Episode 8. Leadership in Security Operations: Sharing lessons learned

Welcome to another episode of Executive Checkpoint. I'm your host, Tino Urbina. This is a podcast where we connect with security leaders to explore their journeys, insights, and vision for the future of the industry. Today, I'm thrilled to introduce Michael Begley, a seasoned expert with over 2 decades of experience in both government and private sector security. Michael is currently the Chief Security Officer for British Telecom Americas, where he leads efforts to safeguard one of the most critical telecommunication networks in the region. Michael's career has an extraordinary start with his tenure at the U.S. Department of Homeland Security, where he managed significant challenges addressing national security threats and combating intellectual property violations. His work bridges government and private sectors, showcasing his strategic vision and operational expertise. In the private sector, Michael has led senior leadership roles at Stewart Stevenson, Woodgrove Mustang, and JLL, bringing a unique perspective to managing global risk and security organizational assets. He's also a proud U.S. Navy veteran and a graduate of the Harvard University Senior Executive Fellowship Program, combining academic excellence with practical expertise. Michael, we're honored to have you. Thanks for being in the show. Nice seeing you.

Hey, Tino, thank you for having me. I appreciate the opportunity to share some of my background and experience with your viewers.

Absolutely. Was that introduction pretty accurate? Is there something I missed there, or—

Uh, no, pretty, pretty accurate. Yeah, um, so I, I actually started my, uh, my career In law enforcement— well, actually started with the military. I went through Army ROTC in college and I was a military police officer. So my last assignment before I left active duty was I was the commanding officer of the U.S. Army CID district at Fort Knox, Kentucky. So I left active duty back around the time when President Reagan was, was in office. And he was really putting lots and lots of money into federal law enforcement at that time. So I saw a golden opportunity to make a switch from military law enforcement to civilian law enforcement. And I joined the United States Customs Service as a special agent in 1987. And so I worked for 25 years there as a special agent with U.S. Customs. In various different assignments around the country, the kind of last stop on the train for me was here in Houston. I was the deputy special agent in charge for the Office of Professional Responsibility, Houston Field Office, which we covered most of Texas and all of Louisiana and Arkansas. So I had several subordinate offices that reported up to me, and then. On the military side, later in my military career, I did an interservice transfer over to the Navy Reserve. And I was an NCIS agent. I think you guys, your viewers probably know that from the TV show, you know, that role that Mark Harmon, the role that Mark Harmon plays, you know, that was based off of me. Yeah.

I like that plug.

The only part, the only problem was they couldn't find an actor handsome enough to play my part. Yeah. So yeah, I did another 15, little over 15 years in the Navy Reserve as an NCIS agent and traveled the world to a bunch of different NCIS offices at Navy bases all over the world. And that was— gained a lot of experience there because primarily what we did, or what I did, was counterintelligence, which is trying to catch the hostile intelligence services from foreign countries trying— they're trying to spy on, on the Navy and steal secrets from the Navy, so on and so forth. So, um, anyways, in 2012, uh, I retired from the Department of Homeland Security here in Houston, and I was very fortunate. Uh, most people don't have the opportunity that, that I had I was a member of an organization called the Energy Security Council, which is based here in Houston, but it's not solely a Houston organization. It's at least a nationwide, if not a global organization, but it's based here in Houston, and it's made up of security executives from many, many different energy sector companies, not just oil and gas, but any energy sector company. And at the time, uh, well, and still they highly promote the interaction between, uh, law enforcement and private sector corporate security people like myself that worked in oil and gas or other energy sector companies. And so I joined that organization and through the Energy Security Council, an opportunity opened up to me, uh, with a company called Mustang Engineering, which is now Wood Group Mustang out in Katy, uh, Texas, west part of Houston area. And, um, they were looking to start up a global security program. They had no global security, uh, program at all. Uh, when I got there, their entire idea of security was they had a security guard driving around in the parking lots on a, on a golf cart.

Wow.

You know, they were growing exponentially internationally. When I joined the company, they had 18 offices in foreign locations. And so they decided they wanted to get serious about security on a global level. So I worked there, started building their global security program, traveled around to all of the international and domestic offices doing security vulnerability assessments, and set up basically from the ground up, you know, all their policies and procedures for a global security program. Started hiring some staff there. Unfortunately, I was only there about 2 and a half years and we were bought out by a British company called the Wood Group, which once we became part of the Wood Group, they said to our CEO, well, you know, we already have a global security program and we already have a head of global security for Wood Group, so you don't really need to have one anymore.

Wow.

So my position and our group there at Mustang Engineering was pretty much kind of disbanded. So I, uh, I, I moved around to a couple of different other companies, uh, in senior leadership roles in corporate security. Uh, like I was the chief security officer for Stewart Stevenson, which you, you mentioned before. Um, but I worked for several different companies and, um, gained a vast amount of experience. Uh, those are all mostly in the oil and gas sector. Well, all of them were oil and gas sector, but 2 years ago, I had an opportunity to join British Telecom Americas. So we are a wholly owned subsidiary of the BT Group over in the UK, and an opening came up because the former Chief Security Officer for BT Americas was retiring. And fortunately, I was hired for that role. And I'll tell you, making the move from oil and gas over to the telecommunications industry has been a huge learning curve. I always kind of thought that, well, once you were in corporate security and you knew all the basics of corporate security, you could kind of go to any company and, you know, make it work. But the nuances and the differences between what we do in the telecommunications industry and what we did in the oil and gas industry was vastly different. And I'm happy to go into a deeper dive on that if you want to, or whatever other questions you have for me. Sure.

Well, absolutely. That's a, that's a very distinguished progression in your career. And here you are in the C-level. I do have a question. Looking, looking back, the skills that you, you know, acquired in your years working in government, how do you feel those translated into the private sector?

Well, you learn, you know, a lot of the skills I learned, especially as I moved up into more senior roles with with the Department of Homeland Security, you know, those managerial and leadership roles or skills that I learned there, you know, very, very well translated over into the private sector. You know, during my tenure, both in the military as well as with, with US Customs, I went through many, many leadership training programs and managerial training programs, especially as I moved up into higher levels with more responsibility and had more people that reported to me. So yes, those translated very well over into the private sector as far as leading people, leading teams, and especially now, you know, I've led multidisciplinary teams that were geographically dispersed, you know, all over the world. And, you know, that can be challenging in and of itself when people that work for you don't— aren't there where you work. And now post-COVID, when everything seems to be done by Teams and almost everybody's working from home, you know, that has presented its own unique challenges as far as being able to, you know, effectively lead people, you know, when you don't see them on a regular basis or or hardly ever at all. But, uh, I'll tell you, this was one of the things that struck me when I first made the transition from government into the private sector was, uh, I'll just give you an example. Uh, when I was transferred here with Homeland Security from, uh, to here in Houston, Mm-hmm. it was to open a, a brand new office for the Office of Professional Responsibility, which OPR in any federal agency. Some, some law enforcement agencies call it Internal Affairs, some call it OPR, but we were the part of the agency that investigated corruption and misconduct and that kind of stuff within the agency. Uh, so we were opening a brand new office here in Houston, and I was working with the architects for designing the office, you know, because we had to have detention cells and a prisoner processing area and this and that. There was a book, you know, it wasn't all online back then, but there was a book—

Right.

Probably about that thick of all of the physical security requirements for a DHS law enforcement agency office. And, you know, a lot of the things that we had to do were very, very expensive. Like one, for instance, when you got off the elevator on the floor of our building where our office was at, where the reception area is at, We had to have them put Kevlar plating in the walls in that whole room. Because if you think about it, if you just have bulletproof glass for the receptionist, if you just lower your gun and shoot underneath the bulletproof glass and all there is is drywall, a bullet's going to go straight through that. So, you know, we had to put Kevlar plating in the walls and all that kind of stuff. Well, you know, all of that stuff that we had to do was mandated by our physical security regulations, but it was also very necessary. Now, when I— my first, uh, job, when I went to Wood Group Mustang, when I traveled around to all of the international offices, and that was the very first time they had ever had a physical security assessment because they didn't have anybody in charge of security before.

Right.

I came back and wrote up my physical security assessment reports, and I met with our EXCOM, or, you know, top leadership in the company. And presented what for each office, you know, what their current state of security was and where we really needed to be to be, you know, meet industry standards, so to speak. And I was quite shocked when they said, well, yeah, we agree with everything you said, but we don't have the money in the budget this year to do that. And it just kind of struck me as like, what do you mean you don't have the money to do that? I'm telling you, you need to do it. And so that was one of the learning curves for me going from the government into the private sector.

Right.

When you work for a private sector company, they're in the business to make money. And so, you know, you can't just like snap your fingers and they're gonna give you $500,000 to secure an office or whatever. You have to plan for that in long-range budget planning, you know, for, You know, you might be able to do some this year and some the following year and some the following year.

Yeah. And you know, it's, that's, that's interesting because that transition is, is very common for service folks that come with this high standard in their security and access to budgets. And private sector is, is, is difficult. You gotta present an ROI on that, on that solution or something, right?

Well, and you also have to work with the senior executives in the company You have to be an integral part of the business of the company. I mean, I know in the past in security, talking with colleagues of mine that have been in security way longer than I have, but, you know, it used to be the whole thing about, you know, gates, guards, and guns, and that was what everybody thought of, you know, corporate security. But that's really changed over the years to where Chief security officers and other senior management people in the corporate security field really have to be very much in tune and involved in the business and understand what the business is trying to accomplish and how you can support the business. And you have to be an advocate and kind of a salesperson to the senior executives because most of the senior executives don't really know anything about security, and you have to kind of explain to them why what is the business case for why we need to do this and get their buy-in that these are things that need to be done. Every company that I've worked for, that's always been one of my primary goals to do early on is to meet with not only the senior executives at the corporate level, but when you have business units, a lot of those business units have their own budgets that are derived from corporate, but they have their own budgets. You know, one company that I worked for had several different business units that had very, very diverse product offerings. And so therefore, what was of concern to the vice president for this business unit from a security perspective—

oh yeah—

was not a concern for the vice president for this business unit because they had totally different concerns from a security perspective. So you have to meet with those key stakeholders, and you have to understand what keeps them awake at night from a security perspective. And you have to tailor your security program to meet the business's needs, not just try and shove a one-size-fits-all thing down, down their throat. That's not going to work.

Right? It's almost like defining a master security plan for each vertical that the company was involved with, right?

Yeah, yeah.

Let me ask you, And this is, you know, kind of transition a little bit from that to the current season, right? It seems to me that the holidays bring their own challenges to the security world where some of the threats, you know, amplify or increase from the cyber to the physical security side. Where are you guys today, you know, from your perspective, from the C-level, looking at what you're having to deal with? Do you guys— prepare for this situation? How has that planning come along for you guys?

Well, typically, and I would say this is probably, you could say this for just about any company, not just the one I currently work for. But during the holiday season, most of the most people, including the senior executives in the C-suite, take a lot of time off during, you know, the Christmas holidays and You know, the whole, probably the week of Christmas through early January. And so from an executive protection standpoint, um, they're not traveling a lot to places that might require executive protection for them. Uh, so it actually kind of slows down some during the holiday season.

I see.

Because they're not around, they're not, they're not working, they're at home enjoying time with their family or doing whatever they do for Uh, the holidays and, and whatnot. Um, but, you know, talking about, um, having to, um, kind of pivot and, uh, adapt to current things that are going on, everybody I'm sure watching your show knows about recently how the, the chief security officer for UnitedHealthcare was assassinated in New York. Well, when you see instances like that, then obviously you have to kind of reevaluate what your, um, your executive protection program looks like. What are we doing, uh, to make sure our executives are protected, especially when they're traveling to high-risk areas? Uh, you know, and being that we are a British company, you know, uh, I don't handle for when they're traveling, you know, over in like, say, Europe or whatever We have different people that handle that kind of stuff. But, you know, if they're traveling here, let's say to New York, right where that CEO was assassinated, if our CEO was coming to New York, we'd have to have a really kind of a deep dive into, you know, the security posture. Where are they going to stay? What transportation is going to be provided? I heard through the grapevine that one of our senior executives that visited our office in New York several months ago Said, oh, I'll just take the subway go around. And I said, oh no no no no no no no no no.

Never know what's.

I mean because also I'm sure your viewers are very well aware of that Daniel Penny case where you know that guy on the subway was threatening to injure or kill people on the subway. Well, you know I was just up in our New York office two weeks ago and talking with the folks that work up there. I mean, they indicate that, you know, hardly any of them ever ride the subway anymore because it's just so dangerous. And to think that one of our senior executives would just say, well, I'll just take the subway around wherever I need to go. That's like, no, that's a hard no.

Yeah, I think that's romantic, right? People see it in the movies, they're coming to visit the city and they go, yeah, everybody does it, right? It's in the movies. From a security standpoint of view, it's a no-go. You know, what are your reflections of— and you're right, I think that's a worthy point of conversation with the shift on, you know, executive protection. And in the flip side of that, I don't know what you make of the perpetrator having access to a 3D-printed gun, a ghost gun. And, you know, that opens up another can of worms on the conversation of— How to handle that. And he's not buying it, he's building in bits and pieces a deadly weapon.

So yeah, and I don't know a whole lot about those ghost guns and how you make them on a 3D printer or whatever, but my understanding is that the weapon itself is not made out of metal, it's made out of some other types of material which are probably not picked up by magnetometers. And so not only that would be a concern for any company's executive protection program, but also I'm sure the Secret Service is very, very concerned about that, about people being able to potentially secrete a gun made like that out of some type of polymer material that is not picked up by magnetometers, being able to get into an event where the president or the vice president was speaking. I'm sure they're very, very on top of that type of technology and how to mitigate that kind of threat because especially with President-elect Trump already having 2 assassination attempts against him, I'm sure that's one of the things very high on their radar screen. I would say also from in the private sector and corporate security, that needs to be something that our executive protection teams have to be looking at. Especially if there's a specific threat against any of your executives that you're trying to protect. Fortunately, and we have an executive protection team over in the UK that that's their full-time job. They're not traveling around with our executives, but they manage the executive protection program and all that. And I talk with them regularly and, you know, they're telling me that based on the intelligence sources that we have, That there's no specific threats against any of our executives. But obviously, if a specific threat to one of our executives did pop up, like in the case of the CEO with UnitedHealthcare, it came out after he was murdered that he had had several threats against him prior to that happening. Well, you know, when you have a situation like that, you need to take it seriously. You need to really step up your, your, your game as far as executive protection But, you know, in corporate security, and I know a lot of your viewers are probably maybe people that are looking to get into the corporate security field, you know.

Sure.

You have to understand that it, well, it's way, way more than just executive protection. That's one small part of what we do. I mean, you have to take a look at physical security of your facilities, whether it be just domestic or globally. You have to take a look at international travel security for all of your employees. I used to work for a company where we had to send some employees down to Venezuela periodically. And as you, I'm sure, are aware, Venezuela is extremely dangerous to travel to, and we had to put the highest level of protection on them through. And, you know, that raises another issue, is when you're traveling to countries where you don't know if you can trust the police, you don't know if you can trust private security. You know, you really have to vet those people and those, those companies very well to make sure that you're not hiring a company to protect your people that are going to end up turning around and kidnapping your people and turning them into bad guys.

Flipping the profits, right?

Yeah. But, um, you know, and, and, you know, we get involved in internal investigations of employee misconduct or external investigations of Maybe some company or individuals that are trying to extort money from the company or committing fraud against the company. You know, one of the big things also, and this has really popped up a lot in, let's say, the last 5 years or so, is security awareness and training. Most companies that I know about, they're really big on wanting corporate security to provide training to the employees Right. On how to deal with an active shooter situation. You've probably seen the video Run, Hide, Fight. That's kind of the gold standard on training for that kind of stuff, but also workplace violence and all that kind of stuff. So, you know, in corporate security, you kind of run the whole gamut of all of these various different things. And corporate security, like when I was in the oil and gas sector, We had very large facilities that we had to secure, and you know I was involved in you know fence line, you know making sure we had a secure fence line around a hundred-acre facility, you know proper lighting, CCTV, all that kind of stuff. And then when I transitioned to my current role with British Telecom, we don't have big facilities like that that we have to secure. We have Here in the U.S., we have many many server racks because we do cloud hosting of data for big big companies that are clients of ours. And so I'm much more involved in the physical security of our server racks that are located all around in facilities around the country. So yeah, it just kind of depends on the company that you work for what the nature of what you'll be doing in corporate security, and you have to be. kind of resilient in that way to be able to pivot. And, you know, okay, I was doing this before, but now I got to go this way.

Yeah. And it seems to me that that's a, that's a, makes you a better leader, right, to have that perspective and the ability to shift and change. I mentioned to you earlier that there's some of the viewership that are junior folks that are looking to either move their career forward, or they're, they're already in security, they're looking, or they're in mid level positions and they're looking to move to that next level. What, coming to the end of the year, what will be your advice for those folks that are looking to move professionally up in the food chain? What are the skills that you, do you think they need to harness? And what are the challenges that you think they might face as they plan their strategy for moving up in the corporate ladder?

Yeah, well, one thing is I would highly recommend making yourself as well-rounded as possible. All of those things that I just talked about. Um, you know, become as, as much of an expert as you can in, in all of those things, uh, because especially if you're looking to move up into a higher leadership position, the companies are going to be looking for people that have that broad level of expertise. And, and one of the things that I have noticed that has really been a big thing in the last several years is it used to be that corporate security, you know, the traditional corporate security, all the things that I just talked about, was very, very separate from cybersecurity, and that you had cybersecurity here, you had corporate security here, and there may be some interface or interaction between the two. But what I'm seeing now is a lot of companies are wanting people that have both the corporate security expertise and cybersecurity expertise. Mm-hmm. And those are 2 totally different skill sets. And to find people that have— are truly experts in both of those skill sets is, is really difficult. But I do, I do see that trend a lot more in companies when I see like job announcements on LinkedIn or Indeed or whatever. I see a lot more where they're looking for, um, expertise in, in both areas.

I think you're right. That's a, that's a big gap. The, the, the converged approach to security is, is there. We need to, we need to do it. And now with AI, that just amplifies, right?

Oh, sure.

Yeah, I do have a question. We're sort of— this is, this has been so fast and fascinating. We're coming to the end of the conversation. But I did want to ask you, what are the— as we get closer to the end of the year, next week we have Christmas. Are there any holiday traditions that you and your family enjoy as you kind of wrap up the year in Christmas or New Year's?

Yeah, well, I'm very fortunate in that my, my kids are— they're all grown, but I still have one clinging on living here at home, trying to get them out the door. But my other 2 that are older, you know, they don't live with us anymore, but they're all here in the Houston area. And my daughter Who I have 2 granddaughters from her. They only live like a mile and a half from us. So it's, you know, really nice to be able to have them come over and put on Christmas music and, and, and the whole family decorate the tree and all that kind of stuff. And then, um, you know, I don't know how much of your viewership, you know, um, view it this way, but, you know, I am very much against the commercialization of Christmas and a lot more into the religious aspect of Christmas. So our family and myself in particular are very, very involved with church activities during the, you know, this period leading up to Christmas and Christmas itself. But yeah, it's great having, you know, I know a lot of people don't have that luxury to have their grandkids that live only a mile and a half away. But, you know, it's so special to be able to have them come over and we all decorate the tree together and Stuff like that.

Yeah. Do you cook or does your wife cook?

A little bit of both.

There you go.

She's, she's a fantastic baker. So she's, you know, she does the pies and all that kind of stuff. So I have to really give her kudos for that because she makes some great pies.

Absolutely. Well, Mike, I really enjoyed our conversation. I think that we might not see each other face to face until Next year. So Merry Christmas to you and your loved ones. I'm looking forward to amazing 2025. So Happy New Year, right? But it was an honor again having you on the show, and we learned a lot. I think we will have to have you back and maybe have a roundtable and bring a level of expertise to continue to advance the knowledge of the security group. So Again, thank you for your time. For you guys watching, look forward to you again. You enjoy your time with your family and friends. Merry Christmas, Happy New Year, and we'll see you on the next edition of Executive Checkpoint.

Well, thank you for having me. I appreciate the opportunity. Merry Christmas to you and your family as well.

Thanks, sir. Bye-bye.

Take care.