I work at the intersection of cyber defense, AI safety, and emerging risk, where the threats are converging and the playbooks are still being written.

My career has taken me from the Marine Corps to NSA, U.S. Cyber Command, the U.S. House of Representatives, Mandiant, and Netflix. Across every role, one throughline: understanding adversaries, building high-trust teams, and translating complex problems into strategies leaders can act on.

Today, I advise organizations, governments, and research institutions on AI governance, agentic threat preparedness, and unifying safety and security into a single discipline. I contribute to global standards efforts including the EU AI Act (via OWASP AI) and lead executive education on cybersecurity and AI strategy at SANS.

If you’re navigating the future of AI risk or security strategy, let’s connect.

Chris Cochran

As a U.S. Marine who spent years working alongside special operations teams, I learned that different missions require radically different mindsets.

Everybody loves the Navy SEAL archetype: aggressive, adaptive, and masters of improvisation.

But if you deploy AI agents with that mindset, you are inviting disaster. AI doesn’t have the judgment to improvise. When it tries, it makes mistakes.

In high-stakes business environments, you don't need the "bang" of chaos; you need the "whisper" of control. You need more of a Delta Force methodology.

In my latest article, I break down why AI requires more determinism, and less heroism, and introduce CONTROL for governing agentic AI.

Read the full strategy below. 👇

Field CISO & VP, AI Security @ SANS | Bridging Cyber Defense and Frontier AI Risk | Ex-NSA, Netflix, Mandiant | US Marine Veteran

Let me set the tone clearly: This is not a debate about which group is "better." Both are elite. Both accomplish the impossible. As a US Marine, I res

Open article: Why You Need to Manage AI Agents Like Delta Force, Not Navy SEALs by Chris Cochran • 4 min read

Why You Need to Manage AI Agents Like Delta Force, Not Navy SEALs

What is your current view of AI in cybersecurity? I bet its a mixed bag. 

Foster Nethercott wants to hear directly from you. 

Make your voice heard. 

Just want the TLDR? Rob T. Lee and Foster will be hosting a livestream July 15th to cover the insights. 

Links to both in the comments. 

SANS Institute

Netflix

Leading 3 functional teams (STAR  - Security, Technology Assurance & Risk | Strategy and Operations | Business Information Security Officers).

Senior Manager, Security Leadership & Engineering

● Designed and currently lead a cyber risk management program focusing on quantitative measurements to drive business investment decision-making, which established a risk tolerance level of $130M to $150M to aid in prioritizing engineering and security investments

● Developing a metrics and assurance program to support and inform Executive Leadership, Engineering
Leadership, Board Members, and Audit Committee members. This program measures thresholds and
targets that drive alignment across performance, security, and other business strategies.

● Established an engineering-first compliance program focused on unified controls, automation, control
effectiveness, control visibility, and self-service evidence functionality

● Created a governance program that established guiding principles for identity access management,
workforce security, and data governance.

● Developed and grew staff competencies through team development, implementation and support of
specific training for various responsibilities.

Head of Security, Technology Assurance & Risk (STAR)

Security BSides Las Vegas

BSides Las Vegas is a nonprofit organization formed to stimulate the Information Security industry and community by providing an annual, two-day conference for security practitioners and those interested in (or looking to) enter the field.

Board Member

Stitch Fix

● Established and executed a 3-year security roadmap to build security capabilities within the organization. The initial security plan focused on Product Security, Cloud Security, Data Security, Incident Response, Infrastructure Security, GRC, and Enterprise Security.

● To support business expansion into European markets, lead the team to develop a comprehensive data
security and protection program that adhered to GDPR compliance.

● Integrated and embedded security into engineering (DevOps) processes to increase security control
adoption

● Created and presented metrics and reporting KPIs to Executives, the Audit Committee, and the Board to highlight security's impact on the business

● Established the first fraud team (Security, Customer Service, and Data Scientists) to address customer
impact and minimize fraud with annual savings of $1.5M)

● Created a strong security communications practice: regular email and Slack communications to educate staff against known threats and potential attack vectors and timely security incident reports, highlighting breaches, vulnerabilities and remedial measures

● Developed and maintained incident response protocols to mitigate damage and liability during security breaches

● Designed company-wide policies to align operations with Center for Internet Security (CIS) standards

● Collaborated with third-party payment card industry (PCI) compliance partners

Director Of Information Security

Twilio Inc.

● Responsible for developing a comprehensive security program for Twilio's Amazon Web Services
Production platform

● Implemented low friction application security design and reviewed 20+ applications monthly

● Executed Threat Vector Analysis for Applications, Services, and Infrastructure to ensure Secure Software Development

● Establish lagging security metrics for operational insight and strategic development

● Responsible for the creation and expansion of the security monitoring and incident response capability
for Twilio Enterprise

● Developing security controls to adhere to Regulatory Compliance (SOC2, PCI Merchant Level 1,
ISO27001)

● Analyzed network security and current infrastructure to assess areas in need of improvement and
develop solutions

● Identified computer hardware and network system issues, performing troubleshooting techniques for
remediation

Security Engineering Manager

CODE2040

Fellows Program Council Co-Chair

LinkedIn

● Spearheaded the development and scaling of security monitoring and incident response capabilities for LinkedIn Enterprise across key global regions including the USA, UK, China, South America, and India

● Established and refined the LinkedIn Incident Response Program, ensuring robustness and agility

● Directed security architecture and set requirements for LinkedIn's expansion into China

● Collaboratively devised LinkedIn's Cloud Security Strategy, formulating security protocols and assessment methodologies for SaaS applications

● Oversaw and administered the GRC process, with a focus on PCI compliance

● Led investigations into copyright violations and instituted a proactive monitoring strategy to curb infringement activities

Manager, Information Security

McAfee

● Solutions Architect for McAfee ePolicy Orchestrator Management Platform within the Federal and
Healthcare Business Sector

● Developed training material for US Intelligence customers to maximize analyst time for computer
network defense (CND) and incident response triage (IR)

● Develop risk metrics for enterprise assets to assist customers in developing and designing a continuous monitoring program for compliance and risk assessments (e.g., certification and accreditation (C&A))

● Performed automated malware analysis using McAfee Network Threat Response, Global Threat
Intelligence Artemis, and open-source tools providing situational awareness for customers for incident
response and (idk)

Principal Professional Services Consultant

DISA

● Provided technical security oversight and lifecycle management to the Department of Defense
Host-Based Security System (HBSS) Program, which supported 3 million+ assets within the DoD ($50M+
program)

● Provided enterprise strategic planning for the implementation and utilization of IDS security tools as part of DoD Directive 8500 series

● Developed an asset risk scoring process to identify critical systems and score the asset's risk posture,
allowing generals to make critical operational and mission-related decisions

● Analyzed HBSS events to assist EUCOM Headquarters Security Operations Center (SOC) in adopting
HBSS events as part of their incident response process and event triage process utilizing the Attack,
Defend, Detect, and Remediate (A2DR Methodology)

Computer Scientist

Penn State University

Research open source integrity monitoring systems and log management systems.

Network Development Program

Northrop Grumman Corporation

Develop widgets for web based JSP application.

Java Programmer (Intern)

With over 15 years as a pioneering technology executive, I stand at the crossroads of cybersecurity and risk management. My deep-rooted expertise spans Information Assurance (covering governance, risk, and compliance) to Security Engineering (focusing on both enterprise and cloud security). 

At the heart of fast-growing, heavily regulated industries, I've built and steered elite teams, excelling in guiding vast, remote, and diverse cross-functional groups within evolving organizations. My primary mission? To seamlessly merge business aspirations with security strategies, ensuring investments result in optimal security outcomes. I champion programs that harmonize innovation with risk management, all while ensuring resilience. Collaboratively working with Senior Leadership and Board members, I establish risk frameworks to foster enhanced cyber resilience, informed decision-making, and amplified productivity. 

My commitment lies in fostering an enterprise-wide culture vigilant against cyber threats, ready to identify, preempt, counter, and recuperate from potential cyber incursions.

Charles Nwatu

Don't get stuck. Help your stakeholders by providing the context to help drive decision-making. GRC is the decision model you need to bring together your security engineering and privacy teams.

GRC is leveling up in 2026! 😎 It's gonna be fun!

#DecisionScience #BehavioralEconomics #ChoiceArchitecture #RiskManagement #FAIRframework #GRC #CyberSecurity

taplio

The Battle

Chris Cochran

Charles Nwatu

Followers

Posts

Engagements

Likes

Performance ScoreChris Cochran's LinkedIn Performance

Performance ScoreCharles Nwatu's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Chris Cochran

Charles Nwatu

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Chris Cochran's LinkedIn Performance

Performance ScoreCharles Nwatu's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreChris Cochran's LinkedIn Performance