Making security work beyond the strategy deck.

A security issue rarely stays within one discipline. An identity weakness can become an incident. A vulnerability can become a business interruption. An exception that looks reasonable in isolation can expose a larger gap in how risk is understood and managed.

My work has centered on connecting those pieces: translating broad security requirements into operating practices, helping teams prioritize meaningful exposures, and bringing clarity to decisions that cross identity, privacy, incident response and governance.

That means looking at more than whether a control exists. I ask whether it addresses the problem, whether someone owns it, and whether the organization can tell when it stops working. A strong design needs people and processes capable of carrying it into daily operations.

I am exploring how AI can reduce the friction in security and risk work: triaging incidents and exceptions, finding relevant evidence, and helping practitioners make better-informed decisions. The goal is to improve the workflow as a whole, including the judgment and accountability around it.

At the same time, AI systems introduce a different set of security questions. When a system can retrieve sensitive information, choose a tool or trigger a business action, its permissions and operating boundaries become central to its safety.

My focus is the connection between those two challenges: using AI to strengthen cybersecurity while building the controls needed to secure AI itself. That spans agentic security, AI assurance and red teaming, security operations, exposure management and enterprise governance.

I bring a technical systems perspective together with an understanding of how organizations assess risk and deliver change. Architecture, controls and operating models need to reinforce each other.