Lingua
Mac · Windows · iPhone & iPad soonLanguage learning with lessons, vocabulary drills and grammar by CEFR level. Russian, Korean, German and Italian, plus a Hungarian starter pack. Built-in speech, no account, works offline.
Security leader · Software builder
I help organizations get security right, and I build small software that respects its users.
vCISO and security consultant for law firms and growing businesses. In my own time I design and ship desktop and mobile apps: local first, no accounts, no tracking.
- CISSP since 2008
- CISM
- CCISO
About
I've spent my career on the defensive side of security, in defense and aerospace, fintech, banking and healthcare. Today I work as a virtual CISO and consultant, helping firms build security programs that hold up to auditors, clients and attackers alike.
I've owned SOC 1 and SOC 2 Type II audits end to end, briefed boards on risk, and run incident response tabletop exercises with executive teams. Most of my days are spent translating between technical findings and business decisions.
My roots in the defense industry still shape how I work. As an ISSO and ISSM, I worked within the NIST Risk Management Framework, from categorizing systems and selecting controls through assessment and continuous monitoring. I've also performed CMMC Level 2 gap assessments, measuring environments against the 110 requirements of NIST SP 800-171 and laying out a clear remediation plan.
What I work on
- Security program development and management
- Risk assessments and board-level reporting
- Audit readiness: SOC 1, SOC 2, HIPAA
- Federal and defense compliance: NIST RMF, CMMC Level 2, FedRAMP
- Vulnerability management that actually closes findings
- Incident response planning and tabletop exercises
- AI security risk and vendor reviews
Frameworks
Apps I've built
Built with Tauri, React and Rust. Each one keeps your data on your own device, signs its releases, and phones home for nothing but updates.
Cairn Exam Prep
WindowsPractice questions for AAISM, CISA, CISSP and CIPP/US, each reviewed and approved by a certified practitioner. New questions arrive as signed packs, and your progress never leaves your computer.
Get it from the Microsoft Store
Not affiliated with, endorsed by or sponsored by ISACA, ISC2 or IAPP.
PDF Combiner
MacCombine PDFs and phone photos into one file. Drag pages into order, turn or remove them, sign, fill in forms, unlock password-protected files, and shrink the result to fit upload limits.
GRC Workbench
In developmentA desktop workbench for the monthly vulnerability remediation cycle: compare scans, confirm closures host by host, draft tickets with SLA due dates, and produce the Excel and Word reports. Everything stays on the analyst's machine.