Law-enforcement experience alone does not make someone qualified to manage private-sector risk.
At Goldman Sachs’ Office of Global Security, I oversaw physical security for select affiliates and subsidiaries. After Goldman acquired a large controlling stake, typically 70 percent or more, I implemented or integrated security policies, procedures, systems, and controls across offices, commercial properties, and complex industrial operations.
This work required more than effective security programs and infrastructure. I had to understand each organization, including its people and operations, its regulatory obligations, and the consequences of leadership failing to meet Goldman’s standards, which always exceed those of the organization itself.
One incident has stayed with me.
Goldman controlled a Dallas-based commercial real estate company with a substantial South Carolina office. One day, the South Carolina HR director called about an employee who threatened to kill her after he was terminated. Understandably, she was terrified.
Under the company’s governance protocol, I contacted its Chief Administrative Officer (CAO) in Dallas. Because the company was a separately managed Goldman affiliate, I was expected to coordinate through him, not act unilaterally. He said he would investigate and call me that day. He never did.
The next day, the HR director called again: the former employee was in the parking lot. I told her to call the police immediately and contacted the CAO. Astonishingly, he said he would do nothing because his assistant’s fiancé, a local Dallas area police patrolman, didn’t consider it a problem.
The threat had occurred in South Carolina, and the former employee was outside the South Carolina workplace. Yet an uninvolved Texas patrol officer had become the excuse for inaction.
I told the CAO I would handle it, arranged additional security at the South Carolina office, and took steps to protect the employee and workplace.
The company’s CFO, the CAO’s manager, was furious. He accused me of overruling his executive and tried to get me fired. I had—and would again. Their reaction and disregard for employee safety, driven by a childish corporate turf battle, were irresponsible and dangerous, all under the pretext of advice from a local police patrolman hundreds of miles from the actual incident.
Law Enforcement and Security Are Not the Same Profession
This incident illustrates a persistent misconception in corporate America: that police experience automatically makes someone a security expert.
Police officers perform an essential public function. Experienced officers can bring valuable judgment, composure, investigative skills, and knowledge of criminal behavior to a corporate security program. However, those capabilities do not automatically translate into expertise in private-sector security and risk management.
A police officer enforces the law; a corporate security professional identifies and reduces risks, protects people and operations, advises management, establishes controls, documents decisions, and supports the organization’s duty of care.
One operates under public authority; the other under corporate governance, employment law, regulations, business continuity, insurance, privacy constraints, and potential civil liability. The professions overlap but are not interchangeable.
“The Police Don’t Think It Is a Problem” Is Not a Risk Assessment
In this case, leadership knew that a terminated employee had issued an explicit death threat, that the frightened target had reported it, and that the former employee returned to the workplace the next day, leaving the potential victim exposed.
These are not vague concerns. They are a documented workplace-violence scenario requiring immediate assessment and protective action.
CISA recommends trained, multidisciplinary threat management that considers behavioral, physical-security, personnel, legal, and organizational factors. OSHA defines threats, intimidation, and similar conduct as workplace violence, even without physical assault.
Police may decide if immediate intervention is needed, but employers remain responsible for protecting the threatened employee, limiting the former employee’s access, securing the property, seeking legal protections, managing and documenting the threat, informing staff, and maintaining safeguards after police leave. These are employer risk-management decisions.
An organization cannot delegate its duty of care to an uninvolved police officer—especially one operating hundreds of miles away and receiving the story secondhand.
Security Requires More Than a Résumé
Companies frequently make another mistake: they appoint a former police officer or federal agent as security director and assume the security problem has been solved.
Sometimes they hire an exceptional professional who learns the business, develops broader expertise, and builds a credible risk program. Most often, however, they hire someone who still sees every problem only through a law-enforcement lens.
A qualified private-sector security leader needs expertise in violence prevention, threat assessment, protective design, liability, crisis management, business continuity, compliance, investigations, privacy, oversight, budgeting, documentation, and executive advice—not just crime and emergency response. Law enforcement experience alone cannot prepare someone to master these disciplines.
Management Still Owns the Decision
The problem wasn’t an uninvolved officer’s reported casual opinion, but executives using it to justify inaction—a governance failure.
After a credible threat, leaders need not be certain violence will occur to take reasonable precautions. Risk management means making proportionate decisions with incomplete information and documenting why they were reasonable at the time.
Additional security couldn’t guarantee safety, but it reduced exposure, reassured the employee, increased workplace visibility, and showed the company took the threat seriously. That’s responsible security management.
Respect the Badge - Examine the Qualifications
This is not an argument against hiring former police officers; many become outstanding security executives, consultants, investigators, and threat-assessment professionals.
Law-enforcement service is valuable but doesn’t prove expertise in private-sector security, workplace violence, protective design, corporate governance, or enterprise risk management. A current or retired badge isn’t a universal security credential.
When an employee says, “Someone threatened to kill me, and now he is outside,” the organization needs a competent assessment, decisive leadership, reasonable safeguards, and an accountable decision-maker—not an informal opinion from someone who knows a cop. “A police officer told us not to worry” is neither a security program nor a defense.