Michael Carroll

About Michael Carroll

Personal Purpose: Empower others with empathy and kindness to develop into better versions of themselves through continuous improvement and pursuit of shared goals.Specialties-Information Security Leadership-Information Security and Assurance Program Management and Development -Information Security Architecture and Engineering-Cyber Security Strategy and Strategic Planning -Control Design and Implementation-Cyber Risk Frameworks (e.g. ISO, NIST) and Reference Architectures (e.g. NIST, CSA)-Information Security and IT Governance, Risk and Compliance (GRC)-Cloud Security-Risk Management and Assessment-Threat Modeling, Security Assessments, Maturity Assessments-Coaching, mentoring and university level instruction and teachingSELECTED LEADERSHIP & PERFORMANCE HIGHLIGHTS-Mergers and Acquisitions Success Stories: A) Prior to the closing of the deal led to Capital One purchasing Discover, my team and I performed the cyber ecosystem due diligence to understand capabilities, overlaps, and gaps between the two ecosystems. Post closure, we led the design work to converge the two ecosystems, remove duplicity, streamline operations, and arrive at a single control stack. B) As part of the Merger of Equals between SunTrust and BB & T to create Truist, my team and I created and implemented a security focused strategy to facilitate the integration of the two heritage banks. Results include reduction of ecosystem complexity, reduction of financial and operational overhead and increased cyber agility.•Successfully rebuilt previously negative business relationship between cybersecurity and a C-Level executive and their team. This allowed us to reestablish trust and regain a “seat at the table” in making decisions. •Became an ISC(2) Official Training Provider (OTP) in order to provide Certified Information Systems Security Professional (CISSP) training to the organization. This resulted in dramatic cost reduction in the training for the cybersecurity organization. •Developed cybersecurity strategies, solutions and ecosystems to address threats and reduce risk for the enterprise (inclusive of business to business, business to customer, and business to employee).•Complete redesign and implementation of all information security policies, standards, procedures and default security contract language to modernize the cybersecurity practices, organizational intent and direction. This includes gaining alignment with Legal, Human Recourse, Audit, Risk, IT, and business stakeholders.

Experience

1. Director, Cyber Architecture

   Capital One

   Mar 2024 — Present · Atlanta, GA, US

   I currently lead a group of Cyber Architects that are charged with solving the most complex and high-impact cybersecurity challenges. My team’s mission is to design and deliver innovative, well-architected security solutions that empower Capital One to maintain its commitment to \"Change Banking for Good.\" By crafting secure, scalable solutions, we help foster trust with our customers and ensure their financial futures are protected.We define the target security state, design robust solutions, and collaborate with cross-functional teams to implement these solutions across the business. Our work enables Capital One to seamlessly integrate security into our products and services, ensuring that security is not a barrier but a business enabler—making the secure way the easy way.Our focus areas span Security Testing, Product Security, Endpoint Security, Detection and Mitigation and Governance, Risk, and Compliance (GRC). We are also pioneering in strategic areas such as securing Generative AI (Gen AI), leveraging Open Policy Agent and OpenTelemetry, and safeguarding the development pipeline. We aim to automate developer workflows and remove friction, ensuring that security remains a seamless part of the development lifecycle while driving business value.As we partner across the organization, we strive to not only secure Capital One’s products but also help lift the entire business.

Education

• Kennesaw State University - Michael J. Coles College of Business

  Masters of Science, Information Systems

• Kennesaw State University

  Bachelor of Science, Information Security and Assurance

Skills

• Information Security Management
• Risk Management
• Risk Assessment
• Security Audits
• Security Assessments
• IT Governance
• IT Audit
• Regulatory Requirements
• Glba
• Pci Dss
• Ffiec
• Hipaa
• Sox
• Nist
• Security Policy
• Mobile Security
• Mobile Strategy
• Digital Strategy
• Security Research
• Incident Management
• IT Strategy
• Computer Forensics
• Mentoring
• Coaching
• Training & Development
• Process Improvement
• Security
• Governance
• Cissp
• Penetration Testing
• Network Security
• Computer Security
• Information Security
• Incident Response
• Employee Training
• Sarbanes-Oxley Act
• Firewalls
• Intrusion Detection
• Cisa
• Big Data