Almeshaan Consulting

 Founder and CEO

Harvard Business Review

Advisory Council Member

Forum Ventures

Venture Partner

Director of Operations | Chief of Staff

Senior Manager Business Operations

Program Manager & Venture Associate

Elevate Diversity

At Elevate Diversity, we strive to be the go-to hub for professionals seeking meaningful connections, career advancement, and impactful service opportunities, with diversity at the heart of our community.

Co-Founder

Resolve

Resolve is a fintech that helps people experiencing financial distress to get out of debt by combining technology and human support. The mission is financial health and prosperity for all and my work was focused on growth, a new product model launch and making Resolve the most ethical brand in the debt space.

Chief of Staff

Nudge Rewards (Acquired by Axonify)

Business Development

Procter & Gamble

Launched the Pampers loyalty app in the UAE.
Supported the Pampers brand manager with analytics, analysis, activations, and ads for the gulf region (UAE, Saudi Arabia, Kuwait, Qatar, Bahrain, Oman).

MBA Product Marketing Intern

Soul & Stripes

eCommerce boutique, offering curated collections and personalized styling services.

Founder

Park Street

Compliance Product Manager

Business Development Representative

Business Develpoment Intern

LVMH

Merchandising & Planning Intern- Fine Jewelry

Founder of FA Consulting | Fractional COO | Developing high performing teams | Startup Advisor | Board Member

At Almeshaan Consulting, we drive organizational effectiveness for high-growth companies by aligning organizational goals, setting up structured performance management systems, and providing leadership development and management training.  

Services:
- 𝐅𝐮𝐥𝐥 𝐓𝐞𝐚𝐦 𝐀𝐥𝐢𝐠𝐧𝐦𝐞𝐧𝐭: Set clear, measurable objectives and key results to guide every team member’s efforts and ensure everyone understands their role in achieving company goals.

- 𝐋𝐞𝐚𝐝𝐞𝐫𝐬𝐡𝐢𝐩 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐦𝐞𝐧𝐭 & 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠: Equip your leaders and managers with the skills to lead effectively, from decision-making to people management.

- 𝐎𝐩𝐭𝐢𝐦𝐢𝐳𝐞 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 𝐰𝐢𝐭𝐡 𝐂𝐮𝐭𝐭𝐢𝐧𝐠-𝐄𝐝𝐠𝐞 𝐒𝐲𝐬𝐭𝐞𝐦𝐬 𝐚𝐧𝐝 𝐀𝐈: Develop systems to meticulously monitor and track critical metrics, ensuring your targets are met efficiently.

Curious how you can drive your team's performance? Reach out at faye@almeshaan.co

Faye Almeshaan

Yastis

Performs cybersecurity consulting for small to mid-sized tech-enabled organizations. We assess & enhance organizational cybersecurity to minimize risks while obtaining / maintaining compliance with regulatory and / or industry requirements. Primary responsibilities include product / process development, business development, and overseeing all consulting work being performed.

Cybersecurity Consultant

Ohio Air National Guard

Currently the 251st Cyberspace Engineering Installations Group (CEIG) Plans and Resources Branch Chief. Oversees publication of various strategic and operational level planning documents. Works with program leads for various resource management programs to ensure effective and efficient use of government funds. Leads exercise planning and execution processes. Serves as the Defensive Cyber Operations (DCO) Program Manager, responsible for building and managing DCO programs at eight subordinate military organizations.

Cyberspace Operations Officer

Lockheed Martin

Oversaw the classified cyber security team spanning three US government special access programs in support of the F-35 Joint Strike Fighter. Designed, implemented, managed cyber security policy, plans, and processes to enforce compliance with the Joint Special Access Program Implementation Guide (JSIG) and other Department of Defense regulations. This included system auditing, vulnerability management, account management, insider threat prevention, system to system connections, wireless access points, user training, hardware and software evaluations, approvals, tracking, lifecycle management, and providing cybersecurity input for Risk Management Framework (RMF) Assessment and Authorization (A&A) efforts. Served as the lead for the Lockheed Martin Pilot Training Device (PTD) Enterprise Working Group (EWG) with the goal of increasing compliance, standardization, and cybersecurity employee proficiency across all F-35 simulator sites worldwide.

F-35 Classified Cyber Security Lead 

Department of the Air Force (Civilian)

Served as the ISSM for the main unclassified and classified networks for the base, overseeing cybersecurity for 28,000 users. Managed the RMF Assessment and Authorization (A&A) packages for both systems and served as a go-to Risk Management Framework (RMF) subject matter expert for 65 Program Management Offices (PMOs). Led the Command Cyber Readiness Inspection (CCRI) preparation team. Regularly requested by government organizations to provide IT and cybersecurity consulting services for other programs and systems. Managed the installation Digital Loss Prevention (DLP) Program, also known as the Insider Threat Program. Senior Local Registration Authority managing the base Public Key Infrastructure Program. Oversaw the base Software Assurance program, responsible for evaluating and approving software requests.

Information Systems Security Manager (ISSM)

Primary technical advisor and requirements lead for IT projects of all sizes, including installation-wide technical refresh efforts and projects providing services for up to 5,000 users at a time. Managed the Firewall Exception Request Tool and Enterprise Telephony Management System protecting the base voice network boundary. Quickly found and shut down cyber-attack attempts.

IT Requirements Surveyor

Air Force / Ohio Air National Guard (uniformed)

Held technical roles in voice, data, and video network infrastructure systems in both fixed and tactical environments. This included all phases of the lifecycle from planning, to implementation, to operations, maintenance, to decommissioning. Also, trained members in related career fields using both military and commercial standards and procedures.

Cyber Transport Systems Craftsman

Department of the Air Force (Uniformed until 2006 then civilian)

Lead implementation specialist for the highest visibility and most challenging voice and network systems projects. Expansive knowledge of AFB voice and IT architecture. Regularly provided consulting and briefings to management and base users on best practices for their IT projects. Conducted programming and maintenance of the base network for 28,000 users.

Voice and Network Systems Implementation Specialist

Cybersecurity entrepreneur helping small to medium-sized US businesses reduce their cyber risk and increase compliance by providing the right solutions at the right time.

Part-time Cyber Operations Officer, recently named as the 2024 Ohio Air National Guard Company Grade Officer (CGO) of the Year and the 2023 Group Cyber Warrior of the Year.

Active in the leading Las Vegas startup communities collaborating with people building things that the world wants and needs.

#cybersecurity #infosec #privacy #compliance

Michael  Andrewes

If a cybersecurity policy isn't followed, is it even worth having?

Many companies rely on policy templates today.

Some customize them, some do not.

AI-generated policies are becoming common too.

The real risk comes when security controls do not align with the policy.

Here’s how to make your cybersecurity policies actually work:

➡️ Customize them to your company.

➡️ Build them around both risk and compliance.

➡️ Get input and sign-off from every department.

➡️ Use technical controls to enforce them where possible.

➡️ Keep policies lean and add detailed playbooks for each department.

➡️ Write clearly so people do not need constant clarification.

When policies are customized, clear, and practical, people actually read them.

✅ Then, we have a real chance of enforcing them, and that's the goal.

Mike Andrewes

Cybersecurity Advisor | Scalable cybersecurity for startups and SMBs

AI is transforming cyber GRC, but there are real risks to consider.

Having the right people, process, and technology is still the winning formula.

Unfortunately, the hiring process can frustrate both companies and jobseekers.

The GRC Recruiter Pete Strouse has successfully navigated these waters, and he’ll be joining - Karina Klever - and me in The GRC Room on Dec 10.

Pete is the CEO and Founder of InfoSec Connect and hosts the Talent Gap Fireside Chat.

We will discuss:

➡️ The cybersecurity skills gap
➡️ Skills companies are looking for
➡️ How AI will change things
➡️ Offshoring
➡️ The right way to hire
➡️ Tips to get hired

Intended audience: Those looking to hire, get hired, or learn more.

👉 Next steps: RSVP today or share with your network!

#cyber #grc #hiring

Mike Andrewes, Sahar Dahan and 3 other connections attending

When there's a cyber attack, it's good to check the dwell time.

Meaning: How long was the attacker in the system before someone noticed?

Sometimes, it's short, which is a good sign.

Other times, it's a year or longer.

The 2020 SolarWinds supply-chain attack is an example of this.

In cybersecurity, it's impossible to be immune to every threat.

They evolve daily.

A software vulnerability or third-party might be at fault.

A long dwell time shows a couple of things:

- The tools in place weren't sufficient.

- The company wasn't monitoring their systems well enough.

This second point is a big one because it's so preventable.

We know to buy and implement the cybersecurity tools.

We need to remember to monitor them and take action when needed.

A lot of this can be automated, but humans need to be checking things too.

Once this happens, confidence will increase and the business benefits.

When there's a major incident, do any other aspects peak your curiosity?

Why is third-party risk management (TPRM) such a challenge? 🤷‍♂️

Fabrik Cofounder and CPO Henry Stanley said something to - Karina Klever - and me that really stuck (paraphrased):

“It is not a business problem you can solve alone. There are many unknowns, and people get hung up on the ones they cannot control.”

He is absolutely right.

Smart, motivated people often won't like waiting on other teams or vendors to send information, especially when it's incomplete or inconsistent.

They also aren't going to love getting asked again and again why a vendor approval is delayed.

Yesterday, I posted about cybersecurity sometimes being seen as the Department of No.

This situation is a major reason this perception exists in cybersecurity.

Some people navigate this effectively, while others struggle with it.

▶️ Check out the attached clip for more on this from Henry and let us know what you think!

We hear a lot about cybersecurity training, but much less about exercises.

In 2025, even smaller companies usually provide some form of cybersecurity training.

Sometimes that training even includes a simple progress check. 🤞

Exercises are different.

They are usually found in companies with a more mature cybersecurity program.

Why is that?

Waiting until a real incident happens to see how teams respond is risky.

By the time you discover the gaps, the damage may already be done.

If your company handles sensitive data, relies on systems staying up, or has compliance obligations, you should run a cyber exercise.

The Cybersecurity & Infrastructure Security Agency (CISA) offers free exercise resources that many organizations use.

The link to their exercise page is in the comments.

Our company can also host an exercise for you.

Exercises work well for company leaders, legal teams, technical teams, and even non-technical employees can take part.

Running an exercise will also show how well your policies and processes hold up under pressure.

There is very little downside to this.

✅ If you have any questions, let me know!

This session of 'The GRC Room: 5 Questions' features Anecdotes CISO Jake Bernardes.

We talked about how he led the company through SOC 2 Type 2, ISO 27001, ISO 27701 & ISO 42001 within his first 6 months.

With Anecdotes being a GRC platform, this is impressive and a great way to stand out among the competition.

Jake was quick to give credit to his team, specifically praising Adeel Bakht and Michael Kipnis 🧡🎗️🇮🇱 for their efforts.

The questions:

1️⃣ Which part of cyber GRC do businesses struggle with the most?

2️⃣ What's one data breach that stood out to you and why?

3️⃣ What's the most impactful GRC-related advice you ever received?

4️⃣ What do you do differently that allows you to excel in this field?

5️⃣ What's the top thing a business can do today to strengthen its cyber GRC?

▶️ To hear more on this from Jake including a couple of hot takes, check out the attached video and let us know what you think!

We can’t protect what we don’t understand.

In cybersecurity, data classification should happen early.

It often doesn’t.

Without data classification, it's hard to tell what types of data your company holds, where it lives, or who has access.

That uncertainty creates risk. 

It also makes it unclear what can safely be shared with partners, vendors, or even your favorite LLM.

Once your data is classified, things start to make sense.

Policies are easier to enforce.

Groups, roles, and system segmentation suddenly look way more security-relevant.

Data classification sets the foundation for your entire cybersecurity program. 

It's worth implementing, even if it's just 'public' or 'confidential' to start.

You can always get more granular, when needed.

#cybersecurity #compliance #grc

Here a simple cybersecurity test business leaders can use:

Ask the person handling your cybersecurity to give you a status report in 30 minutes.

How would that go?

This request can be quite insightful.

If they need to pull data from many locations, clean it, and analyze it before giving you a decent answer, something might be lacking.

People in our role should have a solid sense of where things stand.

This doesn't mean memorizing random numbers.

It means reviewing the important items often enough that they're easy to recall.

There should be a living list that shows the top risks and the actions being taken.

There should be a small set of dashboards that give quick context.

When the cybersecurity person (or team) is prepared, it will show.

Thank you to our clients, partners, and peers for making each day in cybersecurity worthwhile.

“Success is never owned; it's leased. And rent is due every day.”

- Rory Vaden, then J.J. Watt

This quote is so true in cybersecurity.

We need to keep evolving to do well over many years.

This can frustrate some people.

It’s also an opportunity.

AI will make certain parts of working in this field easier and better.

It will also add headaches we need to navigate.

We can’t do this in a way that brings the business to a crawl.

Anyone can do that. 

Instead, we need to:

- Learn the business 
- Communicate effectively 
- Build good processes
- Automate, when possible
- Continuously monitor systems
- Respond to issues quickly
- Continuously improve things

When things go well and the business meets their goals, it’s a rewarding feeling.

I’m thankful to be a small part of that.

Now, it’s time to go make some food!

No alternative text description for this image

"What will we do if there are major cyber risks?"

In third-party risk management (TPRM), this is important to ask within your organization.

Without knowing what the business leaders think, the cybersecurity team might be spinning their wheels while assessing vendor risk.

It might even get to the point where business leaders and staff are pointing fingers at the cybersecurity team for simply trying to protect the company.

Of course, it'd be great if we can send a vendor questionnaire and receive a quick response showing strong cybersecurity and compliance.

That doesn't always happen though. 🙁 

Sometimes, the response is weak or misleading.

Sometimes, there is no response.

By having this discussion with the business leaders, everyone will know whether:

- Things need to move forward anyway, so it's time to start thinking about how to mitigate the cyber risks; or

- Business leaders genuinely want to know how things look then will decide what to do.

- Business leaders plan to take the cybersecurity team recommendations and are open to looking at other vendors.

This conversation doesn't need to last more than five minutes.

Have the talk and get this right.

Everyone benefits.

✅ If you need to sharpen your TPRM so your business can accelerate, send me a DM.

#cybersecurity #grc #tprm

taplio

The Battle

Faye Almeshaan

Michael Andrewes

Followers

Posts

Engagements

Likes

Performance ScoreMichael Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Faye Almeshaan

Michael Andrewes

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Michael Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreMichael Andrewes's LinkedIn Performance