I am stuck working out the details though, in particular where to store the security_credentials pointer (so it can be used later in DESTROY()).

You can change AlarmZone typemap to wrap it with an AV (a perl array) then use the first slot for the AlarmZone pointer and the second for the SecutiryCredentials wrapper.

Another option is to extend AlarmZone and SecurityCredentials classes adding a pointer to the Perl wrappers so you can navigate in both directions.

update: Maybe a simpler solution would be to use a fieldhash.