Security governance in practice
Established NIST-aligned risk reviews and remediation tracking, linking findings to accountable owners and follow-through.
Cybersecurity Leadership · Risk · Resilience · Transformation
Miguel A. Perez
Cybersecurity & Technology Executive
CISSPCISMCCSPPMPCompTIA SecAI+
Cybersecurity and technology leader with 25+ years across enterprise, federal, and classified environments, including 11 years directing enterprise security for approximately 500 users and 1,200 endpoints. Led identity modernization, strengthened security governance and resilience, and connected security controls to operational and business outcomes. Now serving in a CACI cybersecurity role supporting FEMA.
Executive Profile
I build security programs that connect technical controls, risk ownership, and business decisions. My work includes leading a 493-user identity modernization, building enterprise risk and remediation practices, coordinating incident readiness, and guiding physical-security modernization. I bring that execution-focused perspective to federal cybersecurity work at CACI.
Enterprise transformation
Led identity improvements involving Okta, Duo, MFA, SSO, privileged access separation, and recurring access reviews.
Risk translated into action
Worked across technical and business teams to strengthen incident readiness, payment verification, resilience, and executive decision-making.
Selected Impact
Selected outcomes from enterprise security leadership and advisory engagements, supported by detailed public case studies.
Built and matured an enterprise security program
Owned security strategy, governance, operational security, policy, risk management, resilience, and executive reporting.
- Established risk-register and POA&M-style remediation discipline
- Embedded security reviews and accountability into daily IT operations
- Supported audit readiness and evidence-driven control assurance
Advanced identity-first security
Directed a phased identity modernization covering 493 users and achieving MFA coverage for human users.
- Microsoft Entra ID / Azure AD
- Okta, Duo, MFA, access reviews, Windows Hello
- Secure remote access and endpoint governance
Improved organizational readiness
Strengthened resilience through incident-response planning, tabletop exercises, business continuity, and recovery discipline.
- Executive tabletop exercises
- Incident escalation and corrective action
- Business continuity and disaster recovery alignment
Reduced human and process risk
Built an enterprise awareness program that helped staff recognize a fraudulent payment exceeding $120,000, enabling intervention.
- KnowBe4 awareness and phishing-prevention work
- Process changes to reduce financial exposure
- Security culture strengthened through practical controls
Led physical-security modernization
Led access-control remediation and a physical-security modernization after identifying more than 1,700 legacy badge records.
- Badge and access-control modernization
- CCTV / Verkada deployment support
- Security drills and inspection readiness
Translated AI risk into practical controls
Advised professional and leadership audiences on secure AI adoption, model/vendor risk, data protection, access control, and responsible use.
- AI security policy and governance concepts
- Vendor-review criteria and risk assessment
- Secure adoption guidance for technical and executive stakeholders
Security Philosophy
Effective security leadership is not about maximizing the number of controls. It is about building organizations that can continue operating when controls fail, suppliers fail, systems fail, or attackers succeed.
Design for disruption
Efficiency matters. Resilience matters more when the environment is uncertain. Security should test assumptions before adversaries do.
Move beyond passwords
Identity should increasingly rely on stronger combinations of what a person is and what they possess, reducing dependence on reusable secrets.
Controls must change behavior
Policies are useful only when they lead to ownership, measurable action, evidence, escalation, and better decisions.
Leadership & Security Capabilities
A CISO-level capability map spanning governance, technical risk, operating resilience, and executive leadership.
Cybersecurity StrategyExecutive Risk CommunicationGRC / Audit ReadinessNIST / FISMA / RMFZero Trust / IAMCloud & SaaS SecurityMicrosoft Entra / M365 / IntuneIncident ResponseBusiness Continuity / DRThird-Party RiskVulnerability ManagementSIEM / MonitoringData Protection / DLP / EncryptionAI Security & GovernanceProgram / Project LeadershipSecurity Culture & Training
Selected Projects & Evidence
Public summaries of deeper evidence-backed work. Over time, each can become a dedicated case-study page.
Enterprise Identity & Zero Trust Modernization
Led a 493-user MFA, SSO, identity-governance, and access-lifecycle transformation using Okta and Duo, with phased deployment, user training, role-based application access, privileged-account separation, quarterly reviews, and NIST 800-53 evidence.
Security Awareness, Phishing Resilience & Fraud Loss Prevention
Built a 500-license KnowBe4 awareness program with Active Directory enrollment, onboarding training, twice-yearly phishing simulations, NIST 800-53 alignment, and executive reporting. Training helped surface a real fraud event involving an escalating payment pattern culminating in a transaction exceeding $120,000.
Small-Business Security & Resilience — SteveBenson.com
Designed a right-sized security and business-continuity approach for a small music studio, expanding cloud protection from temporary file sharing measured in tens of megabytes to automated backup of nearly the full dataset—just under 1 TB—while strengthening identity, network segmentation, recovery readiness, and protection of customer data.
Physical Security Governance & Access-Control Modernization
Remediated a legacy physical-access environment with 1,700+ active badge records for roughly 220 legitimate badge holders, then led a two-plus-month modernization that approximately doubled camera coverage, integrated badge administration with Active Directory, introduced tiered and mobile access, strengthened surveillance coverage, and established NIST-aligned governance and recurring recovery testing.
Credentials
Completed professional certifications supporting cybersecurity leadership, cloud security, governance, AI security, and execution.
CISSP
Certified Information Systems Security Professional
CISM
Certified Information Security Manager
CCSP
Certified Cloud Security Professional
PMP
Project Management Professional
CompTIA SecAI+
Security certification focused on AI-era cybersecurity risks and controls
B.A., Chemistry & Physics
St. Mary’s College of Maryland
Background
Experience spanning federal mission support, enterprise security leadership, and independent cybersecurity advisory work.
Oct 2026–Present
Senior Information System Security Manager — CACI International (FEMA-supporting program)
Joined CACI on October 19, 2026, in a federal cybersecurity assignment supporting FEMA. Initial onboarding and customer access integration are underway; project outcomes will be added as they are delivered.
2014–2025
Information Security Manager / Enterprise Security Lead — AFGE
Led enterprise security strategy, governance, operations, incident readiness, risk management, resilience, and executive reporting.
2002–2014
Program Security / National Security Support — TASC / NRO
Supported classified mission environments and security programs across national-security contexts.
2026
AI Security Curriculum Advisor / Instructor — Intellectual Point
Advised professional and leadership audiences on secure AI adoption, model/vendor risk, data protection, access controls, and governance.
Let’s connect.
Open to conversations around CISO, vCISO, cybersecurity leadership, enterprise risk, cloud security, AI governance, and resilient security programs.