My foremost passion is to simplify complex problems using simple technologies. 🚀🚀

As a highly experienced and knowledgeable security professional, I have been called upon to provide guidance and advice to chief executives, chief information officers, and chief security officers in both times of need and times of plenty. My insights on cyber security have been invaluable to these leaders, helping them to develop strategies and approaches to keep their networks, data, and systems secure. I am proud to have been a trusted partner to these influential individuals, providing the support they need to navigate the ever-changing digital landscape.👨‍🏫🏁

I have directly been involved with, advised, orchestrated, and provided on-the-ground strategic response and oversight services for several multi-billion dollar companies during cyberattacks.👨‍🚒👮‍♂️

I have designed, implemented, and staffed cyber security programs and strategies for the nuclear industry, top tier HIPAA hosting, and SAP hosting companies. 🔐

Numerous billion-dollar companies have purchased my consulting services to help them assess and adjust their strategy to defend against current technical threats, such as ransomware. 💻

I specialize in automating and modernizing legacy programs with reliable modern solutions. Take a look at my Github for my hobbies.

History

2020

I’m currently at Syntax, which acquired my former employer Freudenberg IT. At Syntax, I’m the Global Chief Information Security Officer (CISO) and am responsible for all security-related matters, such as protecting data centers, services, and offering security services.

Syntax is my fourth Security Operations Center deployment, with elements from my second deployment included. It is a leading provider of Enterprise Resource Planning (ERP) systems such as SAP, JDE, and EBS.

Syntax has some unique IP for ERP Security, some existing, some I helped develop. Syntax has ECARE for JDE, and now we have Sentinel for SAP using a series of custom rules and management criteria we’ve created. We’ve also developed Zero Trust ERP access technology which is extremely powerful.

Syntax is my first large scale Zero Trust implementation which has been awesome. Zero Trust as a strategy is powerful when coupled with the right technologies. I’m never going back!

At Syntax, I have been instrumental in assembling and selling large-scale SOC services and Security Engineering Services, providing high-level advisory services to key customers when needed. I have worked hard to advance Syntax’s security posture to a position of world-class excellence in the market, far surpassing the standard for the industry.

Tech Learned

1. Crowdstrike MSSP Management and Deployment (from 0 to millions)
2. CyberArk MSSP (won MSP of the year 2021!)
3. Zero Trust Network Access (Cloudflare)
4. ERP Specific Zero Trust Security Designs and Strategy
5. AWS Specific Security and Designs
6. DevSecOps at scale with SOAR
7. Azure Security through Sentinel and Lighthouse for MSSPs

2019

This was my startup experience. I helped pick the offices, I made the network designs, I helped pick out the furniture and put together our first products. I helped grow this business from inception to 100s of employees as the CSO/CISO.

I worked as sales/presales/operations in the early days, putting together solutions for customers for Security and IT Related products. Overseeing the customer and corporate security for the business. Putting together products, contracts and delivery was part of responsibilities.

I performed assessments and CISO as a service for companies in crises, traveling around the world for IR related purposes. I’ve handled greater than 30 ransomware related situations as an advisor at this point, including payments, recoveries, interacting with the CISO/CEOs while writing recovery plans and helping the execute those plans.

This was my third Security Operations Center and cloud deployment of controls for a company. This company was purchased by Converge after I left.

Tech Learned

1. Complete Startup from VC Funding (from 8 to ~250 employees in 1 year)
2. Security Assessments for Multibillion Dollar Companies
3. Security Technical Strategy Development for Multibillion Dollar Companies
4. Incident Response/CISO as a Service for Multibillion Dollar Companies
5. MSP/MSSP Agreements for Cisco and Crowdstrike
6. Cloud Security for Azure

2017

At Fruedenberg, I took on a highly coveted senior leadership role, where I was able to use my expertise to create a comprehensive cyber security program. This new program would be the foundation for a risk-based approach to commercial business, which I developed into a product for the company. My work not only enabled their business objectives, but also became a standard practice across the industry, allowing Fruedenberg to remain a leader in the cyber security space.

At Freudenberg IT, I provided secure guidance to over 100 SAP users, secured our Data Center and Hosting operations, and interacted with CIOs, CEOs, and other high-level executives from billion-dollar companies. I helped created a security product line tied to our hosting products that helped protect our customers and core business while providing many millions of additional revenue.

This was my second Security Operations Center that I stood up from scratch, and this one had many lessons learned incorporate form the previous experiences. As part of this process I signed MSP agreements with Cisco, Qualys and Splunk to allow for sales of these products.

Tech Learned

1. SAP/ERP Protection
2. Security MSSP Programs and Implementation
3. Contracts and Sales for Security Services

2016

Allscripts was a major transitional period in my career. It was here I went from an “Expert Security Engineer” to a “Senior Security Manager”. I had some great leadership from Andrew Mabe, as he helped put together a strategy with technologies to implement.

At Allscripts I became an implementer and leader in technologies. It was here where I learned about the business aspect in Security and how important it was to ensure people could get the care delivered while maintaining a high level of protection for their data.

This was where I built my first Security Operations Center and operational program at scale. It was fun and exciting.

Tech Learned

1. Splunk and Splunk Enterprise Security
2. Cisco Firepower and Cisco StealthWatch
3. Cisco Advanced Malware Protection
4. Malware Analysis / Packet Capture Analysis
5. Datacentner Design and Protection
6. HIPAA Compliance and HITRUST
7. Electronic Health Records (EHR)
8. Security Operations Center
9. Large Scale Vulnerability Management

2014

When Duke Energy took over the CR3 plant in Florida (and closed it), I relocated to the Sharon Harris Nuclear plant in the Raleigh-Durham area of North Carolina. At this plant, I was appointed to the Expert Panel as the Target-set Member, as well as the Cyber Security Specialist.

I helped create and oversee the implementation of a portable media and asset protection program. Additionally, I oversaw and ran a 15+ person team performing security assessments for Critical Digital Assets in accordance with 10CFR73.54 while implementing the Cyber-Rule for Sharon Harris.

I designed and implemented several major infrastructure upgrades for the plant, and safeguarded the local population from potential cyber-attacks. I took this responsibility very seriously, as expected.

Tech Learned

1. Cyber Security Assessments
2. Cyber Security Incident Response
3. Leading Large Scale Teams
4. High Stakes Cyber Compliance
5. Acquired CISSP

2011

Progress was my entry into Nuclear Power Generation. Here I learned a lot our process and procedural usage and adherence. Most people don’t know that to work in Nuclear Power you need to go through a training/qualification process that’s accredited and overseen by INPO. It takes a year or so to get qualified, if you pass.

Here I was a target set expert panel member working to secure the plant under 10CFR73.54 and 10CFR 73.56 amongst other requirements. I also helped the installation of the mandated controls such as data diodes and other protective systems.

I also design a proof of concept baselining system for system hardening as well as a multi engine anti-virus solution to scan incoming data for malware.

Tech Learned

1. Nuclear Power Generation Engineering
2. B&W PWR Reactor Function and Operation
3. Process System Protection and Design
4. Compliance with Regulatory Guide 5.71 and NEI 08-09R6
5. Data Diodes / IDPS / Anti-malware technologies

2006

I started at Delhaize as a Programmer Analyst, supporting the company’s automated ordering system platform. I had to learn the SAF-AG ordering application and ended up writing a web application that allowed for an MMI to edit and update inputs to the batch processing by business users. This upset our InfoSys lead, who had quoted hundreds of thousands of dollars to produce what I did in a couple of afternoons. This was my first experience with politics.

I learned mainframe programming and was part of an on-call rotation to support mainframe-related jobs. I was also assigned to develop store inventory processing applications. In 2008, I wrote software that is still in use at all stores in 2022.

I created a solution using commercial off-the-shelf (COTS) time clocks with a micro version of Linux and a proprietary interface language. This was compared to a commercial Kronos solution. My clock cost about $250 per clock, compared to the multi-thousand dollar Kronos clock, and it provided more functionality. I have a special place in my heart for a great leader, Scott Burrill.

By the end of this tour of service I owned a number of business critical applications, some of which I wrote the middleware and integrated, others that I wrote from scratch. I still occasionally get questions on my 15+ year old code. 🥴

Tech Learned

1. Systems Analysis, Optimization and Integration
2. Mainframe Jobs, Scheduling and TSO
3. JCL, COBOL, EZTRIEVE Mainframe Programming
4. SQL Server DB and Numerous vendor applications from JDE
5. PDX Pharmacy Software and Oracle DB Administration
6. JavaScript, Java, Perl, DB2, Bash, Korn, SQL Programming

2006

This was my first job out of college, where I supported Munis as an “Operating Systems and Database Support Analyst”. I was responsible for fixing SQL Servers, Informix Databases, and a variety of UNIX-type operating systems.

After the first month, I automated my job using shell scripts and wrote code blocks in my notes for various tasks. It turns out I was doing “DevOPs” in 2006.

Tech Learned

1. Informix, SQL Server, Oracle Databases
2. Windows, HP-UX, AIX, SCO, Linux Servers
3. Programming Bash, SQL, Command Script

Disclaimer

The opinions expressed here are my personal opinions. Content published here is not read or approved in advance by any company and does not necessarily reflect the views and opinions of those companies. This is a personal blog, not a corporate blog.