Senior Cyber Policy Advisor · Major Incident Response Commander · Hands-On Technical Practitioner
I turn hands-on-keyboard engineering, testing, and risk analysis into federal directives, security programs, and practical decisions at the frontier of emerging technology.
I connect hands-on security experience with federal policy development, helping decision-makers understand technical capabilities, limitations, implementation needs, and risk.
Led federal logging and post-quantum policy development as lead author of OMB M-26-14 and M-26-15. I bring agencies and technical experts together to translate strategy into guidance, responsibilities, and practical implementation priorities.
I translate cybersecurity and emerging-technology issues into briefings and recommendations that make evidence, uncertainty, and tradeoffs clear. My practitioner background helps me explain both what a technical finding supports and what remains unresolved.
My approach is to turn a policy objective into specific questions, identify the evidence needed to answer them, and work with technical teams to assess feasibility and limits. In the other direction, I explain technical findings in terms of the decisions policymakers need to make.
This is the perspective I bring to emerging questions in AI assurance, evaluation, and oversight: clear claims, evidence that can be examined, and explicit uncertainty.
Worked directly with NIST on IoT, logging, and risk publication updates, contributing technical and emerging-technology input to make guidance clearer and easier for agencies to implement. Advised federal AI governance and acquisition policy, connecting risk management and responsible innovation with agency mission needs.
At OMB, I work with budget staff and resource management officers to bring budget, resource, and cost-saving considerations into cybersecurity policy development and advisement. Effective policy needs a credible path from the stated objective to the people, systems, and resources needed to carry it out.
The policy work rests on years of testing systems, building risk processes, and helping people act on technical findings.
I helped secure vendor remediation by translating web-application testing findings into business risk and supporting discussions tied to contract renewal. That work grew from a technical foundation of 275+ penetration tests across enterprise systems, cloud, web, mobile, medical devices, APIs, and integrations.
Used Python and SQL for security-data analysis in penetration-testing and security-architecture work at Memorial Sloan Kettering and CipherTechs.
Authored detection rules used in production and built automated threat-intelligence collection and enrichment pipelines at CipherTechs and Memorial Sloan Kettering.
Administered Linux servers, user and SSH access, AWS IAM, and EC2 at CipherTechs, Memorial Sloan Kettering, and MJHS.
Delivered cybersecurity and privacy risk advice, including Health Insurance Portability and Accountability Act (HIPAA) requirements, to clinical, research, and executive stakeholders through 550+ independent assessments at Memorial Sloan Kettering. Managed approximately 50–100 concurrent assessments across enterprise and medical-device projects, advising teams during design and developing mitigation plans with the people responsible for delivery.
At Memorial Sloan Kettering, I implemented data minimization, anonymization and pseudonymization, retention and deletion, and data-lineage controls. I also evaluated privacy APIs.
Enhanced RSA Archer capabilities and improved assessment methods and automation at Memorial Sloan Kettering. At New York City Cyber Command, contributed to ServiceNow governance, risk, and compliance (GRC) development and automation supporting agency audits and risk-management processes. Supported continued system authorization under the organization-specific frameworks at both institutions.
Gave city leaders risk-informed dashboards and metrics by founding and leading the citywide cyber risk mitigation and acceptance program. Built its intake, risk profiling, mitigation and acceptance workflows, accountability tracking, and definitions of risk appetite and tolerance to support mitigation decisions. Applied the National Institute of Standards and Technology (NIST) Risk Management Framework alongside other frameworks and supervised the program team.
Created and led NYC Cyber Command’s first risk assessment and audit of Internet of Things, operational technology, and industrial control systems (IoT/OT/ICS), including the methodology, risk-rating model, focus areas, and question bank for continuous auditing.
How I Develop TeamsAs Senior Cyber Policy Advisor and Major Incident Response Commander, I draw on my work as a Penetration Tester, Auditor, Threat Intelligence Analyst, and AI Security Practitioner across government, healthcare, and financial services.
Where there was no playbook, I led its creation, in principle and practice: meet people and the problem where they are, ask the questions that narrow it, name the unknowns, and build a first version that addresses each stakeholder's mission, risks, and constraints. First-of-kind directives, programs founded from nothing, and decisions with no settled answer, always in service of the mission.
At the Office of the Federal Chief Information Officer (OFCIO), Office of Management and Budget, I set cybersecurity and emerging technology strategy and policy across the Federal Civilian Executive Branch, balancing operational realities, agency mission needs, and public trust. I have served multiple periods as Acting Director of the Cyber Team and chair interagency working groups of the Federal Chief Information Officers Council and Chief Information Security Officers Council, bringing together senior technical leaders, CIOs, CISOs, and policy officials.
With no prior federal standard for AI era telemetry, built and led the interagency working group that redesigned federal logging (M-21-31 to M-26-14) to be cost effective, risk based, and nimble, with explicit support for AI assisted analysis, scalable detection, adversary observability, and automated defense. Lead author of OMB M-26-14 (May 22, 2026), which replaced M-21-31, tasked CISA with a new Logging Reference Architecture within 90 days, and aligned centralized visibility and AI enhanced detection with federal zero trust across IT, IoT, and OT. CISA released the Logging Reference Architecture in August 2026, delivering on that tasking.
Led federal PQC policy from strategy to execution. Supported the National Cybersecurity Strategy Implementation Plan initiative that made OMB responsible for migrating federal systems to quantum-resistant cryptography; co-organized the February 12, 2024 White House Roundtable on Protecting Our Nation's Data and Networks from Future Cybersecurity Threats and briefed the principals; contributed to the August 2024 White House fact sheet on a post-quantum future; advised Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (June 22, 2026); ran the interagency working groups; and authored the civilian agency guidance, culminating as lead author of OMB M-26-15, Execution of the Migration to Post-Quantum Cryptography (June 24, 2026), the first federal directive executing the migration. Advised the June 2026 Executive Order on the Next Frontier of Quantum Innovation and support OMB's coordination role under it.
Technical and policy advisor on AI risk, cyber harm, and red teaming for federal AI governance (M-25-21) and agency AI risk management (M-24-10).
Advised AI acquisition policy (M-24-18 and M-25-22) and unbiased AI principles for large language models (M-26-04).
Advised EO 14110 implementation, EO 14179, and America’s AI Action Plan; briefed and supported the Chief AI Officer Council; and worked the Federal AI Use Case Inventory.
Particular focus on AI powered security tooling, quality assurance for AI generated findings, and managing vulnerability reports at unprecedented scale and speed.
Supported federal cybersecurity oversight and reporting to Congress by helping develop new metrics, writing the logging, post-quantum cryptography, and incident response sections of the annual Federal Information Security Modernization Act (FISMA) guidance (M-24-04 for FY 2024 and M-25-04 for FY 2025), and contributing to Federal Cybersecurity Progress Reports. Co-authored earlier IoT guidance and maintained oversight.
Informed federal cybersecurity budget priorities and agency submission reviews through contributions to the joint OMB and ONCD Administration Cybersecurity Priorities memoranda for the FY 2025 (M-23-18) and FY 2026 (M-24-14) budgets. Work with budget staff and resource management officers to bring budget, resource, and cost-saving considerations into cybersecurity policy development and advisement.
Advised EO 14144, Strengthening and Promoting Innovation in the Nation's Cybersecurity (January 2025), and EO 14306 (June 2025), and work the modernization of OMB Circular A-130 they directed.
Zero Trust policy advisor and working group member; helped organize the July 18, 2023 White House Multifactor Authentication Modernization Symposium. Advised the Secure Software Attestation policy (M-23-16) and supported agency concerns and questions through Cyberstat. Advised M-26-05, Adopting a Risk-based Approach to Software and Hardware Security (January 2026), M-26-10, Reinforcing Transparency, Accountability, and Oversight of Federal Technology (March 2026), and Federal Risk and Authorization Management Program (FedRAMP) modernization (M-24-15 and FedRAMP 20x).
Advised on and helped improve authorization-to-operate (ATO) processes through OMB.
Medical IoT lead and guidebook author, Aerospace IoT advisor, IoT CISO subcommittee member, and IoT Labeling advisor.
At the White House, helped lead IoT/OT playbooks and the U.S. Cyber Trust Mark initiative for IoT.
Provided implementation guidance and answered agency questions on M-23-13, No TikTok on Government Devices (2023), and advised its 2026 rescission (M-26-17). Security and technical advisor on digital-first public experience (M-23-22), Section 508 digital accessibility (M-24-08), and .gov domain (M-23-10) policies.
Coordinate vulnerability evaluation across federal stakeholders, using threat modeling and exploit path analysis to weigh systemic risk and harm.
Support federal major-incident readiness as Major Incident Response Commander and technical advisor for response policy and procedures. Designed and ran the September 2025 Federal CISO Council readiness tabletop exercise.
Helped host and organize the March 11, 2026 White House Convening on AI for Cyber Defense Optimization at the Eisenhower Executive Office Building, bringing federal cybersecurity leaders and frontier technology companies together on AI powered monitoring, detection and response, threat hunting, and cyber forensics. Takeaways spanned closing foundational gaps, federated data access, legacy and hybrid integration, human oversight, faster procurement and ATO pathways, and the new AI risk surface of model manipulation, drift, and data integrity.
Worked directly with NIST on IoT, logging, and risk publication updates, providing technical and emerging-technology input to make guidance clearer and easier for agencies to implement. Contributed technical advice to CISA products, including Binding Operational Directives and guidance, and to OMB legislative affairs, EOP components, and agencies.
Advise the Federal CIO and CISO on technologies and cybersecurity risk, prepared testimony and briefing materials for the October 25, 2023 House Homeland Security hearing on federal cybersecurity governance, and prepare principals for cabinet officers, foreign dignitaries, members of Congress, and public engagements including the Billington Cybersecurity Summit, Black Hat and DEF CON, FedTalks, the Homeland Security Defense Forum symposiums, and the Potomac Officers Club Cyber Summit.
Built and maintain strong relationships across the federal government, state, local, tribal, and territorial governments, and the private sector, including many agency CIOs and CISOs. Interview candidates, train new OFCIO staff and interns to be rapidly actionable, and advise across OMB policy portfolios to keep security policy achievable: never a roadblock, but an avenue to protect and enable agency missions.
National policy authored, contributed to, or advised at the White House, 2023 to present. Open a document directly or expand its title, context, and contribution details.
Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026). Replaced M-21-31 and set the stage for AI-enabled cyber defense through modernized logging and network visibility. Lead author.
Execution of the Migration to Post-Quantum Cryptography (June 24, 2026). Lead author.
Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 2025). Contributing author: new metrics and the logging, post-quantum cryptography, and incident response sections.
Fiscal Year 2024 Guidance on Federal Information Security and Privacy Management Requirements (December 4, 2023). Contributing author: new metrics and the logging, post-quantum cryptography, and incident response sections.
Administration Cybersecurity Priorities for the FY 2026 Budget (July 10, 2024) and the FY 2025 Budget (June 27, 2023), joint OMB and ONCD. Contributor.
Administration Cybersecurity Priorities for the FY 2026 Budget (July 10, 2024) and the FY 2025 Budget (June 27, 2023), joint OMB and ONCD. Contributor.
Post-Quantum Cryptography Future (August 13, 2024). Contributor.
Annual FISMA reports to Congress (2023 to present). Contributor. Link opens the FY 2023 report.
Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (April 3, 2025). Superseded M-24-10. Technical and policy advisor.
Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (March 28, 2024). The first binding government-wide framework for agency AI use. Technical and policy advisor.
Securing the Nation Against Advanced Cryptographic Attacks (June 22, 2026).
Ushering in the Next Frontier of Quantum Innovation (June 2026).
Rescission of M-23-13 (August 10, 2026).
Reinforcing Transparency, Accountability, and Oversight of Federal Technology (March 31, 2026).
Adopting a Risk-based Approach to Software and Hardware Security (January 23, 2026).
Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles (December 11, 2025).
Winning the Race (July 2025).
Sustaining Select Efforts to Strengthen the Nation's Cybersecurity (June 6, 2025).
Driving Efficient Acquisition of Artificial Intelligence in Government (April 3, 2025). Superseded M-24-18.
Removing Barriers to American Leadership in Artificial Intelligence (January 23, 2025).
Strengthening and Promoting Innovation in the Nation's Cybersecurity (January 16, 2025).
Advancing the Responsible Acquisition of Artificial Intelligence in Government (October 3, 2024).
Modernizing the Federal Risk and Authorization Management Program (FedRAMP) (July 25, 2024), including FedRAMP 20x.
Strengthening Digital Accessibility and the Management of Section 508 of the Rehabilitation Act (December 21, 2023). Security and technical advisor.
Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (October 30, 2023). Implementation.
Delivering a Digital-First Public Experience (September 22, 2023). Security and technical advisor.
Update to M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (June 9, 2023).
No TikTok on Government Devices Implementation Guidance (February 27, 2023). Implementation guidance; rescinded by M-26-17.
The Registration and Use of .gov Domains in the Federal Government (February 8, 2023). Security and technical advisor.
CISSPCertified Information Systems Security Professional · ISC2 · 2019View my Credly profile
CISMCertified Information Security Manager · ISACA · 2022View my Credly profile
GPENGIAC Penetration Tester · 2018View my Credly profile
GCTIGIAC Cyber Threat Intelligence · 2020View my Credly profile
GSLCGIAC Security Leadership · 2022View my Credly profile
GSTRTGIAC Strategic Planning, Policy, and Leadership · 2022View my Credly profile
GCSAGIAC Cloud Security Automation · 2021View my Credly profile
ITIL 4ITIL 4 Foundation in IT Service Management · PeopleCertCredential description
FSCEForescout Certified ExpertCredential description
Pending: Certified in Emerging Technology (CET).
Qualys, Nexpose, Nessus and other Tenable solutions such as Security Center, Burp Suite, OWASP ZAP, nmap, sqlmap, Metasploit, Netcat, John the Ripper, Empire, Hydra, Arachni, SSL Labs, Kali Linux, Fing, Ettercap, and spoofing tools.
PromptMap, Garak, PyRIT, Cybench, Promptfoo.
RSA Archer, Reciprocity ZenGRC, AuditBoard, LogicGate, ServiceNow, Splunk, Taegis, Demisto, Intel/McAfee SIEM, CrowdStrike, Cylance, Cyphort, FireEye, Thycotic, BMC Remedy, Salesforce.
ForeScout CounterACT, Imperva SecureSphere WAF and Database Activity Monitoring, Imperva Incapsula, Zscaler, Lookout, Check Point, Zimperium zIPS and zANTI, MobileIron, AirWatch, Forcepoint Triton, Citrix.
Python, Xcode, Visual Studio, Eclipse, Coda, WordPress, Jina, TeamViewer, Final Cut Pro, Adobe Premiere Pro, After Effects, Illustrator, Grass Valley Edius, BoinxTV.
Binghamton University, State University of New York
Binghamton University, State University of New York
