Privacy program
DPIAs, PIAs, and privacy-by-design
Assessments and notices across GDPR, CCPA/CPRA, GLBA, and state privacy laws, built into the engineering lifecycle rather than stapled on at the end.
At Wells Fargo he conducted 70+ privacy impact assessments across high-risk banking systems and set controls aligned to GLBA, CCPA, and internal risk appetite. At Truist he led 50+ enterprise privacy risk assessments with privacy-by-design controls for GLBA, CCPA/CPRA, TCPA, and data minimization. At The Avery Group he ran PIAs and DPIAs and updated consumer-facing privacy notices for emerging tech products.
Open the record
AI governance
AI risk and impact assessments
Risk-tiering, escalation, and audit-ready tracking aligned to the EU AI Act, NIST AI RMF, and ISO 42001 — plus the operating model around the model.
As Principal Consultant at The Avery Group he directed end-to-end AI risk and impact assessments and standardized risk-tiering criteria. At Truist he partnered with executive, business, and technology stakeholders on enterprise AI adoption: which processes to automate, which use cases mattered, and whether the governance could scale with the build.
Open the record
Federal & CMMC
CMMC readiness and data protection
Data-flow mapping and control frameworks for defense-industrial and fintech clients, with evidence a federal baseline can stand on.
At The Avery Group he led CMMC readiness and data governance engagements, mapping complex data flows against strict federal baselines. At Davis Professionals, LLP he spearheaded enterprise data protection assessments for CMMC and federal alignment, kept audit-ready technical documentation against NIST guidelines, and worked with engineering and security to close control gaps in cloud systems.
Open the record
Regulatory
Gap analysis that an examiner can follow
GLBA, CPRA, GDPR, HIPAA, NYDFS, and the wider map — LGPD, PIPEDA, the NIST Privacy Framework, ISO 27001, NIST 800-171.
At Synovus Bank he led enterprise regulatory gap analyses across GLBA, CPRA, GDPR, HIPAA, and NYDFS. That work contributed to a formal privacy program audit with zero material findings. He was the privacy subject-matter expert across 30+ business units.
Open the record
Third parties
Vendor risk, DPAs, and cross-border transfers
Contract language, transfer restrictions, and audit rights — negotiated with Legal and procurement, not left as a questionnaire in a drawer.
At Synovus he led privacy evaluations and contract negotiations for critical vendors, putting DPAs, transfer restrictions, and audit rights into master service agreements. At Truist he strengthened third-party oversight and cross-border transfer governance with Legal and Information Security. At Wells Fargo he helped stand up standardized DPA frameworks covering encryption, breach-notification SLAs, and retention.
Open the record
Operations
DSARs, incidents, and the RoPA
The unglamorous machinery: access requests, incident workflows, and a record of processing that stays audit-ready.
At Synovus he overhauled DSAR operations and incident response, cutting DSAR response timelines by 60% and cross-functional incident resolution time by 20%, and kept the enterprise RoPA continuously audit-ready. At Wells Fargo he maintained data inventories and cross-border processing records used for regulatory inquiries and internal audit defense.
Open the record
Infrastructure
Cloud migration and data residency
Privacy requirements written into the move — residency, control gaps, and the evidence that travels with the system.
At Truist he partnered with cloud migration teams so privacy requirements and data residency controls were part of infrastructure transition planning. At Davis Professionals he worked with engineering and security to find control gaps across cloud systems and run remediation. Frameworks in the toolkit include NIST 800-171 and CMMC alongside ISO 27001.
Open the record
Operating model
Programs inside the build, not beside it
Governance embedded in digital transformation: product, engineering, and the risk appetite of a regulated firm.
At Wells Fargo he embedded privacy governance in enterprise digital transformation, directing workstreams across 40+ initiatives with Product and Engineering. The tools he has run this work in include ServiceNow, Archer, OneTrust, Securiti.ai, and Jira. He is used to translating GDPR, CPRA, the EU AI Act, NIST AI RMF, and ISO 42001 for C-suite, Legal, Engineering, and GRC audiences.
Open the record
