Chris Morrison

WORK HISTORY

EDUCATION

SKILLS

ABOUT CHRIS MORRISON

Director-level Information Security & GRC leader with 10+ years of experience building and scaling security programs in HIPAA-regulated, high-growth SaaS environments, and in the public sector.Proven first security hire who has built security, compliance, and risk functions from the ground up - owning SOC 2 Type II, HITRUST r2 CSF, enterprise risk management, third-party risk, and security operations end-to-end. Led 7 consecutive SOC 2 Type II audits and 7 years of HITRUST certification with zero findings, while establishing audit-ready, repeatable security programs that scale with the business.Trusted executive partner known for translating security, risk, and compliance into clear, business-aligned decisions. Regularly brief executive leadership and boards on risk posture, control maturity, regulatory exposure, and investment tradeoffs. Strong collaborator across engineering, legal, product, and go-to-market teams to embed security without slowing velocity.Hands-on technical leader with deep experience governing controls across AWS and modern SaaS stacks, including SIEM, EDR, DLP, IAM, SASE, cloud security monitoring, AWS WAF, and incident response readiness. Extensive experience with tools such as Datadog, Lacework, Sumo Logic, and Google Workspace security controls to drive visibility and reduce risk.Led third-party risk programs at scale, customer security due diligence, Trust Center development, and AI risk governance aligned to NIST frameworks — strengthening customer trust and accelerating enterprise sales.Earlier director-level leadership in public safety and community corrections, managing large teams, complex operations, and regulatory oversight — experience that informs a calm, pragmatic, execution-focused approach to security leadership.I thrive in roles where security is a business partner, combining governance, technical credibility, and executive communication to build programs that are trusted, measurable, and sustainable.