Observe the flow before you direct it.

You cannot direct a system you have not watched.

Observe the flow before you direct it. It's the closest thing I have to a rule, and it came from watching rather than from a book.

Every system already has a current running through it before you arrive. A team has one. An incident has one. So does a budget cycle, an agency, a market, and any room full of people about to decide something. That current is there whether or not you've bothered to read it, and the fastest way to lose is to push against a flow you never took the time to see.

Most of the expensive mistakes I have watched, and a few I have made myself, came from someone deciding before they understood. Usually because deciding felt like leadership and watching felt like hesitation. It's almost always the other way around. The watching is the work, and directing is just what becomes possible after.

Born here. Raised here. Still here.

None of which is an accident. Baltimore is less a biographical detail than an operating system. Old Bay goes on everything, including a few things you wouldn't expect and one or two you should probably not attempt. A half and half is a beverage, not something you put in coffee. Club music is real music and I'm not taking questions.

The Ravens and the Orioles are not negotiable. The Ray Lewis dance is load-bearing. And it's not a coincidence that my favorite color is Orioles orange, which is why it is all over this page.

I'm married, and we're raising our kids here. That's the part of the Baltimore decision that actually took thought, and it's the one I'd make again.

I tend to say I am from Baltimore before I say any title. The route from where I started to where I sit now was not visible from where I was standing, and I would like it to be a little more visible to somebody else.

Manly deeds, Scholarship, and Love for all mankind.

Nature, mostly.

The thread is nature, and the pace of nature. Measured patience.

Every time the job changed, I went back.

I started at Morgan State in electrical engineering in 2005, and that is where I worked out that I liked the systems more than I liked the circuits. In 2007 I moved to University of Maryland Global Campus and started my career the same year. The bachelor's and the master's after it were both earned at night, alongside a full-time job, which is the only way I've ever known how to do it.

Read the list below from the top and you get the pattern in reverse, which is roughly how I noticed it. Illinois now, because the next set of rooms speaks in capital allocation rather than controls. Carnegie Mellon when the seat became a CIO's problem rather than a CISO's. Cornell when the work stopped being technical and started being about people. Every time the job changed shape, I went and got trained for the version of it I didn't yet know how to do.

The half a board can verify.

If you arrived here from a board search or an advisory conversation, this is the part that checks out on paper. I am the State Chief Information Security Officer for Maryland. Before that, CISO at two federal agencies. Before those, going back to 2007, security and technology work at Raytheon, Iron Vine, USAID, the Securities and Exchange Commission, the Centers for Medicare and Medicaid Services, and T. Rowe Price's global financial operations.

Across those seats I have carried cybersecurity budgets from $13 million up to $60 million, and directed a $300 million IT portfolio as a deputy CIO. I have briefed C-suite executives, White House staff, and board members on risk posture, which in practice means turning a technical threat into a number a finance executive can actually act on. I built the risk quantification methods to do it alongside finance and risk leadership rather than at them.

Every program I have run has also been examined by somebody whose job was to find the gap: inspectors general, legislative auditors, congressional staff, the Government Accountability Office. I've never operated a security program that wasn't being graded by an outside party, which turns out to be reasonable preparation for a board.

On the governance side, I serve as Vice Chair for Government and Chair for State and Local within the ACT-IAC Cybersecurity Community of Interest, a national public-private body where those seats are nominated rather than volunteered for. Closer to home I chair or sit on several Maryland councils and commissions covering critical infrastructure protection and healthcare cybersecurity.

Before those: Vice Chair of InspireCISO's Capital Region chapter through 2026, co-chair of the Federal CISO Council's CISA engagement working group, and a seat on the GIAC advisory board since 2017. InfraGard rounds it out.

LinkedIn keeps the full account and I keep it current. Everything else on this page is the half a resume cannot carry, and in my experience that is the half that decides whether somebody belongs at the table.

The companies I own and operate.

StrataLeaf Technologies LLC is the holding company. Three brands under it, one governing logic: protect what exists, lead what is coming, invest in what lasts.

Recognition, and other people's accounts.

Useful mostly because none of it was written by me.

Awards

Coverage