For agencies, contractors, and public institutions at every level
Security leadership for government and the organisations that serve it
Government security work has its own shape. The adversaries are different, the accountability is public, the frameworks aren't optional, procurement moves at its own pace, and the mission usually can't stop while you fix things. I've served as the subject-matter expert for US and allied governments from the municipal level to the national, and for the contractors and institutions that work alongside them. I know the difference between a control that satisfies an assessor and one that would stop an intrusion, and I know you often need both.
What I bring to a public-sector role
Operational depth: about twenty years hands-on in incident response and security operations, which matters in environments where the incident is a national-security or public-safety event rather than a business interruption. Framework fluency: NIST's families of guidance as working tools rather than compliance paperwork, and an understanding of how authorisation, continuous monitoring, and incident reporting actually get done inside an agency or a contractor. The academic grounding, through a PhD centred on cybersecurity, AI, and the criminal use of technology, and a law school education that helps when the question is what the rules actually require. And the patience public-sector delivery takes.
The kinds of role
Agency or departmental security leadership. Security leadership inside a contractor or systems integrator serving government. Programme leadership for an authorisation, a modernisation, or an incident-driven rebuild. Advisory roles for public institutions, utilities, and critical infrastructure operators with government oversight. And the allied and international variants of each, where I've worked as well.
What I don't claim here
Specific agencies, programmes, and engagements stay under NDA, and I don't publish clearance or employment detail. If a role requires particular eligibility, we'll establish that privately and early.
The honest fit
This works where leadership wants someone who can run the operation and speak the framework language, and where the role has the authority to act between oversight cycles. It doesn't work where the security role exists to produce documentation and nothing else.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research How Do You Set a Sustainable Workload for a Security Team?
- Research How Can a Board Verify That Cyber Risk Is Improving?
- Research Which OT Cybersecurity Risks Should You Address First?
- Short Who do we have to notify after a breach, and by when?
- Short Who's in charge of an incident when IT and security disagree?
Related work.
Other ways I'm engaged on the same problems.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
- For recruiters and search firms: what I'm a fit for, and what I'm notA straight answer for search firms: roles, fit, non-fit, and how to get a fast yes or no from me.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- Agencies and public institutions at federal, state, and local level hiring senior security leadership.
- Contractors and integrators serving government who need a security leader who's worked both sides.
- Allied governments and international organisations with comparable requirements.