I build security, compliance, and AI governance programs and run the automation that keeps them alive. Currently leading a SOC 2 audit engagement and governed enterprise AI adoption at Lotlinx, backed by 15+ years of IT leadership across automotive ad tech, offshore oil & gas, and professional services.
I lead security, compliance, and IT operations at Lotlinx, where I built the security function from the ground up: a SOC 2 program now in external audit, a 20+ policy governance framework, a layered endpoint and cloud security stack, and organization-wide AI adoption with the controls and usage monitoring designed in from day one. Behind that sits 15+ years of owning entire technology estates across automotive ad tech, offshore oil & gas (including an IMO-mandated maritime cyber security plan), and professional services. My pattern is consistent: find the gap, make the business case, design the solution, run the rollout, then automate it so it scales.
Built a SOC 2 program from first internal pitch to external audit engagement: a 20+ policy framework, Secureframe GRC automation, penetration testing, tabletop exercises, and a security team I hired and lead. Vulnerability trends, audit progress, and risk reporting all run through me.
Led organization-wide adoption of Claude, Claude Code, Cursor, and Gemini as both the governance owner and a heavy daily practitioner. Wrote the AI policy, built the security controls, spend caps, and usage monitoring, and built the dashboard leadership uses to steer AI investment.
Architected Okta SSO and MFA, BetterCloud lifecycle automations, and HRIS-driven identity with Rippling as the source of truth, keeping access accurate from onboarding through offboarding across the entire SaaS estate over SCIM and SAML.
Highlighted initiatives spanning SOC 2 compliance, AI governance, security operations, identity, and automation.
Directed a ground-up SOC 2 program from first pitch through external audit engagement: policy framework, gap assessments, Secureframe implementation, penetration testing, tabletop exercises, and the auditor relationship. Evidence collection runs on automation, not spreadsheets.
Wrote the AI acceptable-use policy and led the phased rollout of Gemini, Claude, Claude Code, and Cursor with controls built in from the start: risk assessments, OpenTelemetry usage monitoring, spend caps, and Okta-governed provisioning. Extended governance to MCP servers with an SOP, inventory tooling, and a request intake process.
Built the dashboard leadership uses to steer AI investment, covering per-user adoption, usage depth, and spend across Claude, Cursor, and Gemini. Data collection is automated, including a PowerShell exporter written against Cursor's analytics API.
Ran the cloud security platform selection, choosing Orca while retiring native AWS and GCP security tooling. Baselined cloud-native Kubernetes container CVE exposure in production, including VM instances in EC2 and Azure, and stood up malicious-package alerting. Utilized DSPM capabilities and secrets detection.
Built the company's information security policy framework from zero into a versioned library of 20+ documents, each carried through legal, HR, and executive approval with employee attestation. Every policy is backed by a working control, so the framework holds up under audit.
Led evaluation, procurement, and rollout of managed detection and response, integrated across the SaaS estate, cloud infrastructure, and every endpoint. Vulnerability counts have trended down since deployment, reported quarterly to leadership.
Built and led supply chain threat mitigation across the engineering estate: scripted GitLab exposure sweeps, malicious-package alerting, post-event analysis for leadership, and automation that shortens detection and response when upstream threats appear.
Established tabletop exercises as standing controls: incident response scenarios with DevOps, legal, compliance, and executives, plus annual business continuity and disaster recovery testing. Designed and ran a company-wide security tabletop at the product and technology summit.
Built the CCPA and data-subject request process with defined SLAs and automated intake, drove privacy policy and MSA updates with legal, implemented consent management on the website, and managed the Privacy Impact Assessment for the company's Canadian market launch with external privacy counsel.
Selected and led the Jamf and Jamf Connect deployment for the macOS fleet: zero-touch enrollment, policy and script architecture, local admin removal, and Okta-connected login. Closed the MDM gap alongside Intune on Windows.
Built automated identity management with Okta as definitive source of truth, integrating Rippling HRIS, SCIM, SAML, and BetterCloud API automations.
Engineered automated user lifecycle management using APIs, SCIM, webhooks, and custom JavaScript BetterCloud extensions.
Delivered Endpoint Detection and Response across all end-user devices to meet SOC 2 security controls and strengthen incident response.
Deployed Intune MDM for centralized device management, compliance policies, and remote wipe across the mobile fleet.
Migrated all passwords from shared spreadsheets to 1Password with employee training for secure password management.
Upgraded network infrastructure with FortiGate firewalls, FortiAP access points, FortiSwitch managed switches, and FortiManager across all offices.
Audited email-enabled systems and implemented DMARC to improve deliverability and mitigate spoofing and spam.
Architected and deployed Okta as a foundational security platform, migrating all applications to centralized SSO and MFA.
Developed vessel cyber security plan per IMO MSC-FAL.1/Circ.3 using the NIST Cybersecurity Framework for process control and safety systems.
Built a PHP/LAMP document management system with SMB replication via FTP to remote sites and intranet integration.
Career spanning IT leadership, offshore vessel operations, accounting, and public sector work terms.
Automotive ad tech leader serving US dealerships with roughly 200 employees across six offices in Canada and the US. First dedicated IT Manager; built the IT and security operations function from the ground up and lead the company's SOC 2 program.
Marine transportation company with 160 employees, two offices, and six seagoing vessels. Administered marine ERP (ABS Nautical Systems) and vessel IT infrastructure.
Full-service accounting firm with 70 staff. Sole IT resource at an Atlantic Canada's Top Employer.
No fake progress bars. Just the stuff I’ve actually used or built with.
Education, certifications, conferences, and professional community.
BetterCloud · Passed at 96% while running the platform rollout
Canadian Centre for Occupational Health and Safety
CompTIA
College of the North Atlantic · Three 4-month work terms
Reach out via the contact form or LinkedIn.
I'm interested in security operations, compliance, and IT leadership roles, and in opportunities where I can keep building real technical depth: SOC 2 and GRC automation, governed AI adoption, cloud and endpoint security, and identity. If any of that matches what you're working on, reach out.