Sol Zona

Cybersecurity leader turned AI governance specialist, combining 8 years of enterprise program ownership with applied AI risk and governance expertise. Built and ran an ISO/IEC 27001 security program from the ground up, establishing the governance structures, risk frameworks, and executive reporting discipline that translate technical risk into business-level decisions. Now focused on the equivalent build in the AI domain: standing up AI management systems on the ISO/IEC 42001 certification path, mapping governance obligations to NIST AI RMF and SR 11-7 model risk expectations, and bridging the gap between AI adoption velocity and the oversight infrastructure organizations need.

Operates best where governance is being built, not inherited.

Senior Cybersecurity Specialist (Team Lead) at A. W. Chesterton (2022-04 – 2026-01)

• Built the company's enterprise cybersecurity program from the ground up (vulnerability management, phishing defense, endpoint protection, and MSSP integration), with measurable risk reduction tied to investment decisions.
• Designed and implemented an enterprise risk management approach aligned to ISO/IEC 27001, including risk identification, scoring (likelihood x impact), treatment workflows, and continuous monitoring, all audit-ready.
• Developed and delivered GenAI acceptable-use guidance and awareness for company employees, addressing customer data exposure risk in third-party LLM tools and aligning guidance with existing data-handling standards.
• Implemented controls limiting shadow AI exposure, including tool restrictions and data-loss prevention measures targeting unsanctioned consumer LLM use across business functions.
• Evaluated MSSP AI-augmented detection capabilities, including behavioral analytics and adversarial-input handling, assessing detection efficacy, false-positive impact, and vendor governance posture for AI features added to existing security tooling.
• Led cross-functional risk reviews with IT, HR, legal, engineering, and business stakeholders; produced weekly cyber health reports, monthly IT leadership updates, and annual executive briefings translating technical risk into business impact.
• Acted as incident commander for security events, translating technical issues into business risk for leadership decisions.

Information Assurance Specialist at Department of the Navy (Naval Justice School) (2018-06 – 2022-04)

• Supported risk management and compliance in a regulated DoD environment, ensuring adherence to established security control frameworks.
• Contributed to security audits through evidence collection and control validation; developed strong discipline in documentation, policy adherence, and accountability.

B.S. in Cyber Operations – Dakota State University (2022)