Chief Information Security Officer (CISO)

SEAN SOKHANVAR

*** ****** ****** ****, ************ MD, 20876 **********@*****.*** 602-***-****

CHIEF INFORMATION SECURITY OFFICER (CISO) CYBERSECURITY STRATEGIST

Seasoned Chief Information Security Officer (CISO) with 20+ years of experience in cybersecurity strategy, governance, risk management, and compliance (GRC). Adept at aligning security initiatives with business objectives, developing multi-year security roadmaps, and implementing ISO 27001, NIST 800-171, CMMC, and NIST Cybersecurity Framework best practices.

Proven ability to lead enterprise-wide security programs, perform third-party risk assessments, establish Data Classification & Data Loss Prevention (DLP) programs, and manage vulnerability scanning and remediation. Strong expertise in incident response, regulatory compliance (ISO 27001, SOC 2, FedRAMP, AI Risk), and security awareness training.

Recognized for fostering security-first cultures, collaborating with IT leadership to assess emerging threats, and driving cybersecurity maturity improvements. Holds CISSP, CISM, CRISC, GPEN, and multiple cybersecurity certifications.

CORE COMPETENCIES

Cybersecurity Strategy & Governance

Risk Management & Compliance (ISO 27001, CMMC, SOC 2, NIST CSF, NIST 800-53 NIST 800-171)

Data Classification & Data Loss Prevention (DLP)

Third-Party Vendor Security Assessments

Vulnerability Scanning & Remediation

Incident Response & Forensic Investigations

Security Awareness & Training Programs

Cloud Security & Zero Trust Frameworks

PROFESSIONAL EXPERIENCE

Obetec Cyber Security Executive July 2013 – Present

Served as virtual CISO (vCISO) for clients without dedicated security leadership, providing executive-level guidance on cyber risk, security investment priorities, regulatory compliance, third-party risk, and security program maturity.

Managed cybersecurity programs across multiple client environments while balancing risk, operational requirements, regulatory obligations, budgets, and business priorities

Led vCISO and managed security services (MSSP) engagements for multiple organizations, serving as a trusted cybersecurity advisor to executive leadership, IT teams, boards, and business stakeholders.

Developed and executed enterprise cybersecurity strategies, multi-year roadmaps, security operating models, and risk-reduction programs aligned with organizational objectives and regulatory requirements.

Conducted executive cybersecurity assessments and translated technical vulnerabilities and security findings into business-risk language, prioritized remediation plans, and measurable security improvement initiatives.

Established and matured security programs aligned with NIST CSF, NIST SP 800-53, NIST SP 800-171, CIS Controls, ISO 27001, SOC 2, PCI DSS, CMMC, and industry-specific regulatory requirements.

Developed cybersecurity governance frameworks, policies, standards, risk registers, security metrics, KPIs, KRIs, and executive dashboards to provide leadership with measurable visibility into security posture and risk.

Led client incident response, threat management, vulnerability remediation, penetration-testing, and security improvement initiatives, coordinating internal teams, MSSP/SOC resources, vendors, and executive stakeholders.

Partnered with client leadership to develop security budgets, technology investment strategies, staffing models, and remediation roadmaps, ensuring cybersecurity investments were prioritized according to business risk.

Presented cybersecurity posture, emerging threats, regulatory risks, major incidents, and remediation progress to C-suite executives, boards, audit committees, customers, and other senior stakeholders.

Led security assessments, gap analyses, risk assessments, penetration tests, and compliance readiness engagements, identifying control deficiencies and developing practical remediation strategies.

Established repeatable MSSP delivery methodologies, service catalogs, assessment frameworks, onboarding processes, SLAs, reporting standards, and customer success practices to improve service quality and scalability.

Supported pre-sales, solution architecture, proposals, statements of work (SOWs), client presentations, and executive discovery sessions, translating customer cybersecurity challenges into strategic and managed-service solutions.

Worked directly with customers to identify opportunities for expanding cybersecurity services and developing long-term trusted-advisor relationships and recurring managed-security revenue.

Developed security strategies for complex IT, cloud, manufacturing, and operational technology (OT) environments, integrating enterprise risk management with operational resilience and business continuity requirements.

Helped organizations transition from reactive cybersecurity operations to risk-based, measurable security programs with defined governance, continuous monitoring, executive reporting, and continuous improvement.

Provided strategic cybersecurity leadership during M&A, vendor evaluations, technology transformations, regulatory initiatives, and major security incidents, ensuring cyber risk was incorporated into business decision-making

Anchor Technology Senior Security Architect May 2010 – July 2013

Led security architecture reviews and implemented network segmentation strategies per PCI-DSS compliance.

Directed risk assessments and compliance audits against HIPAA, PCI, and federal regulations.

Managed a team to implement Fortinet firewall solutions and optimize security infrastructure.

Acted as the primary incident responder, overseeing security breaches and remediation strategies.

ITSolutions LLC Senior Security Architect Nov 2003 – May 2010

Client: U.S. Food and Drug Administration (FDA)

Served as Lead Security Architect for the FDA ICT21 contract, designing and securing enterprise networks.

Conducted Risk Assessments (RA), Data Classification, and mitigation planning for regulatory submissions.

Managed security compliance and performed Certification & Accreditation (C&A) processes for FDA data centers.

Client: U.S. Department of State (DOS) – Security Operations Center (SOC) Supervisor

Supervised global SOC operations, monitoring embassies and consulates worldwide.

Investigated security alerts, mitigated cyber threats, and maintained email and firewall security.

McAfee (Network Associates) Senior Network Security Engineer Dec 2000 – July 2003

Led enterprise-wide antivirus and endpoint security deployments for the Department of Veteran Affairs.

Conducted security audits and risk assessments to enhance government agency cybersecurity resilience.

Developed Perl-based automation scripts to enhance security operations.

EDUCATION, CERTIFICATIONS & TRAINING

Member of Info Guard and Arizona Cyber Threat Alliance (ACTRA)

CISSP – Certified Information Systems Security Professional (#345203)

CISM – Certified Information Security Manager (#15300015)

CRISC – Certified in Risk and Information Systems Control (#1619640)

GPEN – GIAC Penetration Tester

Certified DSPM Architect

ISO 27001 Lead Auditor Certified

AI Risk Management Professional Certification

Cloud Security Alliance (CSA) Zero Trust Certified

ISC2 Cloud Security Training

Contact this candidate