Ultra Maritime

2024–2025 · Chief Information Security Officer

The challenge

In a multinational defense business, cybersecurity connects engineering and operations with contractual obligations, regulatory expectations, and investor scrutiny. My work was to build a function that could bring those demands together and make the program more stable and accountable.

Building the team and program

I built and led the cybersecurity team from the ground up, establishing SOC, security architecture and engineering, and governance, risk, and compliance capabilities. I developed a comprehensive security strategy and roadmap and worked across legal, compliance, engineering, operations, and product teams.

A multinational remit

My responsibilities extended beyond US DoD, DFARS, and CMMC expectations to ISO-related requirements, Australian Cyber Security Centre (ACSC) guidance, and readiness for Canada’s emerging Canadian Program for Cyber Security Certification (CPCSC).

Canada introduced the first phase of CPCSC in 2025. My work is described here as program alignment and readiness; it does not imply that later certification requirements had already been met during my tenure.

Stability and readiness for scrutiny

In an investor-owned business, a security program needs to stand up to questions from customers, regulators, and prospective investors. I developed executive and board reporting and a financial risk register to connect security issues with operational and commercial consequences.

That work supported program stabilization and preparedness for due diligence: making responsibilities, risks, priorities, and the state of the program easier to explain and examine. It is experience in helping an organization prepare for scrutiny, without attributing a transaction outcome to cybersecurity work.

From strategy to operations

My responsibilities also included assessment preparation, commissioning an external readiness review, and serving as incident commander during active risk events. The emphasis was on building a sustainable function alongside immediate operational and assessment demands.