|
VP / CISO | PRODUCT SECURITY, PRIVACY ENGINEERING & AI GOVERNANCE — HEALTHCARE, FINTECH & REGULATED TECH
MF is a U.S. citizen based in LA/Conejo Valley (Agoura Hills), CA, and is available immediately.
Open to FT/hybrid and/or occasional travel for leadership offsites or board meetings.
Passport: Active, willing to travel as needed.
Industries: Healthcare/HealthTech, Life Sciences, FinTech, Insurance, and other highly regulated consumer-technology sectors.
Hierarchy/Report to: CEO, COO, General Counsel, or Board Audit/Risk Committee.
Size of Companies/Employees: Growth-stage to large enterprise (500 – 10,000+ employees); comfortable both scaling a program and operating in mature-governance environments.
Size of Staff: Built and led teams up to 18 (3 managers, 15 FTE), plus cross-functional/dotted-line oversight.
Education/Degrees/Active Certs: M.S., Information Security Policy & Management, Carnegie Mellon University; B.S., Computer Science, UCLA. CISSP-ISSEP, CISA, CRISC, PMP, CIPP/US, CIPT, AIGP, IAPP Fellow of Information Privacy (FIP), Google Cloud Generative AI Leader.
Areas where I have delivered the greatest impact: Product security & SSDLC, privacy engineering (CCPA/GDPR/DSAR at scale), AI governance and agentic AI security, FedRAMP/HIPAA regulatory readiness, M&A security integration, and board/audit-committee risk reporting.
Over the past decade, I've built and scaled Information Security and Privacy Engineering functions across healthcare, insurance, and consumer technology organizations where regulatory trust is the product. Most recently, I built the Product Security & Privacy Engineering function from the ground up, hiring and coaching 3 managers and 15 engineers to full capacity, serving as ISSO for a FISMA-regulated national research platform, and directing readiness for FedRAMP Moderate authorization. I also led the security integration of two acquired companies into shared services within a single year, and stood up the privacy engineering function (PIA, cookie consent, DSARs) using OneTrust from scratch.
My background spans some of the most heavily regulated environments in the country.
- I was hired as the first cyber risk 2nd-line executive, obtained a $300M cyber liability policy, and led enterprise compliance with NY DFS cybersecurity requirements.
- I owned 42 SOX IT General Controls reviewed annually by external audit and automated over 2,000 CCPA/GDPR data subject requests per year.
- I built the information security program 0→1, including core IAM and endpoint security infrastructure, within six months.
I've also moved early into applying AI to security operations rather than just securing AI as an afterthought. I established enterprise AI governance and third-party LLM risk review processes (Gemini, OpenAI), developed a security framework for vetting Model Context Protocol (MCP) integrations, and used AI tooling to automate 40% of security reviews across an annual volume of 300 — freeing my team's capacity for higher-value work. I currently advise an early-stage agentic AI security startup on runtime governance for autonomous AI agents and speak/publish regularly on AI security (RSA, ISACA, OWASP, ISSA-LA; IEEE, Forbes, Gizmodo).
What I'd bring to an organization is a proven ability to build and scale security and privacy programs in regulated industries, translate technical risk into a board-ready narrative, and use AI and automation to multiply team leverage without sacrificing rigor. I'm targeting VP/CISO-level roles at growth-stage to enterprise companies in health tech, fintech, or other regulated sectors and open to a conversation with any organization navigating that combination of scale, regulation, and AI-driven change.
| 
