Security as a business enabler
Security programs measured by business outcomes: faster sales cycles, customer trust, and fewer surprises, not just controls checked.
CISO · Technologist · Attorney
Security that moves the business forward.
I'm a modern, practical CISO: deeply technical, focused on business outcomes, and fluent in the regulations that shape risk. Security may not be the core business, but done well it's what sets the business apart.
About
I'm a Chief Information Security Officer who has led security in both cybersecurity software and healthcare, two industries where trust is the product and the regulators are watching.
I'm hands-on technical. I can go deep with engineers on architecture, cloud, and application security, then walk into the boardroom and talk about revenue, risk, and outcomes. I don't treat security as a cost center or a department of "no". It's an enabler that helps the business ship faster, win customers, and earn trust.
I'm also a licensed attorney, so I read regulations, contracts, and disclosure rules the way a lawyer does and turn them into practical engineering and business decisions. Right now I'm going deep on AI security: how companies can adopt AI quickly without creating risks they can't see.
- RoleChief Information Security Officer
- IndustriesCybersecurity software · Healthcare
- AlsoLicensed attorney
- Based inColumbus, Ohio
How I lead
Technical depth
A hands-on leader who earns engineers' respect: cloud, application security, and secure-by-default platforms that don't slow teams down.
AI security
Practical guardrails for adopting AI, from model and data risk to governance, so the business can move fast with eyes open.
Regulation, through a lawyer's lens
A licensed attorney's read on privacy, healthcare, breach notification, and disclosure rules, turned into clear decisions for executives and boards.
Board & advisory
Cyber expertise in the boardroom, with business judgment to match.
Boards are now expected to oversee cyber risk and explain how they do it to investors, regulators, and customers. Few directors combine hands-on security leadership with legal training and an operator's focus on growth.
I bring all three, and I'm open to board and advisory roles with companies that want cyber risk treated as a business issue rather than a technical footnote.
- Cyber risk oversight. The questions a board should ask, and how to tell a strong answer from a weak one.
- Regulation and disclosure. An attorney's view of privacy, healthcare, breach notification, and cyber disclosure obligations.
- AI governance. Practical oversight of how the company adopts and secures AI.
- Business first. Risk weighed against growth, customers, and cost, never in isolation.
- Incident readiness. Preparing leadership for the decisions a major incident forces.
Speaking
Available for keynotes, panels, podcasts, and executive briefings. Talks are practical, candid, and tailored to technical or executive audiences. Event organizers can grab my bio and headshot from the speaker kit.
Topics
The sandbox held. The attack worked anyway.
AI coding agents are privileged insiders with none of the controls. Where the real attack surface is (config files, MCP servers, tokens, CI hooks) and how to lock it down.
Deterministic gates, AI triage
An operating model for AppSec when finding bugs is cheap and triage is the bottleneck. Security teams become control engineers.
What boards should ask about AI and cyber
Plain-language oversight from a CISO who is also a lawyer: agent incidents, separation of duties, and the gap between adoption speed and governance.
Regulation on a 24-hour clock
The EU Cyber Resilience Act and similar disclosure rules reward organizations that know what's in their software on an ordinary day.
Recent appearances
- [Talk title]
- [Episode title]
Recent thinking
I write daily on LinkedIn about securing AI agents, what to prioritize when you're flooded with vulnerabilities, controls that actually hold, and the governance and regulation leaders need to get ahead of. A few favorites:
Deterministic gates, AI triage
Deterministic engines decide whether something is a finding. AI decides what to do about it.
The EU Cyber Resilience Act's 24-hour clock
Twenty-four hours is not enough time to go find out what is in your software… It is only enough time to look it up.
When an AI agent bypasses access controls
‘The agent was sandboxed’ is a claim that needs evidence, not a design assumption.
Live secrets on GitHub: revocation is the gap
Detection without rotation is just a list of open doors.
Letting AI approve its own code
Nobody approves their own expense report.
The sandbox held. The attack worked anyway.
Stop counting on any control the agent can reconfigure from inside its own session, because that isn’t a boundary, it’s a preference.
Education & credentials
Ph.D.Computer Science (in progress)
J.D.Juris Doctor · Licensed attorney
MBAMaster of Business Administration
M.S.Computer Science
B.S.Computer Science
Professional certifications · ISC2
CISSPCertified Information Systems Security Professional
CCSPCertified Cloud Security Professional
CSSLPCertified Secure Software Lifecycle Professional
Technology, law, and business: the three languages a modern CISO has to speak. Plus ongoing AI coursework from OpenAI, Anthropic, and Google Cloud, completed October 2026.
Let's talk
Pick whichever fits. Every message comes straight to me.
Executive roles
Recruiters and hiring leaders looking for a CISO or senior security executive.
Speaking & podcasts
Conference organizers, podcast hosts, and event teams. My speaker kit has a bio and headshot.
Board & advisory
Companies looking for a director or advisor with cyber, legal, and business depth.