I help teams see
the compliance work
they're already doing.

Compliance programs that give teams
clarity, not more work.

I’ve seen compliance treated as a tax on engineering and sales — a year-long audit scramble that burns out teams, blocks deals, and adds to the backlog. The programs I build are different: synchronized, automated, and designed so evidence collected once serves multiple frameworks simultaneously. The best programs feel invisible to the teams involved in them. It’s really pattern recognition at scale.

Where I build the programs
that open the markets.

Jan 2023 — Apr 2026

Rubrik, Inc.

NYSE: RBRK · Data Security & Cloud Data Management

$600M → $1.2B

Revenue

3 → 13

Certifications

• I designed a net-new Coordinated Audit ProgramA methodology synchronizing multiple certification cycles so overlapping evidence is collected once and serves all frameworks simultaneously — compressing a year-long process into 3 months., reducing audit requests from 1,000+ per cycle to under 400 through cross-framework control correlation
• I grew the certification portfolioThe set of security certifications a company holds. Each one unlocks a specific regulated buyer segment that would otherwise require a no-bid. from 3 to 13 globally recognized standards, directly unlocking financial services, healthcare, government, automotive, and international markets
• I pursued ISO 42001The international standard for AI Management Systems — obtained before any customer demanded it, creating a first-mover differentiator in AI-governed data security. proactively before any customer demanded it: first-mover positioning in AI-governed data security
• I managed four FINRA SEC 17a-4US rule governing electronic records retention for broker-dealers. Without this evaluation, Rubrik cannot sell to any regulated financial entity. evaluations enabling the financial services and broker-dealer market segment
• I integrated three M&A entities with zero certification gaps and built off-cycle audit management infrastructure to absorb future acquisitions
• I scaled the compliance function from 1 to 5, developing a team member with zero prior background into a lead assessor running independent evaluations
• I owned Customer TrustThe function responsible for enterprise customer security posture visibility — security reviews, trust portal, and executive compliance briefings. Owned since Elastic., managing the full customer-facing security program alongside compliance — a function I have held continuously since Elastic
• I authored customer-facing compliance whitepapersTechnical documents Sales uses to close deals: they answer the security questionnaire before the customer asks it, converting audit posture into competitive differentiation. and executive assurance briefings used directly in enterprise deal cycles — removing compliance as a blocker to sales and converting it into a differentiator

Head of Security & Compliance · Customer Trust · Team built 1 → 5

Aug 2021 — Jan 2023

People.ai

Private · $1.1B Unicorn · AI Revenue Intelligence Platform

$38M → $56M

Revenue

Inc. 5000

Fastest growing

• I built the compliance program from absolute zero at a newly minted unicorn: policies, processes, vendor selection, and full audit cadence
• I achieved SOC 2 Type 2The gold-standard enterprise security audit. Required by most enterprise procurement as proof of operational security maturity. and ISO 27001International ISMS standard. Required by most global enterprise buyers as baseline proof of mature security governance., directly unblocking the enterprise sales pipeline these certifications had been gating
• I expanded the portfolio to ISO 27701, ISO 27017, and CSA STARCloud Security Alliance certification — widely required in EU and APAC enterprise procurement for SaaS vendors., opening privacy-regulated and cloud-sensitive enterprise segments
• I compressed the audit cycle from a full quarter to one month using my coordinated certification methodology
• I participated directly in enterprise customer calls, removing compliance as a deal obstacle in real time

Sr. Manager, Governance and Compliance · Zero-to-one program build

Oct 2018 — Aug 2021

Elastic

NYSE: ESTC · Enterprise Search, Observability & Security

$160M → $609M

Revenue

70% peak YoY

Growth rate

• I led Elastic’s first-ever ISO 27001, 27017, and 27018 certifications — directly cited as enabling the majority of Elastic’s $271.7M FY2019 annual revenue (Elastic FY2019 10-K)
• I assisted in building Elastic’s first FedRAMPFederal Risk and Authorization Management Program: the US government’s cloud security authorization. Without it, no federal agency can use a cloud service — one of the most rigorous compliance gates in enterprise software. certification program, contributing program management and compliance infrastructure to a team effort that opened the US federal government market for the first time in company history
• I reduced audit-related engineering burden by 80% through evidence automationReplacing manual evidence collection with automated integrations that pull evidence from JIRA, GitHub, and cloud logs continuously — not just at audit time. and self-service collection tooling
• I reduced security questionnaireVendor security assessments sent by enterprise buyers. Industry average turnaround: 10+ days. My pre-built response libraries cut this to 2.5 days, unblocking hundreds of deals annually. turnaround from 10 days to 2.5 days, accelerating hundreds of enterprise sales cycles

Principal Security Risk & Compliance Analyst

2017 — 2018

Aetna / CVS Health

Architect Advisor, Forensic Business Architecture

Forensic Architecture — expert analysis protecting Aetna Healthcare product development across enterprise systems.

2015 — 2017

Evariant

Director, Compliance & Information Security · Connecticut

Managed security and compliance for 50+ hospital networks handling PHIProtected Health Information: any health data tied to an individual. HIPAA requires strict controls for any vendor touching PHI. across AWS, Hadoop, and Salesforce.

2014 — 2015

Saint Mary’s Hospital

Information Security Officer · Connecticut

First information security executive. Launched first-ever IAM program, Federal Audit Responses, and Disaster Recovery planning.

2011 — 2014

OSU & Huntington National Bank

IT Security Analyst · Ohio

Led $3M enterprise DLP implementation across 20+ university departments; remediated 100,000+ incidents.

Every certification is
a key to a locked market.

The certification portfolios I have built are not operational overhead — it’s the direct unlock mechanism for regulated enterprise segments across every major market on earth. I’ve certified for, operated in, and crisis-tested programs in North America, Europe, the Middle East, and Asia-Pacific, including active BCDR programs in Ukraine and the Middle EastBusiness Continuity & Disaster Recovery frameworks I built and maintained under active regional crisis conditions — the highest-stress proof that a compliance program actually works when the environment stops cooperating. under real operational pressure.

United States

FedRAMP · FINRA

FedRAMP: the US government cloud authorization gate. FINRA SEC 17a-4: required for electronic records at broker-dealers. Four evaluations completed at Rubrik.

Germany

BSI C5 · TISAX

BSI C5: German Federal Office for Information Security cloud standard, required by German financial institutions. TISAX: mandatory for automotive suppliers to BMW, VW, and Mercedes.

Australia

IRAP · ASD

IRAP: Information Security Registered Assessors Program, the Australian government cloud security authorization. Required for all federal agency sales.

Canada

OSFI B-13

OSFI B-13: Office of the Superintendent of Financial Institutions technology risk guideline. Required for technology providers to Canadian banks and insurers.

India

DPDP · RBI

DPDP: India’s Digital Personal Data Protection Act, 2023. RBI cloud guidelines: Reserve Bank of India mandates for financial cloud vendors handling Indian citizen data.

Israel

BCDR active

Active Business Continuity and Disaster Recovery programs designed and crisis-tested under real regional operational pressure in Israel and the broader Middle East.

UAE / Dubai

DESC certified

DESC: Dubai Electronic Security Center cloud standard. Required for cloud service vendors operating with UAE government and enterprise entities. Certification → Middle East government market → enterprise revenue in the Gulf region.

Ukraine

Crisis BCDR

Business Continuity & Disaster Recovery frameworks built and maintained under active regional crisis conditions. The highest-stress proof that a compliance program actually works.

South Korea

ISMS-P · PIPA

ISMS-P: Korea Information Security Management System — Personal information protection. PIPA: Personal Information Protection Act. Required for cloud services handling Korean citizen data.

Certification → market → revenue outcome

Source: SEC filings, press releases, program records.

Certifications	Market unlocked	Revenue outcome
ISO 27001International Information Security Management System standard. Required by global enterprise buyers as baseline proof of mature security governance. Cited in Elastic's FY2019 10-K as directly enabling $271.7M revenue.ISO 27017 / 27018Cloud-specific security controls (27017) and personal data protection in the cloud (27018). Required by EU and APAC enterprise buyers above the baseline ISO 27001.ISO 27701Privacy extension to ISO 27001. Maps directly to GDPR and CCPA obligations. Required by privacy-regulated enterprise buyers and EU data processors.	Global Enterprise & Privacy-Regulated Markets ISO 27001/17/18 cited in Elastic FY2019 10-K enabling $271.7M ARR. ISO 27701 opens EU privacy-obligated buyers.	$2T+ TAM Global enterprise SaaS baseline
FINRA SEC 17a-4Rule 17a-4 mandates electronic records retention for broker-dealers. Any cloud vendor storing broker-dealer records must pass this evaluation. Completed four times at Rubrik — a prerequisite for every financial services enterprise deal.SOC 1 Type 2Covers controls relevant to financial reporting. Required by fintech and financial services procurement. Type 2 means controls were tested over a period (typically 6-12 months), not just described.	Financial Services & Broker-Dealers Non-negotiable gate for broker-dealers. Four evaluations completed at Rubrik.	$B+ TAM Financial services data security
HIPAAHealth Insurance Portability and Accountability Act. Any vendor handling Protected Health Information (PHI) must be HIPAA-compliant. Non-negotiable for hospital systems, payers, and health tech platforms.HITRUSTHealthcare-specific certification combining HIPAA, NIST, and ISO controls. Preferred by major hospital networks and insurers over HIPAA alone — demonstrates a higher level of operational maturity.	Healthcare & Life Sciences Table-stakes for hospital systems, payers, and health tech buyers.	$390B+ TAM Healthcare IT · opened from zero
EO 14028Executive Order on Improving the Nation's Cybersecurity (May 2021). Requires federal software suppliers to self-attest compliance with NIST SP 800-218. Active attestation maintained to preserve federal pipeline eligibility.FedRAMPFederal Risk and Authorization Management Program. The US government's cloud security authorization. Without FedRAMP authorization, no federal agency can procure a cloud service. One of the most rigorous and expensive compliance gates in enterprise software.	US Federal Government FedRAMP Moderate completed FY2025, unlocking the full US federal chain.	$100B+ TAM US federal IT · GSA eligibility
BSI C5BSI Cloud Computing Compliance Criteria Catalogue. Published by Germany's Federal Office for Information Security. Required by German financial institutions and government agencies for cloud vendors.IRAPInformation Security Registered Assessors Program. Australia's government cloud security framework. Required for any vendor selling to Australian federal and state agencies.TISAXTrusted Information Security Assessment Exchange. Managed by ENX Association on behalf of the German automotive industry. Mandatory for any supplier to BMW, Volkswagen, Mercedes-Benz, and other OEMs.	Germany · Australia · Automotive OEMs Three markets from one coordinated portfolio build.	EU+APAC+Auto Three markets, one coordinated build
ISO 42001International standard for AI Management Systems (AIMS). Published December 2023. Pursued proactively before any customer demand — establishes governance, risk management, and accountability for AI systems. First-mover advantage in AI-governed data security.	First-mover: AI Governance Pursued before any customer requested it. Certifies at a fraction of the eventual cost.	First mover AI-governed data security

Four degrees.
One pattern-finding mind.

The same instinct that finds the hidden control satisfying five frameworks at once is the instinct I carry across all four of my degrees: find the structure connecting unrelated systems, name the pattern, build something that uses it.

M.S. — 2010–2011

Information Systems

Strayer University

How technology systems connect, scale, and break — the engineering foundation behind everything I automate in compliance.

M.S. — 2005–2006

Forensic Psychology

Tiffin University

Why people behave the way they do under pressure — essential for designing controls that teams actually follow.

M.S. — 2004–2005

Crime Analysis & Justice Administration

Tiffin University

Pattern recognition in complex data, applied to risk — finding the anomaly before it becomes a breach or an audit finding.

B.A. — 2001–2004

Psychology

Ohio University

Understanding how people think, decide, and change — the root of every compliance culture shift I have run.