Crisis-tested Information Security Executive with deep expertise in cloud security, cyber incident response, data protection, and regulated infrastructure. Proven leader in protecting large-scale, mission-critical environments through threat-informed security strategy, operational resilience, and legally defensible incident response. Led and governed global CSIRT operations (24x7), independently managing high-severity incidents including cloud compromise, data disclosure, DDoS, malware, DLP breaches, and insider-related events. Investigated 1,000+ cyber and data incidents, translating forensic findings into executive decisions in close coordination with legal, compliance, and customer leadership. Architected and embedded security-by-design across cloud platforms and regulated services, including IBM Cloud for Financial Services. Extensive experience aligning security programs with global regulatory and assurance frameworks such as NIST SP 800-53, FedRAMP, ISO/IEC 27001, SOC 2, GDPR, DORA, HIPAA, PCI DSS, and FFIEC. Cyber risk and resilience executive with 25 years of leadership across regulated cloud, financial services, technology and mission-critical environments. Trusted adviser to Board and C-suite leaders, regulators and external auditors on technology risk, third-party risk, incident response and regulatory assurance. Currently lead risk governance for a ~$100M technology portfolio at IBM spanning Cloud and Consulting, covering 200+ suppliers, 50+ ISVs and 500+ assessments a year. Owner of the Cloud Supplier Exit Strategy and Cloud Supplier Offboarding Framework, a risk-based approach to secure supplier termination, transition, access revocation, data deletion, evidence retention and residual risk closure. Founded IBM's third-party risk assessment (TPRA) function (2,000+ suppliers assessed), led a 24x7, 25-person CSIRT through 1,000+ incidents (MTTR down 70%), and built AI-enabled audit automation on IBM Bob/watsonx that cut client questionnaire turnaround from 2.5 days to about 30 minutes. Zero major findings across multiple regulatory assessments.