Rafael Ibarra

Own a $14M security budget and 45-person team spanning SOC, GRC, AppSec, cloud security, and IAM for a 2,100-employee payments platform. Reduced mean time to remediate critical vulnerabilities from 41 to 13 days by rolling out risk-based patching SLAs and automated ticket routing. Achieved ISO 27001 and PCI DSS Level 1 certification in 14 months; maintained SOC 2 Type II with zero exceptions for 4 consecutive audits. Deployed zero-trust access (SSO, phishing-resistant MFA, device posture) for 100% of workforce; phishing-driven account compromises fell 92%. Present quarterly cyber-risk posture to the board audit committee; led tabletop exercises with the executive team and outside counsel. Negotiated cyber-insurance renewal that lowered premium 22% while raising coverage limits to $25M.

Built the security function from 6 to 28 people as the company scaled from $40M to $210M ARR. Launched a 24/7 security operations center with SIEM/SOAR automation, cutting alert triage time 60%. Embedded secure SDLC and threat modeling into 30+ engineering teams; pen-test high findings dropped 75% year over year. Ran incident response for a third-party vendor breach, containing exposure within 6 hours and meeting all customer notification obligations.

Led HIPAA security program across 12 hospitals and 9,000 endpoints; passed OCR audit with no findings. Migrated perimeter to next-gen firewalls and network segmentation, isolating 4,000 medical IoT devices. Implemented DLP and email encryption that reduced reportable PHI incidents 80%.

Performed vulnerability assessments and log analysis for state agency networks; authored 40+ incident reports.

Graduate studies focused on enterprise security architecture, risk management, and cyber defense.

Undergraduate foundation in computer science, systems, and software engineering.