Hi, I'm Adalberto.

I am a cyber risk, policy, and systems security practitioner working at the convergence of enterprise IT, risk mitigation, and emerging technology policy.

IT infrastructure came first, policy second. Ten years of running enterprise systems taught me that most security problems are decision problems, and I am drawn to the gap between what a finding says and what leadership can act on. The test I care about is whether the mission still runs when something fails.

My approach follows that order: start with how the systems actually run, assess the controls against NIST CSF, NIST 800-53, and ISO 27001, write the policy that makes them enforceable, and build the risk cases decision-makers can act on directly. I am strongest at the point where a technical finding has to become a decision.

I also understand the other side of the brief firsthand. At CUNY, I support a 1,000-plus user institutional environment and serve as the escalation authority for cabinet-level and senior leadership technology issues. I know what breaks when a recommendation ignores how the systems are actually run.

As technical lead on a DHS Office of Strategy, Policy, and Plans engagement, I briefed smart city infrastructure risk to a Deputy Under Secretary and more than fifty DHS Science and Technology personnel.

I am particularly interested in the work frameworks alone cannot do: deciding which risk actually matters, getting leadership aligned on it, and writing the policy people will follow. Frameworks give a program its structure. Judgment decides what it protects first.

Currently exploring full-time opportunities in New York in infrastructure security, security operations, GRC, and cyber policy. If that is what you are building, let's talk.