Matt Henson

About Matt Henson

Most export control failures aren’t caused by bad intentions—they’re caused by bad system design. I work as an Export Controls Architect, helping organizations design defensible, scalable export compliance systems that actually function in modern, data-driven environments.What I do-Translate ITAR, EAR, and allied regimes into operational frameworks and system architectures-Design scalable export authorization models (licenses, exceptions, TAAs, MLAs)-Embed export controls into SharePoint, Jira, Confluence, PLM, and cloud data flows-Architect ExClass, ExRestrict, and ExAuth data models and automated workflows-Prepare for and support audits, disclosures, and mitigations with regulator-grade traceabilityWhat makes my work different-I treat export controls as a systems engineering problem, not a policy exercise-I design regulation-to-code mappings that hold up under audit-I specialize in structured data, graphs, and AI-assisted orchestration, not static documents-I build architectures supporting automated classification, scoped reuse, and immutable decision logsI’m a strong fit if you-Operate in defense, aerospace, advanced manufacturing, or dual-use tech-Are introducing AI, automation, or LLMs into regulated workflows-Have decentralized business units with inconsistent export control practices-Need more than advice—you need a working, enforceable architecture-Are under regulatory scrutiny for intangible exports (software, data, access, transfer)What I don’t do-Simple license filing-One-off classifications with no system contextCore skills:ITAR, EAR, AU DSGL, UK regimes · Export Classification (USML, CCL, DSGL) · Export Authorization Management · Export Controlled Information & Software · Compliance Architecture · AI Governance · SharePoint & ITSM workflows (Jira, ServiceNow, ADO) · Data Governance · Risk Mitigation & Audit ReadinessExperience highlights-Participation in 7 ITAR Consent Agreements, focused on AECS architecture and data access/location controls-Data scanning, classification, and metadata tagging (structured & unstructured)-Zero Trust and ABAC-driven authorization (PEPs, PDPs, PIPs)-AI data ingestion pipelines and controlled processing workflows-Data access audits, breach response, remediation, and corrective actions-Export control integration with DLP, DRM, masking, trimming, and data-centric security

Experience

1. Zero Trust Working Group, Ai Industry Lead

   Atarc Advanced Technology Academic Research Center

   Jan 2024 — Present · US

   As ATARC AI Industry Lead, I help define AI use cases for Zero Trust. The AI sub-team is charged with answering two questions:(1) How can AI benefit Zero Trust,(2) How can Zero Trust benefit AI?

Education

• Oklahoma State University

  MS / BS, MS - International Studies, International Trade and Development / BS - Marketing

  1999 — 2005

Skills

• Six Sigma
• Defense
• Dod
• Security
• Earned Value Management
• Project Management
• Governance
• Business Process Improvement
• Business Process Mapping
• Politics
• International Trade
• Security Clearance
• Integration
• Cyber Compliance
• Systems Engineering
• Government
• Requirements Management
• Requirements Analysis
• Mind Mapping
• Aerospace
• Process Engineering
• Economics
• Pmp
• Trade Compliance
• Compliance
• Program Management
• Export Compliance Automation
• Defining Requirements
• Engineering Management
• Government Contracting
• Process Improvement
• Strategy
• Sap
• Information Assurance
• Process Automation
• Far
• Sharepoint
• Itar
• Cross-Functional Team Leadership
• Strategic Planning