Security that scales from a startup to a Fortune 100.

The Marines taught two things no certification can: how to decide under pressure with incomplete information, and how to build teams where accountability is non-negotiable. Combat engineers think in both construction and destruction, a mental model that maps directly onto security architecture.

Moving from MOS 1371 to a tactical data-network gateway role wasn’t a career change; it was the same mindset applied to a new domain: building and defending infrastructure against adversaries with nation-state patience.

At the Senate, every alert was real and every decision carried national-security weight. At the Pentagon the role flipped to finding the gaps real threat actors would exploit. Holding both sides at once is the dual perspective that still shapes how I lead.

Consulting forces a breadth in-house roles can’t: every kind of environment, every kind of failure, every kind of organizational dysfunction. You learn what works and what’s theater. At GE (2011–2015), as Senior Red Team Analyst and then Senior Security Architect, I helped architect the migration of roughly 500 applications to AWS and re-architect them as cloud-native, well ahead of the trend. In parallel, as CTO of the National CyberWatch Center, I built a cybersecurity team from zero and developed GRC frameworks for a national education initiative.

At Uber I architected the SOAR detection and attack-emulation platform (later open-sourced) and led Red/Purple Team work across AD, IAM, and PAM, including the Azure AD migration. At Cruise, the stakes shifted from data to physics: securing software that drives cars on public roads. At Black Hills I built and led a purple-team program of roughly thirty assessments while mentoring the next generation.

At McKesson I own security strategy across Red Team, Vulnerability Management, EDR Engineering, and Endpoint Strategy, protecting 1.5M+ endpoints. I built a 25-person organization from scratch, cut the critical/high backlog 40% in nine months through risk-based prioritization, and turned the vulnerability disclosure program into a strategic asset feeding the EASM effort.

At United Airlines I directed Red Team, Cyber Threat Intelligence, and IAM across a 100,000+ employee operation: driving a $25M IAM program, operationalizing 60M+ monthly threat signals, partnering with TSA, FBI, and ISACs on nation-state response, and cutting audit findings 60% year over year across SOX, SOC 2, PCI 4.0, ISO 27001, and NIST.