Led the threat and vulnerability management program for one of the largest payment processors in the world, cutting time to remediate by 87% and time to detect by 91%.
A payment processor lives inside PCI-DSS and SOC 2, with a vulnerability backlog that scales with the size of the estate. The program had the data but not the decisions.
We turned scan output into ranked, owner-assigned risk: exploitability, exposure, and business criticality rather than raw CVSS counts.
Built the team to match the work: vulnerability analysts, application security assessors, penetration testers, and data loss prevention specialists, with governance documented as policies, standards, and procedures.
Embedded security into the development lifecycle so findings stopped arriving after release.
Independent · 2025 to present
A multi-tenant Slack alternative in production at cinchme.app, with tenant isolation proven in the database, a browser suite run against the production image, and a release gate that refuses to promote traffic without evidence.
North Highland · 2014 to 2026
A risk and compliance program aligned to ISO 27001, HITRUST, HIPAA, GDPR, and UK Cyber Essentials that certified on the first pass and opened more than a billion dollars of revenue.