Strategic Security Leadership & Expertise
Two decades of hands-on experience in security engineering, incident response, and executive advisory — now available to help your organization build resilient security programs from the ground up.
Consulting Services
Tailored engagements designed to meet your organization where it is and take it where it needs to be.
Virtual CISO (vCISO)
Executive-level security leadership without the full-time commitment. Strategic guidance tailored to your organization's risk profile and growth stage.
Key Deliverables
- Security program roadmap & maturity assessment
- Board/executive security briefings
- Risk register development
- Security budget planning & vendor evaluation
- Regulatory compliance strategy (SOC 2, ISO 27001, NIST CSF)
- Incident response escalation & advisory
Startups, mid-market companies, and organizations without a dedicated CISO
Security Program Development
Build a comprehensive security program from policy to operations. Governance, risk management, and compliance frameworks designed to scale with your business.
Key Deliverables
- Security policy & standards documentation
- Risk assessment methodology
- Compliance gap analysis & remediation roadmap
- Security awareness training program
- Metrics & KPI framework
- Third-party risk management program
Organizations building their first formal security program or maturing for compliance
Software & Product Security Program
Shift security left in your development lifecycle. DevSecOps integration, threat modeling, and secure development practices that ship secure software faster.
Key Deliverables
- Secure SDLC framework
- CI/CD security pipeline design (SAST, DAST, SCA, container scanning)
- Threat modeling methodology
- Secure code review process
- Vulnerability management workflow
- Developer security training curriculum
SaaS companies and engineering teams building security into development
Detection & Response Program
From detection engineering to incident response playbooks. Build the capability to find threats early and respond decisively when it matters most.
Key Deliverables
- Detection strategy aligned to MITRE ATT&CK
- Custom detection rules & tuning
- IR plan & role-specific playbooks
- SOC runbooks & triage procedures
- Tabletop exercise facilitation
- Security tooling evaluation
Organizations with security teams needing to build or improve detection & response capabilities
Relevant Experience
Two decades of building, scaling, and leading security programs at organizations that define the industry.
Rapid7
Senior Director of Product Security & Deputy CISO
Architected a company-wide shift from traditional AppSec to DevSecOps across 800+ engineers and 7 product lines. Designed a custom governance model based on OWASP SAMM/DSOMM, established a Security Champions program embedding 37 engineering leads, and built AI-driven tooling for automated threat modeling and vulnerability triage within CI/CD pipelines.
Key Outcomes
- DevSecOps framework adopted across 7 product lines and 800+ engineers
- Security Champions program embedded 37 leads, decentralizing security ownership
- Built CVE validation agent reducing false positive triage by automating exploitability analysis
- Engineered Repository Trust Validator for third-party dependency risk assessment
Rapid7
Deputy CISO (Interim)
Served as Deputy CISO for 14 months, bridging three CISO transitions for a 2,500-person organization. Managed the full InfoSec program including Board of Directors briefings, regulatory compliance maintenance (ISO 27001, SOC 2, FedRAMP), security budget planning, and cross-functional risk governance.
Key Outcomes
- Maintained ISO 27001, SOC 2, and FedRAMP compliance through leadership transitions
- Delivered quarterly Board of Directors security briefings
- Managed InfoSec program for 2,500-person organization during critical transition period
- Ensured zero compliance gaps despite three consecutive CISO transitions
Rapid7
Principal Security Researcher
Developed a threat analysis pipeline using Python, PyTorch, and NLP to parse unstructured SOC analyst reports, map adversary behaviors to MITRE ATT&CK, and correlate findings against petabytes of alert data. Produced the Rapid7 Quarterly Threat Report and established a data-driven framework for measuring detection and response outcomes.
Key Outcomes
- Created Rapid7 Quarterly Threat Report, elevating brand reputation through press interviews and webcasts
- Defined taxonomy of 97 Detection & Response and 73 Attack Surface Management outcomes
- Built ML-powered pipeline mapping unstructured reports to MITRE ATT&CK at scale
- Published research on detection strategy optimization adopted by MDR customers
Rapid7
Director & Founder, Managed Detection & Response
Founded and scaled Rapid7's Managed Detection & Response service from zero to $60M ARR and 250+ customers. Designed the "vCISO" service model providing strategic security guidance to SMB executives. Defined the technical architecture for the proprietary detection stack while personally leading pre-sales, go-to-market strategy, and public evangelism.
Key Outcomes
- Scaled from zero to $60M ARR and 250+ customers in three years
- Designed vCISO service model adopted as industry standard for MDR providers
- Defined technical requirements and service architecture for endpoint detection platform
- Led pre-sales engineering and go-to-market strategy for the service launch
Mandiant
Senior Manager, Threat Analysis & Hunting
Directed a team of Principal Analysts delivering advanced threat hunting against nation-state actors. Served as dedicated Virtual CISO for 20 enterprise clients, translating forensic findings into executive risk strategies and guiding Boards through post-breach remediation roadmaps. Selected as speaker at MIRcon on advanced detection methodologies.
Key Outcomes
- Acted as dedicated vCISO for 20 enterprise clients simultaneously
- Translated forensic findings into executive risk strategies and Board-level remediation roadmaps
- Led elite threat hunting team focused on nation-state adversary campaigns
- Selected as MIRcon speaker on advanced detection methodologies
Mandiant
Senior Threat Analyst (Founding Team, Managed Defense)
As a founding analyst for Mandiant's Managed Defense service, authored the technical service delivery methodology and SOPs for auditing environments using Mandiant Intelligent Response (MIR). Managed 30 simultaneous client environments, bridging incident response and continuous monitoring to ensure zero recurrence of compromised assets.
Key Outcomes
- Co-authored the foundational service delivery methodology for Managed Defense
- Managed 30 simultaneous client environments with zero recurrence of compromise
- Bridged incident response and continuous monitoring into unified service model
- Developed SOPs that became the operational standard for the Managed Defense team
Ready to Strengthen Your Security Posture?
Every engagement starts with a conversation. Let's discuss your organization's security challenges and how I can help you build lasting resilience.