Executive Security Experience and Detail
Charter Communications
Vice President, Information Security Operations and Strategy
A senior executive with oversight of IT Security Operations, Incident Response, Security Quality Assurance, IT/Security Budget (@$100m), and IT Security Strategy. Successfully led the build-out of the security operations, Incident Response, Defensive Security, and GRC teams while guiding key projects through to successful fruition (on budget and on time). Starting with a NIST 800-53 assessment on IT's security capabilities, I crafted a Security Roadmap to guide future progress. Cross-referencing the 800-53 examination to the NIST Framework for Critical Infrastructure, I blended the results into the overall corporate security goals. This structured approach proved instrumental in reducing the operating budget through efficiencies and automation while increasing security posture and accountability. I created and implemented a Secure Development Framework to guide Security throughout the SDLC and overall application lifecycle. I Led the Charter/Spectrum Leadership team from a technological view of security to fully realize there was more business involvement necessary to cover the threat profiles fully. I also led them through and socialized, recommended regulatory compliance processes for AML, GDPR, and CMMC.
Key Results
- I created an organizational structure that matched skills and limited headcount to cover Security Operations efficiently, Incident Response, Security QA, and IT Security Infrastructure project management and execution (saving over $30m in OpEx and CapEx).
- Transformed the organization to recognize that security is more than technology and that many aspects of business-driven security activities had not been incorporated into the overall risk measurement (defending against a growing insider threat)
- I created and implemented a "Bow Tie" threat metrics process that successfully allowed the organization to front-run potential disruptive or nefarious activity leading up to and through prominent "high profile" events like the Republican National Convention and the Democratic National Convention.
- Provided a multi-year strategic plan that not only looked at technological advancements but took into account operational sustainability, cultural impact, and maintained a satisfactory end-user experience.
- Managed allocated budget year-over-year to achieve (and in many cases, overachieve) expectations.
Key Initiatives/Activities
The following are initiatives and programs crafted and implemented under my watch.
- Application Rationalization and normalization of dissimilar applications across the blended enterprise after MA&D activity
- Standardization of security toolsets
- The transition of limited appliance-based web filtering capabilities to an integrated Palo Alto firewall/AD driven, customizable web filtering schema
- Selected and implemented DLP technology in alignment with culture, User expectations, and operational sustainability
- Researched, tested, and selected data classification tool to augment and kick start the DLP program and relieve much of the end-user burden for success
- Researched and implemented a SEIM tool to assist in the concatenation of security event alerts
- Researched and implemented Endpoint Detection and Response (EDR) tools to reduce the endpoint resource utilization and increase efficiency/effectiveness of the discovery and sequestration of data, and aid in incident response
- Researched and recommended SOAR tools to pull alerts and data from dissimilar network segments to gain greater enterprise visibility of risk and events
- Orchestrated the creation of general and specific playbooks for Incident Response across all areas of IT and OT
- Guided the culture to embrace a cross-functional IR team to address insider threats (culminating in the formation of the Internal Risk Working Group or IRWG)
Webster University
Adjunct Post Graduate Level Cybersecurity Professor
Teach online classes to master's degree candidates. Area of specialty includes Introduction to Cybersecurity, Industrial Control Systems Security, and Security Organizations management.
Omgeo LLC, Boston MA
Chief Information Security Officer
Defined and identified, in a "greenfield" environment, cross-functional security teams to monitor security controls, analyze trends, identify and mitigate threats, and provided proactive instruction to networking and support personnel. I led the security operations of network engineering, application development, computer, and business operations toward compliance with government regulations and industry-accepted practices. I directed network security monitoring, intrusion detection/prevention, and vulnerabilities assessment tools/deployment. I established a highly acclaimed vision and three-year improvement plan to address identified U.S. Securities and Exchange Commission (SEC) audit deficiencies and additional enhancements to ensure the business-critical technologies' availability and recovery.
Key Results
§ Gave the organization a previously deficient resilience to thwart attacks on network/information technology assets
§ Successfully convinced the SEC to eliminate all significant findings from their (3) failed audits based on my vision/roadmap.
Manulife Financial, Boston MA
Chief Information Security Officer (AVP, Global Information Systems Security)
Successfully realigned IT practices to effectively safeguard information assets; restructured and improved all major IS functions for overall security and efficiency. Established and directed security and operations of network engineering, telecommunications, application development, computer, and business operations. Collaboratively authored, socialized, and implemented Global Security policies and standards. Developed and rolled out comprehensive Network and Application Development Architecture Guidelines. Designed, justified, and established an organization-wide risk management initiative.