My Approach to Security Leadership
I came to security leadership through an unusual path: advanced technical work followed by product management. This progression shaped how I think about the role, as I focus on helping the business succeed, not just protect it. I've learned to collaborate with colleagues across teams and ask the right questions so I can further the company's objectives. As a CISO, I draw on over 25 years of in-the-field experience, a Computer Science degree from UPenn, and an MBA from MIT Sloan.
Leading Security and IT at Axonius
As CISO on the executive leadership team at Axonius, I've built and led the security and IT program since the company was a nascent startup. I initially joined Axonius as VP of Product before transitioning to the newly-created CISO role, which gave me a strong vantage point: I understood the business before I took responsibility for protecting it. My mission has been to:
- Build lasting trust in the security of the company's products.
- Empower the company to grow while managing risks.
My strategy involves:
- Finding ways to say "yes" to business initiatives.
- Knowing when to apply pressure to prioritize security tasks and when to pull back.
- Becoming an action-oriented leader to deliver measurable results.
- Adopting new technologies—including AI—in a practical and responsible way.
- Minimizing the attack surface to strengthen defense and lower costs.
I've managed the security and IT program through multiple stages of Axonius' growth, from an early-stage startup that won the RSA Innovation Sandbox, to reaching unicorn valuation, to a maturing organization recognized on Forbes Cloud 100 and Deloitte Technology Fast 500.
Background That Informs My Approach
Before Axonius, I built cybersecurity products and services in roles that taught me to think like a business owner. I led product management for endpoint security software at Minerva Labs (acquired by Rapid7). At NCR, I developed a managed security service for businesses that didn't think they could afford protection. Earlier, at Savvis (now part of Lumen), I led security consulting during the early days of cloud computing, helping organizations navigate unfamiliar risks.
I've stayed close to the technical side of security over the years. This includes projects such as the open-source REMnux toolkit and the malware analysis course at SANS. These hands-on activities help me evaluate security claims and guide technical decisions.