Director of Physical Security

Director of Physical Security

Triumph stores high-value inventory in warehouses that are growing in number and size, and the physical threats against them keep evolving: organized theft crews, insider collusion, social engineering at the door, interception in transit, and attackers who adapt to whatever controls they find. This role keeps our warehouses ahead of those threats. You will not be a coordinator of other people's security work — you will find the risk, decide what to do about it, build the thing, and prove it worked.

The bar for this role is simple: measurably less risk, without slowing the business down with undue process.

This role is onsite and not remote-eligible. You'll be based at our new warehouse in the East Bay, with up to 20% travel to our San Francisco HQ. Occasional East Coast and international travel may also be required.

What you'll do

Own the physical risk picture, end to end. Identify and quantify physical risk across EH&S, guard force operations, protective intelligence, BC/DR, duty of care, loss prevention, executive protection, background screening, M&A due diligence, high-value targets (people and things), and workplace violence. Rank it by actual exposure, write the policies that address the top of that list, implement them, and train staff on them. Ship in priority order — don't wait for a complete picture to start reducing risk.

Secure our warehouses from evolving physical threats. Maintain a current threat assessment for every warehouse, grounded in how theft crews, insiders, and opportunists are actually targeting high-value goods in our industry and region. Re-test controls as those tactics change through inspections, red-team exercises, and incident reviews, and turn what you learn into design and procedure changes rather than reports. You'll join shortly after we move into our newest warehouse, so the first job is making sure it's as secure as it was designed to be: walk the site, test every door, camera, and alarm point against the design, close the gaps the move exposed, and lay out the options and transition path to monitoring as a service. Every future site comes online to the same bar. You'll run the site security review, write the design and specifications (access control and door electrification, cameras, high-value storage, docks, server rooms, and monitoring, with hardware kept vendor-independent), review the integrator's scope and pricing against your design, oversee construction at the moments that matter, and commission every point yourself before inventory arrives.

Reduce external shrink, and own the number. Take responsibility for loss across warehouse, retail, and in-transit inventory. Build case files, run investigations, and work directly with local law enforcement, prosecutors, and organized retail crime task forces to get repeat offenders charged. Design and deploy deterrence, detection, and recovery strategies, then report the dollar impact of each.

Reduce internal shrink with the same rigor. Build the controls that make employee, contractor, and vendor theft hard to commit and easy to detect — segregation of duties on high-value inventory, dual custody and audited handling of graded assets, cycle count and variance analysis, exception reporting that ties warehouse management system (WMS) and access control data together, and camera coverage designed around the points where inventory actually changes hands: receiving, custody, pack-out, and shipping handoff. Run internal investigations to a defensible standard: interview training, chain of custody, and documented findings, in partnership with Accounting, HR, and Legal, with a clear escalation path to prosecution or civil recovery. Distinguish real theft from process loss and mis-shipments, and fix the process problems rather than investigating them twice.

Own security across the employee and contractor lifecycle. Physical security is something people experience every day, and the program should make their day easier, not harder.

Pre-hire: set background screening standards by role and risk tier, with defined adjudication criteria and a fair process for adverse findings — heavier scrutiny where someone will handle high-value inventory, cash, or facility keys.

Onboarding: badge issuance tied to the identity system so access is provisioned from an authoritative source, plus a security orientation that covers duress, incident reporting, and what to do when something feels wrong.

Day to day: access that fits the job and gets reviewed when the job changes, visitor and delivery management that doesn't create a bottleneck, safe parking and after-hours egress, duty of care for travelers and remote staff, and a reporting path people actually use because using it isn't a hassle.

Offboarding: coordinated badge, key, and asset recovery timed with system deprovisioning, and a threat assessment process for involuntary terminations run jointly with HR and Legal — planned before the conversation happens, not after.

Design, deploy, and continuously improve access control, surveillance, perimeter protection, and emergency response for existing and new sites. Walk the sites, write the specs, run the installs, and validate the result through inspection and testing — not through a vendor's status report.

Write the technical design standard our integrators build to. Cover storage construction, door hardware, access control, camera coverage, intrusion and monitoring, and network. Tier it so a small site and a large site each have a compliant answer, and agree it with our integrator as their minimum requirements, so future sites are ordered directly against the standard instead of designed from scratch each time.

Build training that changes behavior. Traveler safety, duress protocols, workplace violence prevention, active shooter response, incident reporting, and general security awareness for both employees and security staff. Run drills and tabletops, measure how people actually perform, and fix what the exercises expose.

Write the operations standard the program runs on. Build it with the operations team on what already works: zoning, visitors and contractors, receiving, custody of high-value product, keys and credentials, floor rules, and incident and emergency response. Design ingress and egress controls and the procedures behind them. Write runbooks for the operations that keep going wrong on a growing floor — deliveries, opening and closing, device handling, visitor escort, and escalation — so they're executed the same way regardless of who's on shift.

Run guard force operations. Post orders, coverage models, escalation paths, shift handoff, and performance standards. Rewrite post orders, procedures, and training on the current guard contract, and set the requirements for its renewal. Hold contract providers to those standards and replace them when they miss.

Share the on-call escalation tier. Guards and site leads handle first response; you and the Head of Security share the escalation rotation behind them. When on call, you're reachable for the incidents they can't close — alarm events, after-hours access failures, suspected theft or tampering, threats, and site emergencies — making the call remotely when that's enough and coming onsite when it isn't. Every escalation ends with a documented outcome, and repeat escalations become fixes to post orders, controls, or training, so the rotation gets quieter over time.

Own vendor selection and performance. Run RFPs for integrators, guard services, and SaaS. Negotiate SLAs, review performance on a set cadence, and terminate underperformers rather than managing around them. Take over day-to-day management of our current integrator and guard-services vendors from your first weeks.

Integrate physical and information security. Shared incident response, badge-to-identity lifecycle tied to the IAM program, and one investigation process across both domains — so a physical event and a digital