George Moraetes

Information Security Architect with 20+ years designing, implementing, and managing security architecture for Fortune 500 companies and government programs. Proven ability to deliver complex, enterprise-wide security initiatives on time and within budget, including development and enforcement of security policies, standards, and controls. Deep experience leading Zero Trust architecture, infrastructure protection, and identity/access management, plus governance, risk, and compliance (GRC) programs covering regulatory frameworks (e.g., NIST, ISO 27001, HIPAA, & FedRAMP) and audit readiness.

Skilled at threat modeling, vulnerability management, incident response, third-party risk, and translating compliance requirements into practical security controls and measurable metrics.

Independent Director, Information Security Architecture (Contractor) - Independent - Tarpon Springs, FL

(2019-01)

• Led enterprise security architecture and program strategy across large public- and private-sector engagements; built and mentored cross-functional security teams and managed budgets and resourcing.
• Architected the Tricare West healthcare enclave across two redundant data centers; mapped security stacks to NIST SP 800-53 controls and led certification & accreditation efforts for federal compliance.
• Managed and matured client security programs aligned to NIST CSF: defined target profiles, prioritized gaps, and implemented roadmaps to elevate maturity levels.
• Designed and implemented Zero Trust architectures, including security policy, control provisioning, and operational playbooks; delivered multi-million-dollar cost avoidance and eliminated $2M in recurring costs through risk-based control rationalization.
• Directed IAM programs (SSO, MFA, PAM) across multiple organizations and led engineer cross-training for operational readiness and supportability.
• Implemented enterprise DLP strategy and security governance controls, yielding >$1M in cost savings.
• Owned security technology strategy and portfolio, including GRC platforms (Archer, ServiceNow) and cloud security controls for Azure and AWS environments.
• Owned end‑to‑end security posture for multi‑tenant and healthcare enclaves: led HIPAA compliance programs, mapped controls to NIST/HIPAA rule sets, and drove remediation to audit readiness.
• Interfaced with customers and partners on security questionnaires, completed SOC 2 readiness artifact collection, and supported audit responses.

Independent Senior Information Security Architect (Contractor) - Independent - Geneva, IL

(1996-01 - 2018-12)

• Led federal certification & accreditation activities and ensured compliance with FISMA and related mandates as part of Security Tiger Teams.
• Designed and deployed enterprise IAM and Zero Trust solutions at scale, integrating SSO, MFA, and PAM to improve security posture and user experience.
• Acted as primary point of contact for security incidents across multiple client engagements; led investigation, containment, remediation, and post-incident reporting.
• Created the industry's first vendor accreditation security assessment to measure third-party security compliance and processes.
• Architected disaster recovery and business continuity solutions aligned to enterprise SLAs; conducted architecture reviews and threat modeling for on-prem and cloud applications.
• Developed GRC strategy and processes to attain/maintain ISO 27001, PCI-DSS, and SOC2 objectives.
• Performed product/security assessments, penetration test oversight, and vulnerability remediation prioritization.
• Architected IAM, SSO, MFA, and PAM solutions; applied least-privilege and zero-trust principles across cloud and on-prem stacks.

Bachelor of Arts - Geology/Geophysics - University of Iowa