Lingua
Mac · Windows · iPhone & iPad soonLanguage learning with lessons, vocabulary drills and grammar by CEFR level. Russian, Korean, German and Italian, plus a Hungarian starter pack. Built-in speech, no account, works offline.
Security leader · Software builder
I help organizations get security right, and I build small software that respects its users.
vCISO and security consultant for law firms and growing businesses. In my own time I design and ship desktop and mobile apps: local first, no accounts, no tracking.
- CISSP since 2008
- CISM
- CCISO
About
I've spent over 20 years on the defensive side of security, in defense and aerospace, fintech, banking and healthcare. Today I work as a virtual CISO and consultant, helping firms build security programs that hold up to auditors, clients and attackers alike.
I've owned SOC 1 and SOC 2 Type II audits end to end, briefed boards on risk, and run incident response tabletop exercises with executive teams. I spend most of my time translating technical findings into business decisions.
My roots in the defense industry still shape how I work. As an ISSO and ISSM, I worked within the NIST Risk Management Framework, from categorizing systems and selecting controls through assessment and continuous monitoring. I've also performed CMMC Level 2 gap assessments, measuring environments against the 110 requirements of NIST SP 800-171 and laying out a clear remediation plan.
More and more of my work is about AI: assessing AI vendors, writing acceptable-use policies, and mapping AI risk for firms that handle privileged information. I'm preparing for ISACA's AI security management credential (AAISM), and I run AI models locally in my own apps, so I know what "the data never leaves the device" takes in practice.
Outside my apps, I run open AI models on my own Mac for projects where the data shouldn't leave the machine: short animated videos made with my daughter, and a local editing pass that tightens my drafts into plain, direct writing before I review them. Keeping AI local is the same advice I give clients, applied to myself. Here's how I set it up.
I build the tools I wish existed, usually for someone specific: a language app for my daughter, a way for my mom to save the 8-hour fireplace videos she loves, a PDF combiner for homework nights. Each one gets the treatment I'd expect from a vendor I was assessing: signed releases, a strict content security policy, no telemetry, and an independent code review before release.
If we've worked together, you've probably seen the Diet Mountain Dew. Yes, that's what the logo is.
What I work on
- Security program development and management
- Risk assessments and board-level reporting
- Audit readiness: SOC 1, SOC 2, HIPAA
- Federal and defense compliance: NIST RMF, CMMC Level 2, FedRAMP
- Vulnerability management that actually closes findings
- Incident response planning and tabletop exercises
- AI security risk and vendor reviews
Frameworks
Apps I've built
Built with Tauri, React and Rust. Each one keeps your data on your own device, signs its releases, and goes online only to check for updates and to do what you ask of it. The privacy page lists exactly what each app connects to.
Bible Overview
Mac · WindowsA Bible reading companion. An overview of every book with its major events, people and key verses, and the full text in the KJV, BSB or WEB. Read aloud with the verse lit, look up old words, keep notes and bookmarks, and find sermons and commentary on the chapter you're reading.
Sermon and commentary links open the churches' and publishers' own websites. Not affiliated with them.
Cairn Exam Prep
WindowsPractice questions for AAISM, CISA, CISSP and CIPP/US, each reviewed and approved by a certified practitioner. New questions arrive as signed packs, and your progress never leaves your computer.
Get it from the Microsoft Store
Not affiliated with, endorsed by or sponsored by ISACA, ISC2 or IAPP.
PDF Combiner
MacCombine PDFs and phone photos into one file. Drag pages into order, turn or remove them, sign, fill in forms, unlock password-protected files, and shrink the result to fit upload limits.
MD to Word
MacTurn Markdown into Word documents. Drop in .md files and get .docx files with real headings, lists, tables, coloured code, pictures, footnotes and editable equations. Works offline; nothing is uploaded.
Media Grabber
Mac · WindowsA small media toolkit for home use. Save sermon audio and long ambience tracks, make plain-text transcripts, trim and join clips, add falling snow or rain to a photo or short video, and turn iPhone HEIC photos into JPGs for printing. Everything runs on your own computer.
For personal use with content you have the right to save. You're responsible for following each site's terms and copyright law. Not affiliated with YouTube, Facebook, SermonAudio or Grace to You.
GRC Workbench
In developmentA desktop workbench for the monthly vulnerability remediation cycle: compare scans, confirm closures host by host, draft tickets with SLA due dates, and produce the Excel and Word reports. Everything stays on the analyst's machine.