🛡️ SecOps
SIEM, SOAR, MSSPs, DLP, IDS, EDR, SASE, SEG, incident response.
README
Hey! I lead security programs and stay in the work across operations, identity, AI, cloud, appsec, and GRC. #Player-coach. Using this page to bring a resume to life and to collect my writing and speaking.
Things I Do
🔐 IAM
SSO, MFA, phishing-resistant auth, device binding, PAM.
📜 GRC
SOC 2, ISO 27001, risk management, audits, control frameworks.
☁️ AppSec & CloudSec
ASPM, CSPM, vulnerability management, DevSecOps, SSDLC, bug bounty.
🔍 TPRM
Vendor assessments, due diligence, lifecycle and ongoing monitoring.
💻 Endpoint Security
MDM, secure baselines, patching, hardening, enterprise browsers.
📈 Program Leadership
Strategy, KPI reporting, budgeting, talent management, cross-functional leadership.
😶🌫️ Privacy
PIA, DPA, data classification, privacy by design.
🚀 Go-to-Market Security
Security questionnaires, RFPs, Trust Center, reviews, contract support.
Tech I Use
Hover any logo to see a musing or spicy take 🌶️
📜 standards/regs I speak
Hover any logo to see the standard name and a quick take.
Writing & Talks
things I've written and places I've spoken
Where is Security's "Great Leap Forward?"
Developers now have AI agents that orchestrate their entire workflow. Security practitioners are still doing the dashboard dance. Part One of a series on what security's equivalent leap forward could look like.
Prompt it till you make it
AI copilots for Security Growth — how security practitioners can harness AI tools to scale their programs and accelerate their careers.
How LogicGate Uses Risk Cloud
A talk at LogicGate's Agility 2021 conference on how LogicGate uses its own Risk Cloud platform. The talk wasn't recorded, but a related marketing video is available on YouTube.
Doing Our Part: LogicGate's Bug Bounty Program
How a bug bounty program enables near-continuous penetration testing without the cost and bandwidth overhead of repeated stand-alone tests.
Responsible Security and Responsible Disclosure: Why a VDP Matters
A Vulnerability Disclosure Program gives external security researchers a clear path to report vulnerabilities — and why that matters for any mature security program.