Alex Pietropaolo

About Alex Pietropaolo

I’m a Principal Cybersecurity Consultant and trusted vCISO for organizations that need executive-level security leadership without the overhead of a full-time hire. With over 18 years experience in cybersecurity, I’ve led the development and execution of risk-based security programs across multiple industries including healthcare, technology, banking, and critical infrastructure.As an acting vCISO, I partner directly with executive teams and boards to shape cybersecurity strategy, establish governance frameworks, and drive alignment between business goals and risk tolerance. I’ve built cyber programs from the ground up, led incident response efforts, conducted maturity assessments, and helped organizations prepare for security frameworks and compliance regulations such as NIST CSF 2.0, CIS Controls, HIPAA, PCI and CMMC.I lead teams with a strong focus on execution, driving both strategic and hands-on cybersecurity and risk management initiatives. My approach is grounded in delivering real results by improving security capabilities and actively reducing risk across the organization.

Experience

1. Grc Lead

   Udemy

   Jul 2025 — Present · Austin, TX, US

   Leading control automation efforts using Drata to reduce manual evidence collection and improve audit readiness across key compliance areasSupporting the implementation of ISO 42001 to establish a structured approach for AI risk management and governanceTranslating regulatory and framework requirements into implementable controls within cloud-based environmentsPartnering with security and engineering teams to align control enforcement with system capabilities and reduce reliance on manual validationDriving remediation of control gaps by coordinating with stakeholders and prioritizing actions based on risk impactIdentifying opportunities to shift from periodic control testing to continuous, system-driven monitoring and enforcementContributing to the evolution of a more scalable, automation-focused approach to governance, risk, and compliance

Education

• DeVry University

  Bachelor's degree, Computer Information Systems

Skills

• Incident Response
• Threat Management
• Web Application Security
• Information Security
• Network Security
• Security Architecture Design
• Security
• Application Whitelisting
• Iso 27001
• Malware Analysis
• Hipaa
• Pci Dss
• Application Security
• Sox
• Security Audits
• Information Security Management
• Vulnerability Assessment
• Sarbanes-Oxley Act
• Payment Card Industry Data Security Standard (Pci Dss)
• Penetration Testing
• Computer Security
• Enterprise Governance, Risk and Compliance