Michael Lekhmus

About Michael Lekhmus

Vice President of Security Operations at a publicly traded company with expertise spanning manufacturing, healthcare, education, finance, cryptocurrency, and the intelligence community. Proven leader managing teams of up to 35 professionals, designing and implementing security programs across cloud, on-premises, and Operational Technology (OT) environments. Skilled in OT/IT segmentation, regulatory compliance, and aligning security strategies with business objectives.Key Expertise:Incident Response, Cloud Security, Digital Forensics, Vulnerability Management, Insider Threat Management, Identity and Access Management, Threat Intelligence, Zero Trust Architecture, OT/IT segmentation, ICS security, Active Directory, Cryptocurrency Security, Red Team, Purple Team.Career Highlights:NSA: Senior Digital Network Exploitation Analyst delivering mission-critical cybersecurity operations for the intelligence community, leading a team of 24 analysts.Current Role: Architected OT/IT segmentation to protect critical infrastructure; Implemented cloud and SaaS security programsImplemented EDR solutions across workloads; automated DFIR labs using Terraform; delivered security programs for high-profile clients in healthcare and finance.Certifications:GIAC Certified Forensic Examiner (GCFE), ISC2 CISSP, CEH, CompTIA Security+, CyberArk Trustee, Forescout Certified Administrator.Technology Proficiencies:AWS, Azure, GCP, Terraform, Python, Splunk, Elastic, SentinelOne (S1), Carbon Black, Defender, Darktrace, BloodHound, PingCastle.Compliance & Standards:NIST CSF, CIS 8.0, SOC2, ISO27001, GDPR, CPRA, HIPAA, SOX, PCI.

Experience

1. Vice President of Security Operations

   CompoSecure

   Dec 2023 — Present

   Implemented a defense-in-depth security program to reduce attack paths and safeguard critical assets across Operational Technology (OT), Internet of Things (IoT), Active Directory (AD), servers, networks, SaaS, cloud environments, CI/CD pipelines, and business-critical applications. Focused on proactive strategies that assume endpoint protection failure, enhancing enterprise-wide resilience and operational integrity.Key Achievements:Defense in Depth & Attack Path Reduction: Approached security development through the lens an attacker would take, attack surface minimization, lateral movement prevention, and layered defenses. Utilized BloodHound and PingCastle to mitigate vulnerabilities, harden privileged access pathways, and enforce segmentation.Active Directory and Identity Security: Established a tiered AD architecture, reducing domain escalation risks. Strengthened IAM frameworks and integrated IDP solutions to enhance authentication and authorization.Network and Cloud Security: Built segmented, zero-trust-aligned networks for hybrid and cloud environments. Applied micro-segmentation, anomaly detection, and advanced monitoring to enhance visibility and reduce exposure.CI/CD and DevSecOps Security: Secured DevSecOps pipelines by embedding security into CI/CD workflows, using SAST/DAST tools, container scanning, and secret/key rotation governance.SaaS and Application Security: Enhanced SaaS governance and protected web applications leveraging red team tools, API security, vulnerability assessments and run time protection for Kubernetes and ITDR for SaaSImplemented UEBA to leverage deep learning to detect anomalous activity.Tools & Technologies:AWS, Azure, GCP, Terraform, Python, Splunk, Elastic, SentinelOne, CrowdStrike, Carbon Black, Defender, Darktrace, PingCastle, BloodHound, Checkmarx, GitHub, TeamCity, Docker, Kubernetes, CyberArk, Forescout, Wiz.

Education

• SANS Technology Institute

  Incident Response Masters Certificate

• Liberty University

  Bachelor of Science - BS, Multi-/Interdisciplinary Studies, General