About
State CISO. Researcher. Veteran.
I run cybersecurity for 35 Florida agencies. I'm studying whether our risk models actually predict losses. I learned decision-making under pressure as a Marine. This site is where the three intersect.
The work
As State Chief Information Security Officer for Florida, I lead enterprise cybersecurity across 35 state agencies, 107,000 employees, and 200,000 devices. The role spans the statewide cybersecurity operations center, a $150M enterprise modernization program, and a four-pillar strategic plan covering community engagement, architecture modernization, CSOC maturation, and resiliency. I came to the role through a career arc that started in the Marine Corps and moved through critical infrastructure security at the Greater Orlando Aviation Authority, then through state government beginning in 2024.
The research
I'm a doctoral candidate at Capitol Technology University. My dissertation applies the FAIR risk quantification model to historical public sector incident data, asking the question that almost no operating CISO has time to ask: do our risk frameworks actually predict what happens? FAIR is the strongest available standard for translating cyber risk into financial language. The literature on its public sector predictive reliability is thin. I have access to data and operational context most academic researchers do not, and I'm using that access to study the model rather than to perform it.
The lens
The Marine Corps taught me that decisions made with incomplete information still have to be made. The discipline that comes from that posture, the willingness to commit, audit, and adjust, is the through-line for everything that followed. I write about that lens because it's load-bearing for the work, not because it's branding.
Why this site exists
Pellonium sells a platform. I'm not selling a platform. The closest analogy is the human version: practitioner-researcher writing on cybersecurity at scale, framework critiques anchored in operational reality, and the structural problems no one wants to name. The site is here because the writing should have a home that signals the work, not a WordPress placeholder that buries it.
What you will not find here
No vendor pitches. No fear-uncertainty-doubt as a sales motion. No agency-specific data. No proprietary state work product. No commercial consulting offers while I hold this role. Just essays.
Subscribe
Weekly insights from Florida's State CISO.
Field observations, framework critiques, and practitioner-researcher essays. No spam. Unsubscribe in one click.