Strategy & investment
Designing security operating models, setting priorities, and developing modernization business cases aligned with business needs and implementation capacity.
Cybersecurity strategy. Enterprise risk. People leadership.
Make security
work.
I help leadership teams turn complex cyber risk into clear priorities, accountable decisions, and security programs that work across the business.
My experience spans public-company CISO responsibilities, enterprise security architecture, and security strategy in Big Consulting—combining technical depth with practical governance and organizational change.
CISO & Deputy CISO opportunities · Houston / National remote · CISSP · MSc Information Security
- Cross-functional change
- Resolved a decade-long patching bottleneck across four functions. High-value-system patch latency fell from more than two months to 2–10 days.
- 80%+ reduction
- Led program improvements that reduced third-party software vulnerabilities by more than 80% for most endpoints.
- Enterprise risk governance
- Built a centralized risk management function and clearer quantitative reporting to help leadership prioritize security needs.
01 / Executive scope
Security leadership
across the enterprise.
I connect the direction of the security program with the decisions, resources, and people needed to deliver it.
Risk & governance
Building executive and board-ready risk reporting, KPI/KRI frameworks, and exception governance to support informed, accountable decisions.
People & execution
Developing distributed security teams, coaching leaders, and building cooperation across business and technical functions to improve delivery.
Technical foundation: enterprise security architecture, cloud security, identity and access management, security operations, incident response, and advanced persistent threats.
Governance & compliance: NIST CSF, NIST SP 800-53 and 800-171, FedRAMP, DFARS, ISO 27001, and PCI DSS.
02 / Selected results
Leadership made tangible.
Examples of building security capability, removing organizational barriers, and making sound technical decisions.
Public-company oil & gas services / Program leadership
Building the governance and operating structure for a security program
More than 80% reduction
Third-party software vulnerabilities, for most endpoints
- The mandate
- Move security initiatives forward and establish a clearer way to prioritize, communicate, and manage enterprise cyber risk.
- My leadership
- With CISO responsibilities, I built and executed program strategy, established centralized risk management, led a team of six, and owned an approximately $3M security tooling and team budget. I trained the distributed team in security operations, strategy, and career development, strengthening cooperation across locations.
- The result
- Clearer quantitative risk reporting supported leadership discussions, while vulnerability and patch management initiatives reduced third-party software vulnerabilities by more than 80% for most endpoints.
Defense contractor / Organizational change
Breaking a decade-long remediation deadlock
More than two months 2–10 days
Patch latency for high-value systems
- The challenge
- A longstanding bottleneck across infrastructure, change management, security, and development had constrained patching for a decade.
- My leadership
- I built a coalition across the four functions to identify and address the dependencies preventing timely remediation.
- The result
- The collaborative effort helped reduce patch latency for high-value systems from more than two months to two–ten days. Resolving organizational barriers made the technical improvement achievable.
Healthcare / Security architecture
A modernization path built around critical operations
A phased implementation roadmap
Delivered network modernization strategy
- The challenge
- Network hardening needed to account for enterprise infrastructure, clinical systems, and life-critical equipment.
- My contribution
- I compared current and future architectures, made the tradeoffs explicit, and sequenced migration around operational constraints.
- The result
- Delivered a roadmap translating security objectives into an implementation path suited to the clinical environment.
03 / Working together
Clear direction.
Shared ownership.
I work with leadership and delivery teams to build mature security programs, support business change, and sustain improvements.
Understand
Examine material risks, business objectives, technical dependencies, and operational constraints.
Align
Agree on priorities, decision rights, accountable owners, and the resources needed to act.
Deliver
Develop team capability and sequence improvements around real implementation capacity.
Verify
Assess results, communicate residual risk, and adjust investment and priorities as conditions change.
People need to be able to report bad news early, question assumptions, and make their constraints understood. Accurate evidence and candid relationships help leaders make better risk decisions.
04 / Current work & perspective
Better decisions.
Stronger security organizations.
Executive advisory
Turning strategic priorities into operating practice
My recent advisory work includes security operating-model design, board-ready KPI/KRI reporting, exception governance, and business cases for major modernization efforts.
I have coached senior leaders on risk communication and program leadership, evaluated emerging risks from AI adoption and integration, and supported board-level strategic alignment for a cybersecurity nonprofit.
Independent research / Human factors
How organizations recognize and respond to risk
I study how trust, incentives, cognitive bias, and organizational dynamics affect executive decisions, risk reporting, and the adoption of security practices.
That perspective informs practical questions: Can people report a problem early? Who can resolve competing priorities? What makes a control workable for the people using it?
Speaking & independent coverage
A Brief Introduction to Cognitive Warfare
How adversarial influence targets perception, trust, and decision-making. My speaking also covers elicitation and manipulation, and software security for IoT devices.
05 / About Stephen
Technical depth.
An enterprise perspective.
My career spans public-company security leadership, enterprise architecture, technology operations, and consulting. I have worked across energy, industrial, healthcare, retail, government, and federal-contractor environments.
My technical foundation extends from software and embedded systems to networks, cloud, and security architecture. I use that depth to test assumptions, explain tradeoffs, and help teams make sound implementation decisions.
I also bring experience in nonprofit board service and security leadership development, with an enduring interest in how governance and organizational behavior shape outcomes.
- Education
- MSc in Information Security, with Merit
Royal Holloway, University of London - Certification
- CISSP
- Location
- Houston, Texas · National remote and Houston-area opportunities