Photo: Unknown photographer (Public domain)
Job description
The work starts with evaluating where a company is exposed, whether that's a building's physical access points or gaps in information security, and recommending specific controls to fix them. Specialists write and update security policy, coordinate staff training and awareness programs, and investigate incidents when something goes wrong, documenting findings for leadership or regulators. Much of it is desk-based, but the job includes site visits to check physical security conditions firsthand, and the pace can spike sharply during an active incident or audit when quick, high-stakes judgment is needed.
Pros
- Large pool of positions nationwide (over 108,000 jobs), more geographic flexibility than many specialties
- Pay can reach $150k with only a bachelor's degree required
- Faster than average projected job growth (3% over the next decade)
Cons
- Above-average hours, expect more than a standard 40-hour week
- Workload can spike sharply and unpredictably during an active security incident or audit
- Gaps in an assessment can have serious downstream consequences, raising the stakes of the work
A typical day
The week's assessment is a distribution campus, and the specialist spends the morning walking it like an adversary would: fence lines, camera dead zones, a propped door that the audit report will feature, and badge-tailgating observed at the employee entrance — noted with times, not names. The afternoon turns analytical: mapping the findings against the client's threat profile, prioritizing fixes by risk rather than cost alone, and drafting the report that must persuade a CFO who sees security as expense. A vendor call evaluates camera analytics honestly against marketing claims. Tomorrow brings the emergency-plan tabletop exercise the specialist designed — because the plan that's never rehearsed is a document, not a capability.
Tasks at the job
- Assess an organization's physical or information security risks and recommend controls.
- Write and update security policies and procedures.
- Coordinate security training or awareness programs for staff.
- Investigate security incidents and document findings.
- Evaluate vendors or technology for security compliance.
- Prepare security assessments or audit reports for leadership or regulators.
Workplace & working conditions
Work is primarily desk-based and indoors, in an office setting, though the job may include site visits to assess physical security conditions.
The pace is generally steady but can spike sharply during an active incident or audit, requiring quick, high-stakes judgment. The role demands precision, since gaps in a security assessment can have serious downstream consequences.
Education necessary or common
Bachelor's degree
Common college majors
Licenses & certifications
- ASIS CPP (Certified Protection Professional, later)
- PSP (Physical Security Professional)
- CompTIA Security+ (for the converged path)
Career path
Related fields
Courses to take
- Government/Law electives — regulatory and legal frameworks
- AP Statistics — risk is quantitative reasoning
- Computer Science — physical and cyber security are converging
- AP English Language — reports that drive decisions
- Psychology — how people actually defeat controls
Clubs, activities & competitions
- Police Explorers or JROTC
- CyberPatriot — the national youth cyber defense competition; the convergence matters
- Model UN or debate — assessment and argument
- Mock trial
First steps you can take now
- Do a security walk of your school or workplace and write a findings memo (share responsibly)
- Compete in CyberPatriot to build the cyber half of the skill set
- Read one physical security fundamentals guide (ASIS publishes intros)
- Interview a security director about how they justify budgets
