Hi, I'm Paul.
Building security programs that hold up on the worst day.
Chief Information Security Officer at Tapestry Health. Before that, Director, then Assistant Vice President of Information Security at OU Health, a $3.9B academic health system, where the security organization grew from 4 to 24.
Sandy, Utah · Open to remote roles
A little about me
Most of my career has gone into building security organizations in places that answer to the public: a school district of 85,000 students, a university of 150,000, and a three-hospital academic health system. The pattern is the same each time. Hire and promote good people, get the identity layer right, put real numbers in front of the Board, and hold vendors to what they signed.
In March 2020, as Fort Worth ISD's functional CISO, a ransomware event reached every system and campus the same month the pandemic closed the schools. Serving as Incident Commander, my team had critical services back in about 10 days without paying a ransom, and the root cause turned out to be an Emotet variant nobody had seen before. That experience shapes how I run a program: the plan has to work on the worst day, not just in the audit.
Now CISO at Tapestry Health, and still most at home building teams, developing leaders and helping organizations adopt new technology, AI included, without taking on avoidable risk.
Strong security programs should enable progress rather than slow it down.
A few things I've worked on
The OU Health cybersecurity team, grown from four to 24 between November 2023 and September 2026, with 13 direct reports, two managers and eight promotions from within, on a $9M annual capital budget presented quarterly to the Board.
Critical services restored across every system and campus of an 85,000-student district after the March 2020 Fort Worth ISD ransomware event, with no ransom paid and two external forensics teams under my command.
Identity and access management rebuilt at OU Health on SailPoint, CyberArk, Entra ID and Imprivata with about $450K in approved funding: provisioning from a week to day one, domain admin accounts from 47 to 9, and 90% of privileged accounts under PAM.
Cut through a security awareness program at OU Health, below the 3.4% hospital average KnowBe4 reports, alongside NIST CSF 2.0 maturity raised from 1.4 to 2.8 and about $2.5M saved across three employers through contract negotiation and consolidation.
Where I've worked
- Chief Information Security OfficerTapestry Health2026 to present
- Director, then Assistant Vice President, Information SecurityOU Health2023 to 2026
- Information Security OfficerWestern Governors University2020 to 2023
- Senior Director of Enterprise Technology (functional CISO)Fort Worth Independent School District2015 to 2020
- Security Engineering ManagerNextlink Broadband2014 to 2015
Earlier roles and full details are on LinkedIn.
Let's connect
Exploring Chief Information Security Officer, Vice President of Information Security and senior identity and access management roles, and always glad to talk about building security programs that hold up.
CISSP, CISM, PMP, GIAC GSTRT · MS, Cybersecurity and Information Assurance, Western Governors University · Health Sector Coordinating Council member, HHS 405(d)