Netflix

Leading 3 functional teams (STAR  - Security, Technology Assurance & Risk | Strategy and Operations | Business Information Security Officers).

Senior Manager, Security Leadership & Engineering

● Designed and currently lead a cyber risk management program focusing on quantitative measurements to drive business investment decision-making, which established a risk tolerance level of $130M to $150M to aid in prioritizing engineering and security investments

● Developing a metrics and assurance program to support and inform Executive Leadership, Engineering
Leadership, Board Members, and Audit Committee members. This program measures thresholds and
targets that drive alignment across performance, security, and other business strategies.

● Established an engineering-first compliance program focused on unified controls, automation, control
effectiveness, control visibility, and self-service evidence functionality

● Created a governance program that established guiding principles for identity access management,
workforce security, and data governance.

● Developed and grew staff competencies through team development, implementation and support of
specific training for various responsibilities.

Head of Security, Technology Assurance & Risk (STAR)

Security BSides Las Vegas

BSides Las Vegas is a nonprofit organization formed to stimulate the Information Security industry and community by providing an annual, two-day conference for security practitioners and those interested in (or looking to) enter the field.

Board Member

Stitch Fix

● Established and executed a 3-year security roadmap to build security capabilities within the organization. The initial security plan focused on Product Security, Cloud Security, Data Security, Incident Response, Infrastructure Security, GRC, and Enterprise Security.

● To support business expansion into European markets, lead the team to develop a comprehensive data
security and protection program that adhered to GDPR compliance.

● Integrated and embedded security into engineering (DevOps) processes to increase security control
adoption

● Created and presented metrics and reporting KPIs to Executives, the Audit Committee, and the Board to highlight security's impact on the business

● Established the first fraud team (Security, Customer Service, and Data Scientists) to address customer
impact and minimize fraud with annual savings of $1.5M)

● Created a strong security communications practice: regular email and Slack communications to educate staff against known threats and potential attack vectors and timely security incident reports, highlighting breaches, vulnerabilities and remedial measures

● Developed and maintained incident response protocols to mitigate damage and liability during security breaches

● Designed company-wide policies to align operations with Center for Internet Security (CIS) standards

● Collaborated with third-party payment card industry (PCI) compliance partners

Director Of Information Security

Twilio Inc.

● Responsible for developing a comprehensive security program for Twilio's Amazon Web Services
Production platform

● Implemented low friction application security design and reviewed 20+ applications monthly

● Executed Threat Vector Analysis for Applications, Services, and Infrastructure to ensure Secure Software Development

● Establish lagging security metrics for operational insight and strategic development

● Responsible for the creation and expansion of the security monitoring and incident response capability
for Twilio Enterprise

● Developing security controls to adhere to Regulatory Compliance (SOC2, PCI Merchant Level 1,
ISO27001)

● Analyzed network security and current infrastructure to assess areas in need of improvement and
develop solutions

● Identified computer hardware and network system issues, performing troubleshooting techniques for
remediation

Security Engineering Manager

CODE2040

Fellows Program Council Co-Chair

LinkedIn

● Spearheaded the development and scaling of security monitoring and incident response capabilities for LinkedIn Enterprise across key global regions including the USA, UK, China, South America, and India

● Established and refined the LinkedIn Incident Response Program, ensuring robustness and agility

● Directed security architecture and set requirements for LinkedIn's expansion into China

● Collaboratively devised LinkedIn's Cloud Security Strategy, formulating security protocols and assessment methodologies for SaaS applications

● Oversaw and administered the GRC process, with a focus on PCI compliance

● Led investigations into copyright violations and instituted a proactive monitoring strategy to curb infringement activities

Manager, Information Security

McAfee

● Solutions Architect for McAfee ePolicy Orchestrator Management Platform within the Federal and
Healthcare Business Sector

● Developed training material for US Intelligence customers to maximize analyst time for computer
network defense (CND) and incident response triage (IR)

● Develop risk metrics for enterprise assets to assist customers in developing and designing a continuous monitoring program for compliance and risk assessments (e.g., certification and accreditation (C&A))

● Performed automated malware analysis using McAfee Network Threat Response, Global Threat
Intelligence Artemis, and open-source tools providing situational awareness for customers for incident
response and (idk)

Principal Professional Services Consultant

DISA

● Provided technical security oversight and lifecycle management to the Department of Defense
Host-Based Security System (HBSS) Program, which supported 3 million+ assets within the DoD ($50M+
program)

● Provided enterprise strategic planning for the implementation and utilization of IDS security tools as part of DoD Directive 8500 series

● Developed an asset risk scoring process to identify critical systems and score the asset's risk posture,
allowing generals to make critical operational and mission-related decisions

● Analyzed HBSS events to assist EUCOM Headquarters Security Operations Center (SOC) in adopting
HBSS events as part of their incident response process and event triage process utilizing the Attack,
Defend, Detect, and Remediate (A2DR Methodology)

Computer Scientist

Penn State University

Research open source integrity monitoring systems and log management systems.

Network Development Program

Northrop Grumman Corporation

Develop widgets for web based JSP application.

Java Programmer (Intern)

With over 15 years as a pioneering technology executive, I stand at the crossroads of cybersecurity and risk management. My deep-rooted expertise spans Information Assurance (covering governance, risk, and compliance) to Security Engineering (focusing on both enterprise and cloud security). 

At the heart of fast-growing, heavily regulated industries, I've built and steered elite teams, excelling in guiding vast, remote, and diverse cross-functional groups within evolving organizations. My primary mission? To seamlessly merge business aspirations with security strategies, ensuring investments result in optimal security outcomes. I champion programs that harmonize innovation with risk management, all while ensuring resilience. Collaboratively working with Senior Leadership and Board members, I establish risk frameworks to foster enhanced cyber resilience, informed decision-making, and amplified productivity. 

My commitment lies in fostering an enterprise-wide culture vigilant against cyber threats, ready to identify, preempt, counter, and recuperate from potential cyber incursions.

Taplio

Charles Nwatu's Linkedin Analytics

Charles Nwatu

Want to drive more opportunities from LinkedIn?