Experience

Background

I’ve spent 25 years in cybersecurity, starting as a network security architect, then moving into cloud security, and now focusing on AI security. Along the way I ran my own managed services business for 10 years, so I’ve seen security from both sides: designing controls for large, complex environments and keeping a small business running when there’s no security team to call. I’m a CISSP, and my work is grounded in frameworks like NIST CSF 2.0, the NIST AI RMF, and CIS. The highlights below show the kind of problems I’ve solved and why they matter to an organization like yours.

AI Security

The challenge:

Agentic AI is moving into the business faster than the controls around it, and the vendor market is full of tools promising to close that gap.

What I did:

Led an evaluation of agentic AI security platforms against the OWASP Top 10 for Agentic Applications and the NIST AI RMF for a global enterprise, informing a multi-year AI security tooling investment.
Wrote enterprise AI security standards defining control requirements across governance, data, model, application, and identity.
Ran a risk-cost analysis of a proposed AI model vulnerability scanning platform. It addressed only a fraction of the actual threat surface, and leadership was redirected toward more effective, risk-aligned controls.
Folded model security into a broader, cross-functional effort to secure the software and AI supply chain.

Why it matters for your business:

You don’t need an enterprise budget to make the same call. Know what AI your people are using, put guardrails around it, and don’t buy a tool that only covers part of the problem.

Cloud Security

The challenge:

Cloud environments drift, and misconfigurations pile up faster than anyone reviews them.

What I did:

Built and executed a three-year roadmap to mature an enterprise cloud security program, identifying and closing gaps in cloud security posture.
Evaluated, selected, and deployed a Cloud Security Posture Management (CSPM) platform tuned to tailored CIS Benchmarks, then drove remediation across approximately 200 cloud accounts in two cloud providers and put guardrails in place so the same misconfigurations don’t come back.
Provided security consultancy during an AWS Experience-Based Acceleration (EBA) to modernize container deployment, and supported security requirements across multiple acquisitions and divestitures.

Why it matters for your business:

Your cloud is only as secure as its settings. A defined baseline (CIS Benchmarks are a good place to start) plus guardrails that stop the same mistake twice is the kind of evidence insurers and enterprise customers ask about.

Zero Trust

The challenge:

A large enterprise made up of several companies, each at a different level of technology maturity, needed one consistent way to protect its data.

What I did:

Designed and implemented a zero trust network architecture as part of a transformational, multi-year cybersecurity initiative, and led that initiative’s network security work stream. This service was operationalized and provided across 15 diverse subsidiaries.
Wrote the network security policies and standards, along with the architecture, operations, and training documentation the teams needed to run what was deployed.
Worked with business unit leaders to turn their security needs into designed and deployed solutions, and evaluated and selected the vendors and support partners.

Why it matters for your business:

Zero trust is a way of working, not a product you buy. It starts with deciding who should reach what, and it only lasts if your IT team or MSP has the documentation to keep it running after the project ends.

Network Security at Global Scale

The challenge:

Firewall rules across a global network drift over time, and every undocumented exception becomes a gap.

What I did:

Designed network security reference architectures and led their implementation across a global network.
Remediated firewall compliance drift across a global network with over 240 firewalls worldwide, building and maintaining policy in Palo Alto Networks Panorama.
Led the security side of an SD-WAN design and rollout, and supported incident response and root cause analysis for critical production incidents at global facilities.

Why it matters for your business:

Whether you have two locations or a global network, the problem is the same: rules pile up and nobody remembers why. A standard reference design is how every site stays configured the same way.

Small Business IT Managed Services

The challenge:

Small businesses need the same fundamentals as large ones, with a fraction of the budget and usually nobody on staff who owns security.

What I did:

Founded and ran an IT consulting and managed services business, from 2007 to 2017, delivering network design, virtualization, backup and disaster recovery, and cloud migrations for more than 75 small business clients across the U.S.
Managed the field technicians, the vendor relationships, and all business operations.
Worked on the provider side at a cloud and managed hosting company: supporting firewalls at 3 data centers, running backup infrastructure for customer data, working in the Network Operations Center, and migrating clients from other cloud platforms.

Why it matters for your business:

I have run a small business and sat on the provider side of the managed services relationship. I know what is realistic to ask of a small team, and what you should be asking of your MSP.

Governance and Frameworks

The challenge:

Frameworks and audits only help when they turn into decisions people act on.

What I did:

Ran security assessments of AI/LLM and agentic automation deployments, mapped the findings to NIST CSF 2.0, and drove remediation (asset inventories, access controls, guardrails).
Participated in audits, led remediation of findings, and reviewed and improved security policies and procedures.
Developed a cloud security charge-back model to recover service and technology costs, and handled vendor selection and contract negotiation for new partners.

Why it matters for your business:

Governance is where security becomes a business discipline instead of a technical checklist. It is the same NIST CSF 2.0 approach behind the Strategic Horizons.

Ready to Gain Clarity?

Get in Touch!