Brett Coon

• Transformed the firm’s enterprise information security and cyber risk program, advising executive leadership and managing partners on risk posture, investment priorities, and regulatory expectations. • Established a firm-wide, risk-based security strategy across governance, identity and access management, vulnerability management, and security operations aligned with business objectives and risk appetite. • Sustained ISO 27001 certification across all critical applications, providing ongoing assurance to clients and regulators and reinforcing trust in the firm’s security posture. • Served as the firm’s head of incident response, leading security incident response and executive coordination during active threats. • Prioritized and implemented enterprise security investments across email, data protection, endpoint security, identity and access management, and security monitoring to reduce firm-wide risk exposure. • Matured the vulnerability management program by identifying systemic patching and configuration gaps and improving accountability for remediation across core business systems. • Revised and standardized all information security policies by aligning governance with industry standards and formalizing review and approval processes to improve consistency and oversight. • Guided cyber risk assessment and decision-making for major business initiatives and application implementations prior to deployment to ensure risks were addressed or formally accepted. • Oversaw outsourced security operations and vendors supporting the firm’s global operations, improving service level performance and alignment with firm risk expectations. • Directed firm-wide security awareness and training programs, including new hire education, annual training, phishing simulations, and threat communications to strengthen security culture. • Delivered regular executive briefings on security strategy, risk posture, KPIs, and emerging threats to support informed leadership decision-making.

• Directed enterprise security architecture and engineering teams responsible for endpoint and network security across on-premises and cloud environments supporting regulated and client-facing platforms. • Partnered with senior technology and risk leaders to align security architecture decisions with enterprise risk appetite and strategic initiatives. • Defined and evolved security architecture standards aligned with PCI DSS, FFIEC, and NIST CSF to improve consistency and regulatory readiness across the enterprise. • Guided security investment and design decisions for endpoint and network security programs to reduce risk exposure and support business scalability. • Established and guided Purple Team collaboration, coordinating remediation of vulnerability assessments, penetration testing findings, and MITRE ATT&CK-aligned threats to improve defensive readiness. • Architected a centralized cloud automation solution for security policy compliance management to strengthen governance and operational efficiency. • Conducted governance, risk, and regulatory assessments, advising leadership on risk treatment decisions including acceptance, mitigation, and transfer of residual risk. • Cultivated strategic vendor partnerships, influencing contract renewals and service alignment to optimize security capabilities and cost efficiency.

• Oversaw global information security operations and engineering teams responsible for protecting enterprise endpoints and core business systems. • Restructured security operations into an engineering-led, 24x7x365 model, strengthening incident response, escalation, and operational resilience. • Delivered enhanced insider threat visibility and data protection across web, network, print, and email channels to support data privacy and regulatory requirements. • Implemented database access monitoring to improve oversight and protection of regulated and sensitive data. • Integrated security programs across multiple major acquisitions, establishing consistent controls and governance in newly acquired environments.

• Directed enterprise information security architecture and security operations supporting manufacturing and corporate environments, responsible for endpoint protection, perimeter security, incident response, vulnerability management, and security operations across core business systems. • Developed and executed 12-, 24-, and 36-month security strategies aligned with business priorities and risk appetite, improving consistency, resilience, and operational readiness during organizational and technology change.

• Managed global endpoint security operations, including malware protection, application control, and incident response capabilities. • Established the organization’s first dedicated information security tools team, improving control deployment, governance, and operational consistency. • Reduced exposure from unapproved software through structured allow-listing and control standardization. • Reinforced incident response processes and coordination across IT and security teams.

• Directed enterprise IT infrastructure strategy covering architecture, engineering, operations, availability, security, and recovery readiness. • Developed multi-year technology roadmaps supporting operating and capital investment planning. • Managed geographically distributed teams responsible for enterprise computing platforms supporting financial institution clients. • Established business continuity and disaster recovery capabilities supporting enterprise resilience and service availability. • Improved cost efficiency and operational stability through infrastructure modernization and organizational alignment.

Managed all IT infrastructure hardware decisions and planning for 1,000 servers, 6 mainframes for 3000+ financial institutions, with 8 professionals in 3 locations and a $10 million operating and capital budget. • Decreased annual budget by almost 20% from $12 million to $10 million by server virtualization of 85%, power reduction, and team realignment. • Sustained a 99.99% availability while revamping data center support from 250 to 1200 servers. • Developed business continuity and disaster recovery solutions for resiliency of 50+ applications with recovery time of the full environment in less than 24 hours.

Supervised availability and recoverability of 250 servers supporting 2000+ financial institutions using current and emerging technologies with 3 analysts and an $8 million operating and capital budget. • Deployed log management across environment, improving event management by 100%. • Implemented automated operating system patch management, providing better than 95% compliance. • Consolidated 3 data centers into a strategic facility, decreasing corporate capital and operational expenses by $1.75 million annually.

Supported 50 servers in support of 10+ applications and 250 financial institutions. • Created a standardized deployment process of growing server infrastructure. • Developed a disaster recovery process in support of production environment.

Supported 12 servers in support of 5+ applications and 125 financial institutions.

Systems administrator for Netware 5, Microsoft Windows NT 4.0, Lotus Notes 4, ArcServe servers, and maintained a full fiber-to-the-desk network.