Physical security managers now run networked systems that are as exposed as any server, yet most career advice still treats the job as guarding and patrols. A physical security manager protects people, buildings and assets through a mix of staff, procedures and technology: access control, video surveillance, alarms, visitor management and the response plans that sit behind them. This guide sets out what the role does at each level from guard supervisor to chief security officer, the skills and systems you need (PACS, video management and PSIM platforms), the routes in, the certifications that help and how the career progresses, including into converged roles that span physical and cyber security. It is written for security officers and supervisors planning their next step, people moving in from the military, police or facilities, and cyber professionals taking on physical responsibilities. Pay figures come only from official US statistics, and we say where those statistics run out.
Key takeaways
- It is a management job first. O*NET's Security Managers profile leads with budgets, investigating breaches, coordinating protection of people on site and emergency planning, not standing posts.
- The systems are now IT. Access control, video and alarm platforms run on IP networks, directories and cloud services, so cyber literacy is a core skill rather than a bonus.
- There is a clear ladder. Officer, supervisor, site or operations manager, regional or corporate security manager, director, then chief security officer or a converged security leadership role.
- ASIS certifications are the common currency. APP for early career, PSP for physical security specialists and CPP for managers with responsibility for a security function.
- Convergence is the growth path. Managers who can work with the CISO on badge-to-account identity, building systems and joint incidents are better placed for senior roles.
What the role does
O*NET describes Security Managers (11-3013.01) as directing an organisation's security functions, including the physical security and safety of employees and facilities. Its sample job titles include Physical Security Manager, Corporate Security Manager, Physical Security Systems Manager, Regional Security Manager, Security and Surveillance Manager and Security Director. Core tasks listed there include developing budgets for security operations, identifying, investigating or resolving security breaches, planning and coordinating security activities to protect employees and guests, emergency management and contingency planning, and responding to alarms, bomb threats and medical emergencies.
| Level | Typical titles | Main responsibilities | What changes at this level |
|---|---|---|---|
| Front line supervision | Security supervisor, shift lead, control room supervisor | Rostering, post orders, incident reports, first response, monitoring the security operations centre (SOC) or control room | You are accountable for other people's work and the quality of records |
| Site or operations manager | Security operations manager, site security manager | Contract guard management, PACS and video administration oversight, investigations, visitor and contractor processes, local risk assessments | Budget, supplier management and technology decisions arrive |
| Regional or corporate manager | Corporate security manager, regional security manager, physical security systems manager | Security standards across sites, technology roadmap, programme metrics, travel and event security, crisis planning | Policy, standardisation and influence over business units |
| Director | Director of security, head of corporate security | Enterprise security risk management, capital planning, executive protection, insider risk programmes, regulator and law enforcement liaison | Risk language with the board and executive team |
| Executive | Chief security officer (CSO), converged security leader | Whole security strategy, often including or partnering with cyber security, business continuity and resilience | Accountability for outcomes across physical and cyber risk |
Most of the work is decision-making about risk. ASIS International's Enterprise Security Risk Management (ESRM) guideline, released in 2019, frames the security professional as an adviser who helps asset owners make risk decisions, and that framing is what separates a security manager from a senior officer.
Core skills and tools
Physical security systems
| System | What a manager needs to know | Where to go deeper |
|---|---|---|
| Physical access control systems (PACS) | Credential technologies (proximity, smart card, mobile), controllers and readers, access levels and schedules, joiner and leaver processes, anti-passback, audit reports | See the Physical Access Control Systems Security Guide |
| Video surveillance and video management systems (VMS) | Camera placement and coverage, retention periods, privacy obligations, export and evidence handling, camera firmware and network hardening | See the IP Camera and CCTV Security Guide |
| Intrusion detection and alarms | Zones, alarm verification, response procedures, monitoring arrangements, false alarm reduction | See the Physical Security Guide for Security Teams |
| Physical security information management (PSIM) and unified platforms | Correlating alarms, video and access events into one operator view with guided response workflows; integration and data quality matter more than the screen | Joint detection is covered in the Physical and cyber security convergence guide |
| Visitor and contractor management | Pre-registration, identity checks, escorting, badge return, watch lists and data retention | See the Physical Security Site Assessment Checklist |
Cyber literacy
O*NET's technology list for the role includes facilities management software for alarm and physical access systems alongside firewall and cyber security software and cloud platforms. In practice a physical security manager should be able to:
- Read a network diagram: know which VLAN the cameras and controllers sit on and what can reach them.
- Manage system accounts: remove default passwords, use named administrator accounts with MFA, and review integration and service accounts on the PACS and VMS. These are non-human identities and should be inventoried like any other.
- Own patching with IT: agree firmware update cycles for cameras, controllers and servers, and plan for end-of-support hardware.
- Connect HR and badge data: make sure leavers lose building access at the same time as network access. See the Employee Offboarding Security Guide.
- Spot cyber-physical attacks: CISA's convergence guide gives examples such as a gap in access control letting someone plug removable hardware into a network, or building HVAC systems being overridden to overheat servers.
Management and business skills
- Risk assessment: threat, vulnerability and impact analysis for sites, events and travel, written in business terms.
- Budget and contracts: guard service contracts, maintenance agreements, capital requests and total cost of ownership for systems.
- Investigations: evidence handling, interviews, report writing and working with HR, legal and police.
- Crisis and emergency management: evacuation, lockdown, business continuity links. See the Crisis Management Guide.
- Communication: briefing executives and influencing site leaders who do not report to you.
Routes into the role
| Starting point | Strengths you bring | Gaps to close |
|---|---|---|
| Security officer or supervisor | Operational knowledge, post orders, incident response, credibility with front line teams | Budgets, written risk assessments, technology and networking, a degree or ASIS certification for corporate roles |
| Military or police | Leadership, investigations, threat assessment, crisis response | Commercial language, contract management, privacy law, corporate culture |
| Facilities or building management | Building systems, contractors, budgets, life safety | Threat assessment, investigations, security standards |
| Security systems integrator or installer | Deep PACS, video and alarm knowledge, project delivery | People management, policy, risk framing for executives |
| IT or cyber security | Networks, identity, vulnerability management, incident handling | Guarding operations, life safety, physical threat assessment, law enforcement liaison |
Education expectations rise with the level. O*NET reports that 70% of respondents in its Security Managers profile said the role requires a bachelor's degree, 15% a master's degree and 10% an associate's degree, and places it in Job Zone Four (considerable preparation needed). Front line roles are different: the BLS says security guards typically need a high school diploma and that most US states require a licence, especially for armed guards.
Licensing also reaches managers in some places. In the UK, Security Industry Authority (SIA) guidance says directors of companies whose staff carry out licensable activities need an SIA licence, and that people who do not personally carry out licensable activities apply for a non-front line licence. If you move into contract security management in the UK, check the SIA guidance for your situation.
Certifications that help
ASIS International's certifications are the most widely recognised in physical and corporate security. Eligibility below is as stated on the ASIS certification page on 8 November 2026; check the ASIS Certification Handbook for current fees and rules. Exam format and preparation are covered in the ASIS CPP, PSP and APP Certification Guide.
| Certification | For | Experience required (ASIS) | When it fits |
|---|---|---|---|
| Associate Protection Professional (APP) | Early career: security fundamentals, business operations, risk and response management | 1 or more years of paid security experience | Supervisor moving towards first management role |
| Physical Security Professional (PSP) | Physical security assessment, design and integration of systems, implementation | 3 to 5 years of physical security experience | Site, systems or technology-focused managers |
| Certified Protection Professional (CPP) | All areas of security management | 5 to 7 years of security experience, including 3 years in responsible charge of a security function | Corporate managers and directors |
| Professional Certified Investigator (PCI) | Case management, evidence collection, reports and testimony | 3 to 5 years of investigations experience, including 2 years in case management | Managers with investigations responsibility |
For the cyber half of a converged role, an entry certification such as CompTIA Security+ or ISC2 Certified in Cybersecurity is a sensible add-on; see the Cybersecurity Careers Guide for the wider map. Continuity and resilience work is covered in the Business Continuity Certifications Guide.
Pay: what the official figures show
Official statistics are thin for this role, so treat any single salary number with care.
- Front line: the US Bureau of Labor Statistics (BLS) gives a median annual wage of $38,050 for security guards and gambling surveillance officers in May 2025, with employment of about 1.3 million and growth of 1% projected from 2025 to 2035.
- Management: BLS does not publish a separate wage for security managers. O*NET files Security Managers under the Facilities Managers occupation and shows that occupation's 2025 BLS median of $106,660 a year, which is a proxy, not a security manager figure. O*NET also projects faster-than-average growth for the group from 2025 to 2035.
- Outside the US: we found no official statistics source that separates physical security managers, so we give no figure.
Progression
The step from supervisor to manager is about writing and money: risk assessments, business cases and contract performance reports. The step from manager to director is about influence: getting business units to fund and follow security standards. The step to CSO is about breadth, usually including resilience, crisis management and a working partnership with the CISO.
The converged path
CISA defines convergence as formal collaboration between previously disjointed security functions, and argues that converged organisations are better prepared to identify, prevent, mitigate and respond to threats. For a physical security manager that creates specific opportunities:
- Identity: joint ownership of the link between HR, the directory and the PACS, so one leaver event removes badge and account access. See the Insider Threat and Identity Guide.
- Building systems as assets: cameras, controllers and building management systems in the vulnerability management programme. See the OT Security Engineer Career Guide for the adjacent engineering role.
- Joint incidents: tailgating followed by a rogue device, or a phone call to reception followed by a badge request. See the Physical Intrusion Response Playbook.
- Executive protection: the digital footprint of executives is now part of physical threat assessment. See the Executive Protection and Digital Footprint Guide.
If your ambition is the top cyber role rather than the top security role, the Path to CISO Career Guide covers that route.
Framework mapping
Being able to talk in the frameworks your cyber colleagues use is a practical career skill.
| Physical security activity | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Authorising who may enter which areas | PE-2 Physical Access Authorizations | PR.AA-06 |
| Enforcing entry with PACS and guards | PE-3 Physical Access Control | PR.AA-06 |
| Video and alarm monitoring | PE-6 Monitoring Physical Access | PR.AA-06 |
| Visitor records | PE-8 Visitor Access Records | PR.AA-06 |
| Defining security roles and authority | (organisational) | GV.RR-02 |
Common failure patterns
- Staying operational too long: supervisors who never write a risk assessment or business case struggle to make the jump to manager.
- Leaving systems to the integrator: managers who cannot say who holds admin access to the PACS or VMS cannot defend it.
- Treating cyber as someone else's problem: security systems on flat networks with default credentials undo good physical controls.
- Badge and account processes out of step: leavers who keep a working badge for days after their accounts are disabled.
- Collecting certificates instead of experience: CPP requires years in responsible charge of a security function for a reason; employers look for the record behind it.
Practitioner checklist
- Map your current role to the level table and name the next role you want.
- Write one site risk assessment and one business case this year, even if not required.
- Learn your PACS and VMS administration model: who has admin rights, which service accounts exist, how firmware is patched.
- Agree a joint leaver process with HR and IT so badge and account removal happen together.
- Pick an ASIS certification that matches your experience (APP, PSP or CPP).
- Add basic cyber literacy through an entry certification or structured course.
- Build a working relationship with the CISO and agree two joint incident scenarios.
- Check local licensing rules (state licences in the US, SIA in the UK) before taking contract management roles.
Standards and references
- O*NET OnLine: Security Managers (11-3013.01)
- US Bureau of Labor Statistics: Security Guards and Gambling Surveillance Officers
- ASIS International: Certification
- ASIS International: Enterprise Security Risk Management (ESRM) Guideline release
- CISA: Cybersecurity and Physical Security Convergence
- Security Industry Authority: Licensing requirements for directors
Related NHI Mgmt Group resources: OT Security Engineer Career Guide · Physical and cyber security convergence · ASIS CPP, PSP and APP Certification Guide · Physical Access Control Systems Security Guide