Pataskala, Ohio · CISSP · U.S. Army veteran
I'm Samuel J. Davis — Director of Information Security and Head of Cybersecurity. I stood up an enterprise security program from nothing, cut PCI audit scope roughly in half, and spend most of my day turning frightening technical problems into decisions a leadership team can actually make.
tip The terminal below is a real conversation — type
help, hire, or just ask a question in plain English.
Interactive
No form, no autoresponder. Type a command or a plain-English question and you'll get the same
answer I'd give you over coffee. Recruiters: start with hire.
About
Most security failures I've seen weren't sophisticated. They were ordinary — a process nobody owned, an exception nobody revisited, a warning nobody understood well enough to act on. Technology rarely fails alone; it fails alongside a sentence somebody didn't say out loud.
So that's the work. I take the thing the engineers are worried about and tell it as a story the finance team, the board, and the person in the warehouse can all follow — and then I make sure the story ends with a decision instead of a slide.
I came to security sideways: programmer, architect, web development manager, then senior manager over network, cloud, and web operations. I earned the CISSP on my own initiative and used it to start a conversation that eventually became a formal enterprise security program. Before all of that, I was a Military Police Sergeant and a communications specialist in the U.S. Army — which is where I learned that a plan nobody has rehearsed isn't a plan.
“If I can't explain the risk in one breath, I don't understand it yet.”
How I work
Every one of these started as an argument I had to win with evidence rather than authority.
I built our first program on the NIST CSF — not because frameworks are magic, but because they give a company a shared vocabulary and an honest scorecard. Governance is the boring function everyone skips and the only one that makes the other five stick.
Program design · Policy · Operating model
Leading PCI DSS governance and auditor engagement, we cut cardholder scope by about half over three years. Every system we segmented, retired, or took out of the flow was one we never had to patch, monitor, audit, or explain again.
PCI DSS · Compliance strategy · Audit engagement
Identity is the real perimeter now. MFA, SSO, and privileged access management do more for a mid-sized company's risk profile than any appliance — and they do it without asking employees to become security experts.
Zero Trust · Identity · MFA/SSO · Cloud security
I put a third-party and SaaS review in front of procurement, not behind it — 20+ vendors a year, assessed on the data and access they'd actually get. Saying “not like that” before a contract is signed costs nothing. Afterward it costs everything.
Vendor risk · SaaS governance · Procurement
Incident response
You learn this the first time it happens to you, and every incident since has re-taught it: calm on the bad day is manufactured in advance, out of rehearsal, clear roles, and permission to speak up early.
Experience
Highlights for Children, Inc. · Columbus, OH
Established and lead the enterprise Information Security function with full accountability for strategy, governance, risk, and incident response across corporate, cloud, and application environments. Senior-most authority on cyber risk, reporting posture and recommendations directly to executive leadership.
Highlights for Children, Inc. · Columbus, OH
Senior operations leader over enterprise network, cloud (Azure), and web platforms — accountable for uptime, resilience, and team performance across business-critical and customer-facing systems.
Progressively responsible technology roles spanning application development, systems architecture, physical security, enterprise platforms, vendor coordination, and delivery in complex organizations. I've been the person on the other end of the security requirement, which is precisely why mine are written to be implementable.
Security culture
You can buy detection. You cannot buy the four seconds in which an employee decides whether to tell you they clicked the link. That decision is made long before the incident, based on how the last person who admitted a mistake was treated.
So I run awareness like storytelling, not compliance homework: short, specific, human, and occasionally funny. I'd rather someone remember one story about a fake invoice than pass a quiz they'll forget by Thursday.
It shows up in the numbers eventually. It shows up in the hallway first.
B.S., Computer Information Systems
DeVry University — Columbus, OH
U.S. Army & Army Reserve
Military Police Sergeant · Communications Specialist
NIST CSF · PCI DSS · Zero Trust · Business continuity & disaster recovery
Contact
I'm open to security leadership roles across the Columbus metro or fully remote, and to fractional and advisory work. If you're standing up a program and want an outside read on it, or you need someone who can explain risk to a room that doesn't work in security, write to me. I'd rather tell you something useful than something polite.
Prefer the keyboard? Type contact in the terminal.
