Eps 3 From Crisis to Command: Building Resilient Security Strategies

Well, hello and welcome. My name is Tino Urbina. Welcome to Executive Checkpoint Podcast, where we dive into the insight and experiences of leadership in the future of technology and security. Welcome to a new episode. Today, we're very thrilled to have Melissa Mack, Certified Protection Professional and Managing Director at Pickerton. With over 2 decades of experience, Melissa has established herself as a leader in security management, Working across various industry sectors and supporting organizations through comprehensive risk management strategies. Her career spans in both public and private sector, focusing on workplace violence prevention, crisis management, and operational resiliency. Join us as we explore Melissa's journey, her impactful work in security and risk, and the insights she's gathering in the mission to promote safety, and integrity in the industry. Melissa, welcome to the show.

Hey, Tino, thank you for having me. I appreciate the opportunity to join you today.

It's very exciting. So, you know, as always, we're gonna start at the beginning. I'm very interested to hear your journey starting in the security industry. So tell us a little bit about your, your background, how'd you get started, and, you know, the progression to where you are today?

Yep. So been in security management really my entire career. I started out while I was in college. I was going to school for criminal justice down here in Texas. I was looking forward to joining the police academy once I graduated. I was working as a correctional officer for the Texas Department of Criminal Justice, and my senior year, somebody from Target Corporation, their asset protection, came spoke in one of my classes. And I've always kind of also been interested in business, and I thought, what a great opportunity to marry the two— criminal justice and business. And so I started out at the College Station Target as the asset protection team leader, catching shoplifters, employees stealing, theft, running covert cameras up in the ceilings, you know, back in the day when we used to get on scissor lifts and run coax across an entire store, but gradually progressed through retail asset protection with Target and then moved on to Eddie Bauer Stage Stores, and then Eddie Bauer, landed at McDonald's managing 2,800 restaurants from a security standpoint. So definitely learned a lot about risk management, incident response. As you can imagine, McDonald's is a 24-hour operation and Um, high volume, you know, obviously a, a big brand. So, um, got my experience there and then continually progressed and landed here at Pinkerton about 3 years ago. So always on the practitioner side. Uh, prior to coming over here, I was leading global corporate security for Willis Towers Watson, and, uh, Pinkerton was a service provider for me and, um, had an opportunity to, what I say, come to the dark side. And, uh, I've really enjoyed it ever since I've been here. So it's great.

Oh, great. And, you know, to me, as we were talking about earlier, a little bit about transitioning from the public sector to the private sector, how was that for you? I mean, what were the challenges when you went from public to private?

Yeah, so my time in public sector was pretty short, but I've always obviously had a nexus and worked with law enforcement folks. But it's definitely just a different operation, right? The way that the framework, the structure, Operationally, how things are set up is certainly different, but the transition for me was, was fairly easy because, again, I was very early in my career. So there was a lot that I didn't know. So I was able to kind of, you know, flex and make that transition. But I do currently now work with a lot of folks that transition out of military or law enforcement over into the private sector. I've been doing that for about the last 5 or 6 years helping with, you know, resume writing, interview coaching, things of that nature, just really as a way to give back. But I find it, you know, when we talk about the collective of the security industry, we're so great at what we do because of the various backgrounds and the journeys that our professionals have, whether it's academia, it's law enforcement, military, technology, sales, You know, it takes all of us collectively. And so, you know, I find that military and law enforcement folks have the skill sets, the qualifications, the experience, everything that we need here. So it's just a matter of how do you translate that over? And it's very much needed in our, in our industry.

No, absolutely. And, you know, I think their qualifications extend on, you know, the amount of dollar projects, or, you know, then they're managing in the military, for example. And so how does that— how do you translate that experience? You know, a couple examples, maybe for someone out there looking at making that transition? How do you transition? Or how do you present that experience to the private sector?

Yeah, so I think it's a matter of looking at the foundational skill set that their experience has, and then being able to Um, kind of do a deep dive into business, especially from a security risk management standpoint, and understand the parallels, right? So it's recognizing what the skill sets are. So adaptability, crisis management, emergency planning, project management, team leadership, you know, all of those are foundational skills that, um, you know, folks in military and law enforcement have working in, you know, with their experience. And it's just being able to articulate how you bring that over into the private sector.

Mm-hmm.

Not so much tactical and transactional. A lot of times I think that's where the challenge comes in, is shifting from that transactional mindset of I do X, I do Y, I do Z, but really about the value that you bring. You protect people, you give people peace of mind, you bring that critical thinking skill set, you bring judgment, you know, good judgment, you know, decision-making skills. Those are the things that are going to support them in their journey in the private sector, not so much the tactical day-to-day. And as we talk about, you know, kind of the theme for our conversation today around strategic leadership, that's the direction security risk management is going. We've got to really focus on being transformational leaders, being strategic in nature, proactive versus reactive, you know, and all of that is rooted in planning and things of that nature. That way, You've, you've got plans in place, but then it allows for the flexibility when, when things happen, right? So it's really shifting from that mindset of tactical transactional to being more strategic, proactive. And then of course, the underlying business acumen is a necessity.

Definitely agree. You know, it comes to mind, you being a woman in security, right? There is a big segment, and we talked about this all the time, we need more women in security, we need new practitioners. Your experience as a woman in security, but especially as a leader, understanding your career, how has that impacted your leadership style?

That's a really good question. And, you know, obviously leadership over the course of one's career, their leadership style, it grows, right? It changes, it adapts. You learn different things from different leaders that you work under. I always say you learn just as much from a bad boss or a bad leader or a bad company that you do from a good one, right? You learn— all of those are things that you take and it helps you adapt your own leadership style. I think one of the things I've learned now, 25 years in, especially for women, but, you know, when you, when you are able to take that next step in your career and you're able to advance and take on a new leadership role, It's important to stay authentic to your leadership style. A lot of times when you receive that promotion or you take that advancement or that new role, you look at those around you at the leadership table and you think that you need to emulate their path for success or their formula for success because that's the company you're now amongst. But that's not what got you there. So I think it's important that you really stay authentic to your leadership style, whether that's Collaborative or servant leadership, or you know, you know whichever situation you know predicates the type of leadership that you evoke. But staying authentic to that, obviously still learning from the leaders around you. You're always kind of taking those nuggets of wisdom and and helping to to reshape yours. But don't feel like you have to change something because you're now sitting at another level or in a new position, because what got you there. is working. So it's successful, it works for you. And just being true to who you are, I think. And it's that diverse thought that you bring to the table that really is what shapes kind of a well-rounded, you know, strategic team or approach and really being able to contribute value to the, to the objectives that you're trying to accomplish.

You know, something comes to mind. I heard this before. Challenges are preparation for greatness.

Yes.

Welcome to challenges. And genuine— I think genuine leadership is never going to be underrated. Absolutely. You know, one of the things that I think is very important in your career is you develop a lot of safety programs, workspace safety programs. And I was wondering if you can maybe walk us through a couple key elements of creating a program that effectively safeguards employees. Just generally walk us through one of those examples.

Yeah, no, definitely. Really what comes to mind is my experience in my time at McDonald's. With 14,000 US restaurants at the time, we really didn't have a formalized workplace violence prevention program, if you will. Oftentimes we executed elements of workplace violence programs, but there wasn't really a framework around it. We weren't always consistent in the way that we manage threats, whether they were persons of interest or groups of interest, things of that nature. And so I think for anybody that's looking to develop a plan, or maybe you just need to reevaluate yours, it's first rooted in standards and best practices. So it's, it's whether you're connected to ASIS and you leverage, you know, their workplace violence, you know, the technical standards and guidelines. Really take the document, review it, go step by step, and understand kind of what all the different resources that you have to create a program, or ATAP, or any of the other great organizations that you can tap into to, to really create your benchmark for your desired state. And then it's important to do a current state evaluation of what you have. So that's speaking with all your key stakeholders, that's looking at You know, your, the personnel, security personnel, HR, understanding who's responsible for what, legal communications, everybody that's responsible or a nexus to workplace violence incidents. Obviously looking at the technology side, physical security systems and measures that are in place, and then policy and procedure, right? So doing a current state evaluation or a program assessment of that. A lot of times, it's helpful to bring in a third party to conduct that assessment, especially if, if you've been in the role for a long time, you kind of tend to put those blinders on and—

Recognize, right? It is.

And it's, that's a very natural thing, right? That's very common, especially if you, you know, you've been a part of it for a while. And I know sometimes there's reluctance for people to do so because, you know, from an assessment side, sometimes you feel like that final report, it's going to go to your leadership, and then You know, maybe if there's negative mentions or there's gaps, then there's this concern that, oh man, you know, leadership might be like, what's Melissa been doing? Why are there so many gaps? Right? So there's sometimes reluctancy to have that assessment completed. But, you know, having that objective view of it so that you really are identifying all the vulnerabilities, all the gaps, getting that subject matter expertise opinion to be able to identify mitigation strategies, prioritizing those elements. But having that be a collaborative process, not just strictly driven by security, but really having all those key stakeholders at the table, it really supports the ESRM concept where there's buy-in for all the business units. And then at that point, once the plan is in place, the program, you know, you've got the policy procedure, everything is documented and created, then it's just a matter of dissemination. It's a matter of How do you communicate this out to every employee across the organization? So all those that are responsible and accountable, all the way down to, you know, at McDonald's, it was all the way down to that 16-year-old employee working the drive-through, right? Because, you know, that's where, you know, the threat, you know, meets the person because you may have somebody come through in potential, you know, robbery situation or something of that nature. So it's creating the culture of security where there's onus and responsibility You know, really pushing forward situational awareness so everybody feels that they're accountable for it and that, like I said, there's an onus for it. So now you have a culture that's created versus just security being responsible for the execution of keeping everybody safe.

Yeah. And you know what, to your point, I think there is a lot to say about the maturity of an organization when all the stakeholders come in and they are agreeable to move forward Even if it's negative, right? I think that's a, that's a key part because, uh, you know, situation— situations change and, you know, um, it's, you know, location-based. And so you have to be flexible in that planning. So people, people, process, and technology are key. But to me, I think, um, sometimes we miss the conversation about governance, right?

Yeah.

Actually implementing, um, uh, you know, especially in the retail sector like McDonald's, and I think of it, you know, Obviously food, but retail in the sense that a lot of people engage and walk in and out of these locations. Legal, I'm sure, is a big portion where, you know, someone engages in a situation with a customer or someone. How do you guys usually manage that training for those individuals on the ground, the employees dealing with the public in general? How much do you get involved in that portion of the training for the organization?

Yeah, so I, regardless of the, the industry vertical, right, like it, it, it needs to go from top to bottom. Um, and I think a lot of times there is sometimes a disconnect between that, that person that's on the ground versus the person that sits in the, the tower at corporate. Um, so it's, it's being able to, to really have that 2-way conversation and know exactly what they're facing on the ground, but it needs to be put in a con— the training needs to be created in context that's applicable to every employee. So what does that real-life situation look like? You know, we're even seeing that, you know, we see that a lot. You know, we're right now dealing with, you know, Hurricane Milton and what we're seeing on the ground there. And it parallels very much so. Like a lot of times, even some of our clients that, you know, as Pinkerton, we're providing, we've got boots on the ground right now for some retailers right in North Carolina. And oftentimes we find that the local teams, there's a big disconnect for what the actual need is on the ground versus what, you know, the corporate or the, you know, the key stakeholders at that higher level are understanding. And so being able to have that communication where it's transparent, it's candid, this is— and people listening on both sides, hey, this is what we're seeing, this is what we need. And so that way it's applicable and it's not just noise and it's there's actually, you know, empathy and care and collaboration behind the efforts that are in the resources that are being contributed to it.

I think that's a key word, empathy. I think as security professionals, sometimes the focus is on the process. And we forgot that the user, or, you know, someone is going to have to go through that specific training and process and dictate that. We talked about the current situation in Florida, you know, My heart goes to all the folks in Florida that it's been hit twice. So crisis events like this are obviously— for a hurricane, there's some level of planning because we know that it's coming. But what's the process for you and your team when something like this happens, and in this case twice for the folks in Florida?

Yep. So luckily with hurricanes, we kind of— we've got, you know, About at least a week's notice a lot of times, especially those of us, you know, Tino, we're down here on the Gulf Coast, so we're no stranger to hurricanes. We, we've unfortunately lived through many of them. And so it's a matter of connecting with our clients, knowing where their operations are, reaching out to them ahead of time, but not just the week ahead, right? It's, you know, once you, once you are a true partner and work with any organization, it's always taking a look at their emergency response plans, always offering guidance, consultancy, advising them on, hey, let's take a look at your plans. Let's see, let's conduct drills. Let's do some training exercises. Let's put these plans to test and constantly evaluating those. I think those organizations, I think in the recent ASIS report that they did for, you know, security risk management where, you know, interviewed and surveyed many CSOs globally, I think you find that they're able to really operate from a level of resiliency by reviewing their plans at least on a quarterly or semiannual basis, right? So it's going through those and being a true partner to help look at those, make them better. But it's all about the preparation. Because the more you prepare, you know, once stuff hits the fan, you're then able to flex where you need to. So it's getting out in front of it as much as possible, securing resources, recognizing plan A, B, C, D, you know, where can you, you know, provide supplement support from that standpoint? And then understanding that the situations are always fluid. It's, you know, how do you scale up or scale down, you know, just depending on the current state situation on the ground.

Yeah, and you know, you as a professional work with some high-risk sectors. Yeah, I mean, in this case we're talking about regional situations, but you guys do have that high-risk sectors that you help and prepare for resilience in practice. What is the most challenging sector that you deal with? that you guys have, you know, successfully allowed them to align their security practices?

Yeah. So I don't know if there's necessarily one that's more challenging. I think the most challenging sector is probably the programs that are the least mature from a security standpoint. I think when you have security programs or security risk management programs that are maybe at a 2 or 3 on a scale of 10, in these crisis-type situations. And it's not a matter of they're not good. It's just a matter of maybe they're in infancy stages. Maybe they've had turnover at a leadership level. Maybe, you know, it's just trying to secure the budget and resources. You know, it takes investment, right, to get security personnel, to get technology in place, to conduct training and things of that nature. It takes buy-in from a leadership level. So I don't know if it's necessarily an industry sector. I think you face the same challenges. It's just more of those programs where you know, or maybe you have a security manager or lead that's in place that's maybe new. And so, you know, maybe they're experiencing these things for the first time, or maybe you have an organization where they don't even have a security department. You know, it's facilities that also is responsible for HVAC and power and everything else, but they're also responsible for security, or maybe it's the EHS person, right? So those typically are the most challenging But that's where it's great to partner with a service provider that has the expertise that can say, hey, you know, this is— let's go step 1, 2, 3, 4. Let's start here from a priority standpoint. This is the recommendation. That way they feel like they don't have to figure it all out on their own, especially, you know, in a short window when there's imminent concerns.

Right. It's political capital. It's always best to, you know, Keep it, you know, if you're a leader listening, you know, don't burn it and bring a third-party consulting group that has, you know, an incredible history. I mean, you guys as an organization, you know, I love the story of the history of the company. But, um, talking about technology, you mentioned, you know, um, the maturity of a business and, you know, the leadership and whatnot. That I think is the same for the technology that some companies choose to bring You know, is there an impactful technology that you've seen that you're excited about, that you guys are eager to implement?

You know, from a Pinkerton standpoint, I think it's about the predictive intelligence, right, or the protective intelligence. So, you know, currently we have a proprietary crime risk intelligence tool that helps with identifying crime risk ratings in areas. You know, currently we can support the US, Canada, Mexico, Sweden, the UK. And what's great about it is, you know, when you're looking at budget dollars that, you know, are tough to get these days in today's economic environment, and many security programs are being taxed with cuts, right? Like, hey, how can you save? How can you do? You know, a lot of times we understand that our biggest cost is, you know, kind of that infrastructure or labor, right? So, or from that technology standpoint, systems. So being able to use data to support how you allocate those resources, right? So leveraging a technology and information such as crime risk ratings that really takes a look at what that, you know, day of, you know, day of week, seasonality, the time of day, that you're more likely to experience or see violent crime or property crime, it helps you then from a resource standpoint with that allocation. So, you know, any type of data-driven information is gonna, you know, is key for today's operating environment. It's no longer, well, I think maybe we should put a camera here, or maybe we should put, you know, security personnel here. It's having the information to help you make that informed decision. And then, of course, layering. There's so much amazing technology that's out there today. I know, you know, especially coming off GSX, it's, it's fun to, you know, I'm kind of a nerd for it, and I like to walk around and look at all the new systems and the things that people are coming up with, the innovative aspect. And then of course you've got AI. Um, and if, if there's any, you know, if, if you have any runway left of a career here in security, I think You know, getting, getting abreast of AI and how it can be leveraged as a resource and a tool is critical. There's definitely some advantages to it, a lot of efficiencies and things of that nature, but you're always going to need the human element, always. So regardless of the data that's provided, the system, the tool, the whatever you have, you still need that human aspect to analyze, tell the story, make the decisions. And so being able to really understand as a strategic leader, how do you combine those to best lead and create your resilient organizations and cultures?

Yeah, and you know, we always talk about physical security, cyber, IT, but we always miss that human component in security that is so key. And I, you know, AI has made, you know, incredible advances in intelligence and data analysis. And, but as you said, that human element has to exist. And speaking of, you know, people, someone starting their career in security or shifting, you know, we're talking about the public sector. What would be your advice for someone getting out of college looking for a potential opportunity to make a living?

Yeah.

What would be your advice for them? understanding that we're in the security industry, what will be your recommendation for them to get involved with security?

Yeah, so just recognize that the sky is the limit. And I think a lot of times, people that don't know about security, their only perception is maybe just that public-facing security officer that they see, you know, at a public place like a stadium or a mall or a movie theater. They don't realize the layers and opportunity and dynamics of the entire industry globally as a whole, right? So knowing that, identifying what your interests are, because obviously you want to enjoy what you do, right? So whether that's technology side, whether that's being innovative, but maybe you're good at sales. Maybe you really care about protecting people or you're, you know, you're keen on forensics or investigations. There is a pathway for all of those interests. There is a pathway of positions that are available. And a lot of times, even, you know, when you take a look at public sector, you know, every job responsibility or duty or, you know, interest that's there, there's something that's very translatable in the private sector. So figuring out what you like, diving into, you know, connecting with different organizations, you know, ASIS really was a game changer for me just because It opened my mind up. I only knew one, one lane. And then, you know, once you see it, you're like, wow, the possibilities and opportunities are endless. So connecting with people in the industry to really figure out where the opportunities are, and then just try it, you know.

You know, the networking, and, you know, one piece of advice I think is key is, like you said, go to networking events, meet people, talk to them, and there's plenty of opportunities. It's not just the guard standing somewhere, right?

Right.

Well, Melissa, I love to hear some words of wisdom from you today to the Melissa when starting her career. What would you tell that Melissa?

Gosh, hang in there. It's gonna be a wild ride, but it's gonna be very it's gonna be enjoyable. And it's a very, you know, I find that the security industry is a very purpose-driven industry. At the end of the day, we're all here for life safety.

Mm-hmm.

It doesn't matter which avenue you're in and what aspect of the industry you're in. If you, you know, if you're a problem solver and you really care about taking care of people, you know, it's very, it can be very rewarding. And I've made some of the greatest friends and colleagues And I'm excited for another 20 years. So, you know, I definitely, I'm all about it, you know, helping people get, get in where they, where they would like to.

So. Absolutely. Well, Melissa, this has been quite enjoyable. So glad that we finally got the chance to do this.

Thank you.

I'll say, as I mentioned to my previous guests, that eventually we'll have a roundtable. We'd love to have you back if you're willing and excited.

Absolutely.

So Melissa, if someone wants to get in touch with you on a professional level through LinkedIn, will that be the easiest, fastest way?

Absolutely. Yep. Find me on LinkedIn.

Great. So again, Melissa, thank you so much for joining us today. This was a joy to have you here. And please comment and ask questions. You know, we'll have some more posting questions for Melissa over the next couple of weeks. And, uh, thank you for joining us for this show today.

Yep, enjoyed it, Tino. Thanks so much.

Always.