Michael Russell

About Michael Russell

As the Head of IT Security, I have managed the deployment, strategy, and governance of the Microsoft 365 Security and Compliance center, including Defender, Entra, and Purview. With over 20 years of experience in IT security, I have extensive knowledge and skills in compliance, privacy, threat protection, identity access management, risk management, and security operations. I have successfully established and implemented security control frameworks based on ISO, SOC, iRAP, CMMC, and NIST standards for multiple industries, including manufacturing, healthcare, and financial services. I have also performed security gap and risk assessments for ISO 27001/17/18 and CMMC, and ensured privacy compliance for GDPR, CCPA, PIPEDA, and AU Privacy Act. I am passionate about delivering best-in-class security solutions that protect the enterprise information assets and align with business goals and objectives. CORE COMPETENCIES: Compliance Privacy Threat Protection Identify Access Management Configuration Management Risk Management Vulnerability Management Security Management Network Security Strategic Planning Data Loss Prevention Security Operations Sarbanes-Oxley (SOX) PCI-DSS FISMA/FedRAMP GDPR COSO COBIT ISO27001/17/18 ISO21434 NIST HIPAA HITRUST iRAP Archer Paisley RSAM SaaS IaaS Cloud AWS Azure TPRM CSA Audits RFP Security & Risk Assessments IAM Okta Cisco Duo RSA DLP SASE SDLC CI/CD Pipeline Penetration Testing SAST Red Team Systems Integration BC/DR Data Retention Agile Microsoft E5 365 Security and Compliance Center M&A PMO

Experience

1. Senior Director, Information Security Operations

   Gohealth

   Jun 2024 — Present

   Reporting to the CTO and responsible for information security, including all aspects of the development, implementation, and monitoring of the ISMS in support of on-prem, Azure, and AWS hosted systems. • Performed budget and technologies rationalization to maximize efficiencies and cyber protection resulting in annual savings greater than $1.5m.• Managed establishment of a Security Operation Center (SOC) program including deployment of XDR & SIEM solutions. • Responsible for on-going architectural design and deployment of IAM & IGA solutions that include Okta, Saviynt, CyberArk, Duo, and MS Entra.• Implemented enterprise Attack Surface Management strategy across cloud and on-premises environments. • Implemented Threat Intelligence with integrations between CrowdStrike, Palo Alto, and Exabeam SIEM tools.• Responsible for evaluation, selection, and deployment of data discovery, labeling, classification, and DLP solutions.• Managed security and architecture assessments and mitigations for ISO 27001/17/18, SOX and HIPAA compliance.• Responsible for Vulnerability Management with advanced AI tools including risk and exposure management based on continuous asset discovery and monitoring.• Responsible for the development and execution of internal and external penetration testing program with a strong focus on web application testing.• Responsible for the implementation of autonomous threat detections and investigations with advanced AI platforms.• Developed NIST AI RMF and ISO/IEC 42001 based comprehensive security and architecture assessment process for in-house AI platforms.

Education

• Texas State University

  Bachelor's degree