SECURITY, AI & GOVERNANCE LEADERSHIP
I’m a Chief Information Security Officer (CISO) and Chief AI Officer (CAIO). I lead security programs, establish AI initiatives, and connect technology decisions to business risk and operating priorities. My experience spans executive responsibility, global operations, and hands-on engineering.
At Community Capital Technology, I lead information security across cloud security, DevSecOps, identity, resilience, customer assurance, and AI governance. I report material security and technology risk to the Executive Committee.
I led multiple SOC 2 Type II reporting cycles, coordinating control ownership, evidence, auditor requests, and remediation. This work connects assurance obligations with accountable action and executive oversight.
While leading CCT’s security function, I established and led an AI enablement and governance initiative. I developed proposals for compliance automation and a controlled adoption strategy addressing employee productivity and engineering support.
I evaluated enterprise AI platforms, created employee guidance, and defined responsibilities across Security, Technology, HR, and Legal. I am now introducing ISO/IEC 42001 and the NIST AI Risk Management Framework at CCT to guide the developing AI governance program, including use-case review, risk assessment, approval responsibilities, and ongoing oversight.
As Vice President of Operations and Chief Information Officer at Absio, my responsibilities spanned IT operations, information security, facilities, and administration.
My executive scope included technology investment, policy, and risk, connecting technical decisions with the organization’s wider operating needs.
At IQNavigator, I directed infrastructure and cyber operations across six commercial data centers in the United States and EMEA, including support teams, availability, disaster recovery, and global service delivery.
I established 24×7 security monitoring and alerting and led creation of the Network Operations Center.
I help organizations decide where to invest, what to address first, and how to turn security and AI priorities into work their teams can deliver.
Set security priorities around business exposure, customer expectations, and operational needs. Give teams clear ownership and executives a direct view of risk, progress, and decisions that need their attention.
Identify worthwhile use cases, evaluate platforms, and build an adoption roadmap. Plan for data protection, employee readiness, operating costs, and measures of success from the beginning.
Connect security policy, control ownership, and risk escalation with AI use-case review, data boundaries, and approval authority. Establish review processes and ongoing oversight so leaders can see what is authorized, what needs attention, and who is accountable.
Hire me to lead the function, provide fractional or interim direction, or deliver a focused security or AI engagement.
For organizations hiring a CISO, CAIO, or combined security and AI leader to establish direction, build the program, and govern adoption.
Discuss the mandate, team, business priorities, and decision-making authority the role needs.
Discuss an executive roleFor organizations that need experienced direction and oversight without a full-time appointment.
Define a fractional CISO or CAIO engagement around priorities, governance, leadership cadence, and coordination with your existing team.
Discuss ongoing leadershipFor a specific security or AI challenge with a defined scope and deliverable.
AI program design, readiness and governance assessments, model or agent assurance, security-program development, and remediation planning.
Discuss a projectDirect implementation experience informs how I assess proposals, question assumptions, and guide technical teams.
MODEL & RUNTIME ASSURANCE
I designed a model-assurance approach for evaluating open-weight AI models against an intended use. It gives AI governance and adoption decisions a basis in provenance, testing, and documented limitations.
Identify the source, exact model version, and runtime configuration. Review supply-chain risks before controlled testing of behavior, security, tool use, and operational fitness.
Retain test evidence and reviewer decisions. Bind human approval to the evaluated configuration and permitted use, with restrictions and reassessment when conditions change.
Data and tool permissions remain essential controls even after a model has been evaluated.
I built and validated a two-node NVIDIA DGX Spark environment to support this work, connecting the assurance design with practical model evaluation.
I created security auditing and reporting for AWS environments and implemented Logz.io as a security information and event management (SIEM) platform.
This work connects cloud security operations with the evidence and reporting needed to oversee the security program.
I used a controlled AI environment to analyze eight inherited infrastructure and DevOps repositories against deployment evidence and live AWS resources.
The work produced validated assessments, dependency mapping, and an infrastructure takeover plan, with human authority over changes.
LET’S CONNECT
For executive opportunities, let’s discuss the mandate, team, and business priorities. For fractional leadership or consulting, tell me the challenge and the result you need.
opportunities@leecuevas.com