Hello, world

Every security person eventually builds a personal site, and this is mine.

I’ll mostly write about building governance, risk, and compliance programs: what works, what falls apart in the first audit, and how to keep the program useful once the certificate is on the wall. I’ll also write some about operations, because that’s where most security programs live or die.

Some posts will have nothing to do with work. Expect some astrophotography and Pokémon cards.

More soon.