Robert Wood

CISO | Servant Leader | Advisor | Lifelong Student (posts here are my own opinions and musings)

I have built, scaled, and run security programs as a CISO at 4 different organizations ranging from small tech startups to trillion dollar government organizations. The early part of my career was spent working in application security and red teaming. Cybersecurity is a passion of mine; using it to do amazing things is something that gets me fired up.

That’s why I founded Sidekick Security. To help organizations achieve security-led growth and digital transformations. In an age of trust as currency in so many industries, I believe this is the time when security truly can be an enabler. 

Beyond that, I am a lifelong learner. I love studying outside of my field and finding ways to expand the mental models I have to solve problems differently, more effectively, or to think about them in altogether new and fresh ways. 

Founder and CEO

Helping to connect SMBs and startups with exceptional security talent. A fresh, blue ocean strategy on the cyber security services market for organizations that really need it. 

AVA Compliance Solutions

AVA provides bespoke Governance, Risk, and Compliance (GRC) strategic advisory and implementation services such as the following:
- GRC Program Design and Roadmap: build for the current client needs with design for future markets and business goals. Specific offerings include setting up Enterprise Risk Management, Policies and Training, Customer Trust and Assurance to speed up Sales Operations, Third Party Risk Management, Internal and External Audits and automation.
- Help organizations with industry-specific needs and achieve attestations for compliance with various standards such as: FedRAMP/NIST-800-53, CMMC/NIST-171, NIST CSF, HIPAA, HITRUST, PCI DSS, IRAP, Cyber Essentials Plus, DORA, NIS 2, SEC and NYDFS reporting.
- Information security certifications and attestations: ISO 27001, ISO 27017, SOC 2 Type 1 & 2, Cloud Security Alliance STAR 1 & 2.
- Operation Technology (OT) cybersecurity certifications such as IEC 62443.
- Privacy program design and specific privacy compliance and certifications: GDPR, CCPA and other relevant US privacy laws, ISO 27018, ISO 27701.
- AI regulations and certifications: EU AI Act, ISO 42001.
- Other compliance requirements where applicable such as OFAC, ITAR, Digital Accessibility/WCAG, Ethics and Code of Conduct, Insider Threats.

Co-Founder and Partner

Akamai Technologies

Ensured successful transition of the Noname GRC function into the greater Akamai portfolio and appropriate teams and processes and supported targeted compliance objectives.
- Delivered 2024 Noname Security audits for PCI DSS, HIPAA, SOC 2 Type 2, and CSA STAR 2 completed on time and without any findings despite the transition of some tools and personnel over to Akamai.
- Ensured successful delivery of PCI DSS Level 1 certification for the API Secuity Platform (formerly Noname) and the Akamai Connector.
- Created detailed instructions and training for both Akamai and Noname Security Sales and GRC personnel on contract and RFP responses, as well as provided advice to improve Go-To-Market efficiency and deliver successful transition of Customer Trust and Assurances practices from Noname to Akamai with all contract/RFP requests addressed 100% and usually within 24 hours.
- Completed full gap assessment of the Australian government IRAP requirements, complete with detailed answers and specific evidence references.
- Completed full assessment of CMMC levels 1, 2, and 3 requirements with mapping to relevant SOC 2 and PCI DSS controls, and specific answers and evidence references.
- Assisted existing programs with EU DORA and NIS 2 compliance for comprehensive task tracking and scheduling.
- Developed executive presentation template for regulation compliance, including highlights on DORA and NIS 2.
- Performed analysis and provided recommendations for US government export compliance, such as ITAR and EAR.

Director of Compliance

University of Vermont Grossman School of Business

Advisor to Women in Leadership graduate program

Advisor

Noname Security

Continued the expansion of Noname’s amazing compliance program towards the IPO/acquisition stage.

VP of Compliance

Led an amazing team of security and privacy professionals to build the best compliance program in the world.
* Designed long-term compliance roadmap by aligning compliance frameworks and standards to meet current and future business and regulatory needs. Expanded existing SOC 2 and PCI DSS controls and added CSA STAR Level 2 and HIPAA attestations to provide a comprehensive and scalable foundation.
* Established an Information Security Management System. Created and updated 50+ policies, procedures, and standards to follow NIST best practices and other industry guidance.
* Developed internal audit framework and control testing, and enabled automation for monitoring and evidence gathering. Structured internal audit controls to meet all external obligations to reduce time and resources for external audits and enable quicker gap identification and resolution.
* Set up vetting of customers, partners, and vendors to meet regulatory compliance.
* Created and deployed new information security awareness training. Deployed new privacy awareness training. Set up metrics and alerting to track progress and ensure compliance.
* Assisted the sales team to increase efficiency and control in reducing the sales cycle and enforcing contractual standards.
* Participated in 300+ contract reviews and RFP responses. Negotiated directly with customers to significantly reduce corporate risk.
* Updated MSA and other contractual terms to reduce business risk and enable future business growth.

Director, Risk and Compliance / Global Risk Officer

ForgeRock

Designed and built a mature compliance program in less than 3 years to facilitate a hugely successful IPO.

Select accomplishments:
* Delivered ISO 27001 certification within the first year. Delivered successful attestations for SOC 2 Type 2, Cloud Security Alliance (CSA) Star Level 2, and HIPAA Security Rule/HITECH Breach Notification Requirements.
* Designed a comprehensive internal audit program to cover all ISO27001 and other security requirements, while reducing time spent by other business units and developing the audits to be scalable and easy to maintain going forward.
* Established relationships with key stakeholders and SMEs across all Business Units to speed delivery of security initiatives by 200%;
* Managed enterprise security risk program, identified 90+ risks and mitigations;
* Negotiated and responded to 200+ customer contracts and security RFP/RFI requests, including from top Fortune 500 companies.
* Provided security compliance reports and advice to executives.

Head of Security Compliance

Cisco

Oversaw end-to-end delivery of information security projects for Cisco WebEx and Cloud Services to protect 90,000+ business customers. 
• Led GRC initiatives to meet Cisco's Data Protection and Privacy requirements. Developed processes and build a security monitoring platform to provide visibility and proactive response to security threats. Assisted with vulnerability assessment and remediation.
• Provided technical guidance to meet audit compliance for FedRAMP, SOC2, and ISO 27001.
• Developed Infrastructure & Cloud logging and monitoring requirements and implementation guides.
• Identified ways to improve organizational effectiveness and security culture as a Product Security Advocate. Developed security awareness through Learning & Development training (videos, presentations, wikis) and presented to engineers and managers at Cisco internal conferences. Reduced product security issues by 200%.
• Managed several security engineers and performed hands-on research and analysis of Cloud and Infrastructure security. Identified and documented 100+ product security improvements. Developed 20+ new threat models and detection mechanisms.
• Established metrics and 5-year roadmap for global initiatives. Identified project dependencies and advanced efforts 6 months ahead of schedule.

Program Manager and Product Security Advocate

Dobrushkin.com

Management Consultant:
Improve organizational strategy, business operations, and work culture to increase productivity, enhance product vision, and sustain company growth. Clients include travel, non-profit, social networking services, mobile apps and games, network security, and stealth start-ups.
• Drive toward 80-20 rule. Identify key projects that will bring 80% of desired effect with 20% of resource investment.
• Reorganize processes, resolve cross-cultural and cross-functional difficulties in operation and communication.
• Promote positive work environment to increase employee productivity, collaboration, and retention.
• Develop user engagement and growth strategies. Lead local and international teams.
• Assess viability of technical projects and start-up opportunities to counsel angel investors.
• Provided technical implementation guidance to Silicon Valley start-up, which led to an early launch.
• Identified and implemented information security risk reduction and compliance strategies.

Life Coach:
Help individual clients rediscover and realign their passions with purpose to become who they were meant to be and realize their potential.

Management Consultant and Life Coach

SunnyKarma

Lead process improvement and design of systems and programs. Addressed shifting priorities and requirements in a fast-moving startup environment to ensure optimal system operations and user satisfaction.

Program Manager

Progeny Systems

Promoted to progressive responsibility via top performance

Technical Program Manager
Oversaw day-to-day management of large scale government projects.
• Managed projects for NASA and US Navy, which led to annual sales of more than $100 million and $45 million in revenue.
• Pioneered major program re-design by changing the Navy lab culture to collaborative effort across all units, even between competitor companies, increasing operations by 40%.
• Facilitated integration across 10+ parallel sites, shortened problem resolution to 1/3rd of original time. 
• Designed new security solutions that reduced software costs by 50% per year; a total savings of over $5 million for the Navy.
• Collaborated with 20+ contractor organizations, proactively driving system usability improvement and function.

Information Assurance Integration Lead
Directed integration of information security products across US Navy submarine fleet.
• Led system integration for Unix/Linux/Windows platforms and directed software and hardware testing, creating 400+ reports to facilitate compliance and accountability.
• Guaranteed compliance to DoD requirements (FISMA, ISO 27001, etc.) supporting successful Certification and Accreditation (C&A).
• Managed intrusion detection product from concept to delivery, saving the Navy over $1 million per year.
• Ensured integrity, confidentiality, and non-contamination of data across classified and corporate networks.

System Administrator / IT Manager
Ensured IT infrastructure security and operation across multiple offices.
• Developed Progeny’s first access system to classified data via SIPRNet circuit, meeting DISA accreditation.
• Managed IT assets, MS Windows AD environment with Exchange, DNS, WINS, DHCP services. 
• Deployed system-wide security solutions including IDS/IPS, firewalls, patch management, disaster recovery.

Software Engineer
• Developed client/server and Web applications, real-time data processing, database management, and Apache/IIS Web servers.

Technical Program Manager

Fraunhofer CRCG

Developed content search engines and graphical user interfaces using Java Servlets/Applets with Oracle/MySQL databases as the back-end.

Software Engineer

I love building compliance programs that extend beyond IPO due diligence to provide business value and visibility into where the biggest risks are and how to address them. I have managed every part of a compliance program, from internal audits to external certifications and customer audits, to customer trust, to third party risk management, to privacy and legal compliance, to contract review and negotiation. Working with people, building relationships, and solving problems together is what I enjoy most. I have done this in various IT and leadership roles over my two decade career with startups, Fortune 500, and government agencies.

Delivered two successful exits with both startups where I had led the GRC function (ForgeRock - IPO, Noname Security - Acquisition by Akamai).

Val Dobrushkin

#GRC and #security terrible practice example, having to pay certain amount to access Trust Center materials, which disables standard Third Party Risk Management practices for those customers.

Governance, Risk, and Compliance (GRC) Executive building IPO-proof GRC, Startup Advisor, Investor, Consultant, Mentor

The information technology industry is rife with terrible pay-to-play practices for critical security components and capabilities that need to be made

Open article: Pay to Access Trust Center - Another Failure in Security and GRC by Val Dobrushkin • 3 min read

Pay to Access Trust Center - Another Failure in Security and GRC

taplio

The Battle

Robert Wood

Val Dobrushkin

Followers

Posts

Engagements

Likes

Performance ScoreVal Dobrushkin's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Robert Wood

Val Dobrushkin

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Val Dobrushkin's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreVal Dobrushkin's LinkedIn Performance