About
I run security risk and compliance for large, spread-out organizations, where the hard part is getting many separate teams to do the same sensible thing. My background runs from hands-on vulnerability and endpoint work to leading a risk team, with audit support throughout: evidence, system security plans, auditor questions, and findings tracked to closure. I’m comfortable explaining a finding to an engineer on Tuesday and to an executive on Wednesday.
Selected work
- Enterprise risk assessment programBuilt and run the annual NIST CSF 2.0 assessment across a large network of agencies, and expanding it to cover AI risk.
- Vulnerability management from scratchOwned the InsightVM program end to end, with credentialed scanning of tens of thousands of assets across more than a hundred entities.
- Audit supportLead audit response, prepare evidence and security plans, and track findings to closure.
- AI-assisted GRCAutomated web scanning and used Gemini to speed up audit responses, policy review, and software approvals.
- Tabletop exercisesRansomware and breach scenarios that test response plans with executives and technical staff.
Experience
- GRC Manager (Information Security Officer 3)State of West Virginia Office of Technology, 2025 to present. Lead risk assessment, risk exceptions, audit response, hybrid cloud compliance, training, and AI-assisted GRC.
- Senior Information Security Specialist, SIEM and Threat DetectionInternal Revenue Service (U.S. Department of the Treasury), 2024 to 2025. Enterprise log review and insider-threat detection in Splunk.
- Information Security and Data Analytics SpecialistInternal Revenue Service (U.S. Department of the Treasury), 2021 to 2024. Administered RHEL systems for data pipelines, documented the data lake with diagrams in a GitLab wiki, and built security dashboards in Tableau.
- Information Security Officer, Vulnerability and Endpoint SecurityState of West Virginia Office of Technology, 2012 to 2021. Built the enterprise vulnerability program and endpoint protection, and led cross-team remediation.
Credentials and tools
CISSP. GIAC GSNA, GPEN, and GWAPT. CCSO. CompTIA Security+, Network+, and A+. B.S., Marshall University, magna cum laude.
NIST CSF 2.0, NIST 800-53, HIPAA, PCI DSS, CMS ARC-AMPE, IRS 1075. AWS, Linux (RHEL, Ubuntu, and Kali), Python and Bash (AI-assisted), Rapid7 InsightVM, Splunk, Tableau, SentinelOne, KnowBe4, and Gemini.