Cybersecurity and compliance advisory firm providing risk management, governance, and regulatory compliance services to organizations across healthcare, financial services, and regulated industries. Strategic Planning: Develop and implement comprehensive cybersecurity strategies for multiple clients across diverse industries, aligning each strategy with the organization's unique goals and risk tolerance. Trusted Advisor: Serve as a strategic cybersecurity resource by educating internal teams and advising external clients on best practices, emerging threats, and risk mitigation strategies. Program Leadership and Execution: Lead multi-client security roadmaps end-to-end, translating strategy into prioritized initiatives, measurable milestones, and sustained operational cadence across stakeholders. Service-line Growth and GTM Execution: Partner with Compass executive leadership to expand service offerings, packaging deliverables into repeatable engagements, refining pricing structures and service tiers, and improving conversion from assessments to retainers. Business Development and Client Expansion: Drive pipeline growth through consultative selling, solution scoping, and executive presentations; identify upsell and cross-sell opportunities within existing accounts and support net-new pursuits to achieve the 50% growth target in 2026.

Provide executive-level cybersecurity, AI governance, and risk advisory services to healthcare, technology, and regulated organizations, supporting secure innovation, regulatory alignment, and informed board-level decision-making. Compass IT Compliance | Virtual Chief Information Security Officer: Deliver virtual CISO services across multiple client environments, defining and executing risk-based cybersecurity strategies aligned to business objectives and regulatory expectations. Serve as a trusted advisor to executive leadership and boards by translating complex cyber risk into clear, decision-ready guidance. Scope expanded over time, leading to a full-time offer. Mendoza Ventures | Healthcare Go-to-Market Advisor: Guide early-stage AI startups on product positioning, security and compliance expectations, and hospital buying dynamics to accelerate adoption within health systems. Integralty IT Consulting | Senior Executive Security Advisor & GRC Practice Lead: Provide executive advisory services, including security program assessments, risk-based roadmaps, and CISO coaching focused on, board communication, governance maturity, and regulatory alignment. Serve as Principal Advisor to CISO of CSC (Corporation Service Company). BondingAI | Healthcare Customer CISO & AI Advisor: Advise on secure AI adoption within healthcare environments, shaping go-to-market strategy, executive messaging, and platform security, privacy, and compliance posture to support health system due diligence and procurement readiness.

305-Bed Acute Care Hospital, 1,000 Physicians and 3,900 Employees AI Governance: Served on the AI Governance Oversight Committee, establishing risk frameworks, policies, and guardrails to enable secure, ethical, and privacy-responsible adoption of generative AI technologies. Budget Optimization: Restructured the cybersecurity budget to align spending with risk-based priorities, eliminate redundant tools, and reinvest savings into high-impact initiatives. Cybersecurity Strategy: Developed and secured approval for a one-year cybersecurity strategy focused on strengthening SOC capabilities, remediating audit findings, maturing resilience program, realigning team structure, and ensuring cybersecurity readiness for migration to Epic. Strategic Team Restructuring: Redefined the cybersecurity team structure by replacing a single-manager model with five specialized leadership roles to drive accountability and deepen expertise.

7 Hospital System, 2,600 Physicians and 12,000 Ancillary Staff Cybersecurity Strategy: Responsible for the building and executing, balancing security controls with business strategy and objectives, for increasing revenue and decreasing risk. Executive Presentations: Deliver concise and impactful board and committee presentations on cybersecurity strategy, risk assessment, incident response, and other pertinent topics resulting in a clear understanding of complex technical concepts among non-technical stakeholders.

Enterprise Security Program Oversight: Lead hospital’s Identity & Access Management, IT Governance, Risk & Compliance, Security Architecture & Engineering, and Security Operations. Attack Surface Management: Developed and implemented an enterprise Attack Surface Management program enabling proactive identification, assessment, and mitigation of risk across the entire threat landscape. Cyber Resiliency: Safeguarded critical assets and maintained operational continuity by developing and implementing comprehensive strategies to anticipate, prepare, respond, and recover from cyber incidents, including DDoS and ransomware attacks. Cybersecurity Insurance: Negotiated cybersecurity insurance covering 100% of potential losses from data breaches resulting in a 20% lower premium than peer organizations. Financials: Managed $10M+ CapEx and OpEx budgets, optimizing financial performance by increasing solution value while reducing cost in alignment with the organization’s risk tolerance. Incident Response Team Commander: Led incident response by assembling teams, driving task execution, and keeping stakeholders informed, providing clear leadership that reduced potential financial impact. Incident Response Time: Improved incident response time by 45% through the development and implementation of a streamlined incident management process. Reduced disruption to operations and safeguarding critical revenue-generating systems during cybersecurity incidents. Metrics: Implemented cybersecurity dashboards tailored to distinct levels of leadership and staffing. Improved visibility, with relevant and targeted information available to the different stakeholders. Security Reference Architecture: Conducted annual reviews of the security tool stack to identify technology gaps and redundancies, informing cybersecurity strategy and budget planning. Third-Party Risk Management: Developed a vendor risk management program leveraging in-house staff and services provider. Completed 75 reviews annually and reduced third-party security risks by 35%. Training Programs: Developed and deployed cybersecurity training and simulation programs for 14,000+ workforce. Increased awareness and reduced susceptibility to phishing attacks from 23.4% to 3.7%.

In conjunction with Deputy CISO role, accountable for the organization’s Information Technology Governance, Risk, and Compliance function, while this position was vacant.

3 Hospital System, 1,100 Physicians and 5,500 Ancillary Staff Cyber Security Strategy & Program Accountability: Directed the strategy, operations, and information security program, managing a $3.2M budget. Cost Savings: Economic conditions necessitated a 20% cut to the existing $8M security operating budget. Migrated to cost-effective platforms, implemented additional automation, and negotiated cost savings with vendors. Managed Security Services Provider: Implemented co-managed 24x7 SOC. Improved threat response times by 30% and ensured uninterrupted monitoring. Metrics: Developed key metrics and forecasts of the information security program, then presented results to Senior Leadership, Executive Risk & Compliance Committee, and Board of Directors. Security Program Development: Built WCHN Information Security program through baseline, gap analysis against common security framework with prioritized remediation efforts. Met level 4 of 5 compliance on the Gartner Information Security Maturity Model. Staffing: Managed the enterprise's information security organization, consisting of direct reports and indirect reports, including hiring, training, staff development, and performance management.