If you are weighing a hospital security director vs security manager, you are probably looking at a job description, a salary band, and a question from finance about why the more expensive title is necessary. You may already have a manager, either your own employee or a supervisor supplied by the guard vendor, and that person may be good. The posts are filled, the reports get written, and the ED calls them when something goes wrong. So the case for a director has to be made in terms of what would actually be different.
I have held and supervised both kinds of roles across law enforcement, fire service, private security, and federal government, and the difference is real. A manager runs the operation that exists. A director decides what the operation should be, owns the risk across the whole campus, and answers to executive leadership for the result. Hospitals that confuse the two usually find out the difference during a survey or after a serious incident, and both are expensive places to learn it.
What a Security Manager Does in a Hospital
A security manager makes the daily operation work. They schedule officers, cover call-outs, handle the ED’s request for a standby, review incident reports as they come in, manage the badge office, respond to complaints from nursing units, and keep the cameras and the access control system running. In a contracted model, the manager is often the vendor’s site supervisor, and their loyalty is divided between the hospital and the company that pays them. This is honest, necessary work, and a hospital with a good manager is better off than one without. The role is also bounded. The manager’s world is the posts, the shifts, and the incidents in front of them.
What the manager cannot do is change the hospital. They cannot tell the emergency department to redesign its visitor flow or tell behavioral health to adopt a different escort protocol. They cannot audit pharmacy’s access list or tell facilities that a parking structure needs different lighting and a different patrol pattern. They cannot walk into the board room and explain the hospital’s workplace violence exposure in terms a trustee understands. They report to someone in facilities, and the authority they carry stops at the guard force.
What a Security Director Does in a Hospital
A director owns the program rather than the operation. They assess risk across the whole campus, from the ED to the maternity unit to the loading dock, and decide what the hospital’s exposure actually is. They set the standards that departments follow for visitor management, infant security, behavioral health response, drug diversion prevention, and parking safety. They write the policy, hold the guard vendor to a contract that reflects the hospital’s real risk, and test whether any of it works. They sit at the same level as the department heads whose operations create exposure, and they report to the COO or the CEO rather than to facilities.
The director is also the person accreditation and regulatory bodies are implicitly looking for. Workplace violence prevention expectations assume an assessment, a program, training, and review, with someone accountable for all four. A director can describe the program from memory, produce the evidence, and explain what changed after the last incident. A manager can describe the shifts.
Hospital Security Director vs Security Manager: The Test
The quickest way to find out which one you have is to look at four things. Look at the reporting line. If the role reports to facilities or to a vendor, it is a manager regardless of the title. Look at the scope. If the person’s authority ends at the guard force and does not reach the ED, pharmacy, behavioral health, or the maternity unit, it is a manager. Look at the audience. If the person has never presented to the board or the executive team and would not know what to say if asked, it is a manager. Look at the testing. If no one has deliberately tried to defeat the hospital’s controls in the past year, walked in through an unstaffed entrance, tripped the infant alarm without notice, or run a tabletop with the charge nurses, then no one is doing director’s work.
That last point is the center of my doctrine. Until Tested: Security Is Only Assumed argues that a program is only as real as the last time someone tried it, and that discipline belongs to the director. A manager keeps the operation running and has every reason to believe it works. A director is paid to find out whether it does.
Why Hospitals End Up With the Wrong One
The usual story is that the guard contract came first, a supervisor came with it, and over the years that supervisor’s title grew without the role changing underneath it. The hospital now has a director on paper who still schedules shifts, still reports to facilities, and still has no authority over the departments where the risk lives. Leadership believes the function is covered because the title says so. The ED nurses, who have watched the same visitor assault two colleagues in a month, know better.
The other story is that the hospital tried to hire a director, could not justify the salary, and hired a manager instead, hoping the person would grow into the larger role. Occasionally that works. More often the manager is consumed by the operation, because the operation never stops, and the director’s work of assessment, policy, testing, and executive reporting never gets done. Both stories end in the same place: a hospital with a manager and no director, carrying director-level exposure.
What to Do About It
Write down what your security leader is actually accountable for, and compare it to the four tests above. If you have a manager, keep them, because you need one, and be honest that the director’s work is not being done. Then decide how to get it done. Move the reporting line for the program out of facilities and up to the COO. Give the program owner written authority over visitor management, workplace violence prevention, and the guard contract across every department. Put security on the board agenda with a single presenter. Require that at least one test of a critical control, an infant abduction drill, an ED lockdown, or an after-hours access audit, happens every quarter and that the results reach the executive team unedited. If no one in the building can do that work, bring in someone who can, even part time.
Go Deeper
For hospitals that need a director and cannot yet fund a full-time one, the fractional model puts an experienced executive over the program while your manager keeps running the operation. I explain how it works in What Is a Fractional Security Director? The Complete Guide, and my book Fractional Security Director lays out the full case for closing the leadership gap with a part-time executive.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply