I build security, compliance, and AI governance programs and run the automation that keeps them alive. Currently leading a SOC 2 audit engagement and governed enterprise AI adoption at Lotlinx, backed by 15+ years of IT leadership across automotive ad tech, offshore oil & gas, and professional services.
I lead security, compliance, and IT operations at Lotlinx, where I built the security function from the ground up: a SOC 2 program now in external audit, a 20+ policy governance framework, a layered endpoint and cloud security stack, and organization-wide AI adoption with the controls and usage monitoring designed in from day one. Behind that sits 15+ years of owning entire technology estates across automotive ad tech, offshore oil & gas (including an IMO-mandated maritime cyber security plan), and professional services. My pattern is consistent: find the gap, make the business case, design the solution, run the rollout, then automate it so it scales.
Built a SOC 2 program from first internal pitch to external audit engagement: a 20+ policy framework, GRC platform automation, penetration testing, tabletop exercises, and a security team I hired and lead. Vulnerability trends, audit progress, and risk reporting all run through me.
Led organization-wide adoption of Claude, Claude Code, Cursor, and Gemini as both the governance owner and a heavy daily practitioner. Wrote the AI policy, built the security controls, spend caps, and usage monitoring, and built the dashboard leadership uses to steer AI investment.
Architected the identity platform (SSO, MFA, SAML, OIDC) and lifecycle automation with the HRIS as source of truth, keeping access accurate from onboarding through offboarding across the entire SaaS estate over SCIM.
Highlighted initiatives spanning SOC 2 compliance, AI governance, security operations, identity, and automation.
Directed a ground-up SOC 2 program from first pitch through external audit engagement: policy framework, gap assessments, GRC platform implementation, penetration testing, tabletop exercises, and the auditor relationship. Evidence collection runs on automation, not spreadsheets.
Wrote the AI acceptable-use policy and led the phased rollout of Gemini, Claude, Claude Code, and Cursor with controls built in from the start: risk assessments, OpenTelemetry usage monitoring, spend caps, and IdP-governed provisioning. Extended governance to MCP servers with an SOP, inventory tooling, and a request intake process.
Built the dashboard leadership uses to steer AI investment, covering per-user adoption, usage depth, and spend across Claude, Cursor, and Gemini. Data collection is automated, including a PowerShell exporter written against a vendor analytics API.
Ran the cloud security platform selection, choosing a CNAPP while retiring native AWS and GCP security tooling. Baselined cloud-native Kubernetes container CVE exposure in production, including VM instances in EC2 and Azure, and stood up malicious-package alerting. Utilized DSPM capabilities and secrets detection.
Built the company's information security policy framework from zero into a versioned library of 20+ documents, each carried through legal, HR, and executive approval with employee attestation. Every policy is backed by a working control, so the framework holds up under audit.
Led evaluation, procurement, and rollout of an MDR service integrated across the SaaS estate, cloud infrastructure, and every endpoint. Vulnerability counts have trended down since deployment, reported quarterly to leadership.
Built and led supply chain threat mitigation across the engineering estate: scripted exposure sweeps of the source control estate, malicious-package alerting, post-event analysis for leadership, and automation that shortens detection and response when upstream threats appear.
Established tabletop exercises as standing controls: incident response scenarios with DevOps, legal, compliance, and executives, plus annual business continuity and disaster recovery testing. Designed and ran a company-wide security tabletop at the product and technology summit.
Built the CCPA and data-subject request process with defined SLAs and automated intake, drove privacy policy and MSA updates with legal, implemented consent management on the website, and managed the Privacy Impact Assessment for the company's Canadian market launch with external privacy counsel.
Selected and led UEM/MDM deployments for both Windows and macOS fleets: zero-touch enrollment, policy and script architecture, application whitelisting, local admin removal, and identity-connected login. Closed the MDM gap across both operating systems.
Architected and deployed the company's identity provider as the foundational security platform, migrating the full SaaS estate to centralized SSO, MFA, SAML, and OIDC, including modifying an internally hosted application to authenticate over OIDC.
Built automated identity management with the HRIS as the source of truth, pushing employee metadata through the identity provider to every connected application over SCIM and SAML, so job changes and terminations propagate without manual work.
Engineered joiner-mover-leaver workflows using APIs, SCIM, webhooks, and a SaaS management platform, consolidating roughly twenty workflows into five with conditional logic. Ten simultaneous onboardings became a routine morning.
Evaluated competing EDR platforms, selected one, and deployed it silently to the full Windows fleet with zero support tickets, followed by macOS. Detections route to chat and ticketing for triage; the deployment satisfied cyber insurance requirements and SOC 2 endpoint controls.
Built the business case for an RMM platform twice (first deferred, then approved on quantified cost of manual work), rolled it out to 95%+ of the fleet, and wrote a PowerShell automation library including a two-ring patching model with an expedited path for critical CVEs.
Replaced spreadsheet credential storage with an enterprise password manager: IdP-integrated SSO and SCIM provisioning, agents pushed through RMM, shared vault architecture, and admin training sessions.
Deployed next-generation firewalls and access points across all offices with centralized, declarative management, site-to-cloud VPN with segmented zones, and complete IT builds for office moves in five cities.
Audited email-enabled systems and implemented DMARC to improve deliverability and mitigate spoofing and spam.
Developed vessel cyber security plan per IMO MSC-FAL.1/Circ.3 using the NIST Cybersecurity Framework for process control and safety systems.
Built a PHP/LAMP document management system with SMB replication via FTP to remote sites and intranet integration.
Career spanning IT leadership, offshore vessel operations, accounting, and public sector work terms.
Automotive ad tech leader serving US dealerships with roughly 200 employees across six offices in Canada and the US. First dedicated IT Manager; built the IT and security operations function from the ground up and lead the company's SOC 2 program.
Marine transportation company with 160 employees, two offices, and six seagoing vessels. Administered marine ERP (ABS Nautical Systems) and vessel IT infrastructure.
Full-service accounting firm with 70 staff. Sole IT resource at an Atlantic Canada's Top Employer.
No fake progress bars. Just the stuff I’ve actually used or built with.
Education, certifications, conferences, and professional community.
BetterCloud · Passed at 96% while running the platform rollout
Canadian Centre for Occupational Health and Safety
CompTIA
College of the North Atlantic · Three 4-month work terms
Reach out via the contact form or LinkedIn.
I'm interested in security operations, compliance, and IT leadership roles, and in opportunities where I can keep building real technical depth: SOC 2 and GRC automation, governed AI adoption, cloud and endpoint security, and identity. If any of that matches what you're working on, reach out.