Interrogate Eric's body of work.

Led, not supported. In 2025, Eric took a government account through a full SOC 2 audit end-to-end — coordinating readiness across control owners, mapping controls to the Trust Services Criteria, gathering evidence, and engaging directly with the auditors to bring the engagement to successful completion.¹

In parallel, he ran a HIPAA compliance review for the same account, assessing administrative, physical, and technical safeguards against the Security and Privacy Rules, then documenting gaps and remediation recommendations for the account team.¹

At Truist Bank, Eric led enterprise security operations supporting 50,000+ endpoints across Windows, Linux, and AIX — deploying and managing the tooling used to scan, assess, and enforce compliance on systems handling sensitive, regulated data.¹

That work included partnering across cybersecurity, server, and application teams on vulnerability remediation and zero-day response, plus implementing privileged access controls with CyberArk under least-privilege principles.¹ Earlier, at the Federal Reserve Bank, he ran vulnerability assessments and penetration testing across roughly 30,000 endpoints.²

Both — and the record shows the range rather than a claim. The hands-on side is 20+ years of operational work: data classification and scanning controls, platform onboarding, RBAC and identity integration, and control execution with evidence collection in banking and regulatory environments.¹

The translation side shows up in the audit and governance work — producing control evidence for audits and attestations, and aligning security to NIST, FDIC, and ISO 27001 standards that leadership and regulators act on.¹ One honest note: Eric's documented titles are engineer and consultant, not CISO — his strength is the operator who can make the posture legible to executives, not a figurehead.