Director of Physical Security

Director of Physical Security

Triumph stores high-value inventory in warehouses that are growing in number and size, and the physical threats against them keep evolving: organized theft crews, insider collusion, social engineering at the door, interception in transit, and attackers who adapt to whatever controls they find. This role keeps our warehouses ahead of those threats. You will not be a coordinator of other people's security work — you will find the risk, decide what to do about it, build the thing, and prove it worked.

The bar for this role is simple: measurably less risk, without slowing the business down with undue process.

This role is onsite and not remote-eligible. You'll be based at our new warehouse in the East Bay, with up to 20% travel to our San Francisco HQ. Occasional East Coast and international travel may also be required.

What you'll do

Own the physical risk picture, end to end. Identify and quantify physical risk across EH&S, guard force operations, protective intelligence, BC/DR, duty of care, loss prevention, executive protection, background screening, M&A due diligence, high-value targets (people and things), and workplace violence. Rank it by actual exposure, write the policies that address the top of that list, implement them, and train staff on them. Ship in priority order — don't wait for a complete picture to start reducing risk.

Secure our warehouses from evolving physical threats. Maintain a current threat assessment for every warehouse, grounded in how theft crews, insiders, and opportunists are actually targeting high-value goods in our industry and region. Re-test controls as those tactics change through inspections, red-team exercises, and incident reviews, and turn what you learn into design and procedure changes rather than reports. You'll join shortly after we move into our newest warehouse, so the first job is making sure it's as secure as it was designed to be: walk the site, test every door, camera, and alarm point against the design, close the gaps the move exposed, and lay out the options and transition path to monitoring as a service. Every future site comes online to the same bar. You'll run the site security review, write the design and specifications (access control and door electrification, cameras, high-value storage, docks, server rooms, and monitoring, with hardware kept vendor-independent), review the integrator's scope and pricing against your design, oversee construction at the moments that matter, and commission every point yourself before inventory arrives.

Reduce external shrink, and own the number. Take responsibility for loss across warehouse, retail, and in-transit inventory. Build case files, run investigations, and work directly with local law enforcement, prosecutors, and organized retail crime task forces to get repeat offenders charged. Design and deploy deterrence, detection, and recovery strategies, then report the dollar impact of each.

Reduce internal shrink with the same rigor. Build the controls that make employee, contractor, and vendor theft hard to commit and easy to detect — segregation of duties on high-value inventory, dual custody and audited handling of graded assets, cycle count and variance analysis, exception reporting that ties warehouse management system (WMS) and access control data together, and camera coverage designed around the points where inventory actually changes hands: receiving, custody, pack-out, and shipping handoff. Run internal investigations to a defensible standard: interview training, chain of custody, and documented findings, in partnership with Accounting, HR, and Legal, with a clear escalation path to prosecution or civil recovery. Distinguish real theft from process loss and mis-shipments, and fix the process problems rather than investigating them twice.

Own security across the employee and contractor lifecycle. Physical security is something people experience every day, and the program should make their day easier, not harder.

• Pre-hire: set background screening standards by role and risk tier, with defined adjudication criteria and a fair process for adverse findings — heavier scrutiny where someone will handle high-value inventory, cash, or facility keys.

• Onboarding: badge issuance tied to the identity system so access is provisioned from an authoritative source, plus a security orientation that covers duress, incident reporting, and what to do when something feels wrong.

• Day to day: access that fits the job and gets reviewed when the job changes, visitor and delivery management that doesn't create a bottleneck, safe parking and after-hours egress, duty of care for travelers and remote staff, and a reporting path people actually use because using it isn't a hassle.

• Offboarding: coordinated badge, key, and asset recovery timed with system deprovisioning, and a threat assessment process for involuntary terminations run jointly with HR and Legal — planned before the conversation happens, not after.

Design, deploy, and continuously improve access control, surveillance, perimeter protection, and emergency response for existing and new sites. Walk the sites, write the specs, run the installs, and validate the result through inspection and testing — not through a vendor's status report.

Write the technical design standard our integrators build to. Cover storage construction, door hardware, access control, camera coverage, intrusion and monitoring, and network. Tier it so a small site and a large site each have a compliant answer, and agree it with our integrator as their minimum requirements, so future sites are ordered directly against the standard instead of designed from scratch each time.

Build training that changes behavior. Traveler safety, duress protocols, workplace violence prevention, active shooter response, incident reporting, and general security awareness for both employees and security staff. Run drills and tabletops, measure how people actually perform, and fix what the exercises expose.

Write the operations standard the program runs on. Build it with the operations team on what already works: zoning, visitors and contractors, receiving, custody of high-value product, keys and credentials, floor rules, and incident and emergency response. Design ingress and egress controls and the procedures behind them. Write runbooks for the operations that keep going wrong on a growing floor — deliveries, opening and closing, device handling, visitor escort, and escalation — so they're executed the same way regardless of who's on shift.

Run guard force operations. Post orders, coverage models, escalation paths, shift handoff, and performance standards. Rewrite post orders, procedures, and training on the current guard contract, and set the requirements for its renewal. Hold contract providers to those standards and replace them when they miss.

Share the on-call escalation tier. Guards and site leads handle first response; you and the Head of Security share the escalation rotation behind them. When on call, you're reachable for the incidents they can't close — alarm events, after-hours access failures, suspected theft or tampering, threats, and site emergencies — making the call remotely when that's enough and coming onsite when it isn't. Every escalation ends with a documented outcome, and repeat escalations become fixes to post orders, controls, or training, so the rotation gets quieter over time.

Own vendor selection and performance. Run RFPs for integrators, guard services, and SaaS. Negotiate SLAs, review performance on a set cadence, and terminate underperformers rather than managing around them. Take over day-to-day management of our current integrator and guard-services vendors from your first weeks.

Integrate physical and information security. Shared incident response, badge-to-identity lifecycle tied to the IAM program, and one investigation process across both domains — so a physical event and a digital event on the same person get connected.

Make risk-based recommendations leadership can act on. Bring cost, residual risk, and a clear recommendation — not a menu of options without a position. Keep every site compliant with local regulation and insurance requirements.

Build and test business continuity and crisis response. Write the plan, run the exercise, publish the after-action, close the gaps, and re-test.

Hire, mentor, and lead a team of FTEs and contractors across our Bay Area sites.

Lead security due diligence for new real estate and M&A transactions, and plan and execute executive protection.

Own the budget and prove the program works. Report on metrics that reflect real outcomes — shrink rate and recovery, incident rate and severity, time to resolve physical alarms, drill and audit performance, post compliance, and program cost against risk reduced.

What we look for in you

• 10+ years in corporate or enterprise physical security, including 5+ years leading at the director level or above.

• Hands-on internal investigations experience: interviewing, evidence handling, and working cases alongside HR and Legal to a standard that holds up.

• Track record of building security into the employee and contractor lifecycle — screening standards, access provisioning tied to HR systems, and offboarding that closes cleanly — in close partnership with People and Legal.

• Experience building and leading teams across a range of skillsets, backgrounds, and personality types.

• Experience scaling security programs across offices and warehouses.

• Hands-on experience taking a warehouse or high-value facility from design through construction and commissioning: you've written the specs, reviewed the integrator's pricing, and walked the punch list.

• Experience writing technical design standards, post orders, and runbooks that vendors and guards execute correctly without you in the room.

• Expertise in physical access systems, surveillance design, executive protection, investigations, and vendor oversight.

• Strong risk-management background: assessments, business continuity, and emergency response.

• Excellent written and verbal communication — able to align security strategy with an executive team and defend a recommendation.

• Based within commuting distance of our East Bay warehouse and able to work onsite there, with up to 20% travel to our San Francisco HQ, plus occasional East Coast and international travel as needed.

• Able to take part in a shared on-call escalation rotation, including evenings, weekends, and holidays when on call, and to respond onsite when an incident requires it.

Nice to have

• Established working relationships with law enforcement, and experience taking cases through to prosecution.

• Demonstrated shrink reduction with numbers attached — internal and external — where you can describe what the loss was, what you did, and what it became.

• Experience in financial services, gaming, collectibles, or other high-value-asset industries.

• Regulatory exposure: SOX, FFIEC, FINRA, GDPR, CCPA.