Principal security architect
High-assurance product security, applied cryptography, and certification.
Common Criteria and FIPS 140-3 strategy for cloud, database, and platform products; technical leadership in the international Technical Communities that write the requirements.
I lead Oracle's cross-product Common Criteria and FIPS 140-3 certification strategy across Oracle Cloud Infrastructure, Oracle Linux, OKE, Oracle Database, KVM, and OCI identity products, and I provide cryptographic subject-matter expertise to product teams building for National Security Systems, including post-quantum migration with ML-KEM, ML-DSA, and SLH-DSA.
Before Oracle I led the first Common Criteria evaluation of Dell iDRAC, and earlier I evaluated products against NIAP Protection Profiles and validated cryptographic modules under CMVP as a lab evaluator at atsec. That evaluator-side grounding is what the architect-side work rests on.
Chair, DBMS iTC
Vice Chair and Technical Editor, AppSW iTC
Technical Editor, CCiTC
CCUF Management Group, 2024 to 2028
Standards leadership
- DBMS iTC
- Chair. Database Management Systems international Technical Community, producing the DBMS Protection Profile and PP-Modules under CC:2022.
- AppSW iTC
- Vice Chair and Technical Editor. Lead author of the Application Software Server and Agent PP-Modules; contributor to the base collaborative Protection Profile.
- CCiTC
- Technical Editor. Originating author of the Essential Security Requirements that established Common Criteria in the Cloud as a recognized Technical Community, and lead author of its CCDB-endorsed cloud evaluation guidance.Foundational substrate for NIAP Policy #32 cloud scope expansion.
- CCUF
- Member, Common Criteria Users Forum Management Group, 2024 to 2028.
- Oracle
- Technical Lead, Oracle Common Criteria Working Group. Trained NIAP and MITRE validator staff on cloud architecture across multi-day workshops.
Publications and standards
PP-Module for Application Software Agent
PublishedCCiTC Guidance for Cloud Evaluations
PublishedEssential Security Requirements for cloud evaluation
Publishedcollaborative Protection Profile for Application Software
PublishedDBMS PP-Modules for Cryptography, Cloud, and DBaaS under CC:2022
In iTC reviewDatabase Management Systems Protection Profile, CC:2022
In iTC reviewExperience
2021 to present
Oracle Principal Security Engineer and Architect
Own FIPS 140-3 validations and Common Criteria certifications across Oracle Linux, OKE, Oracle Database, KVM, and OCI Identity Management. Lead GSMA NESAS process audits and product certifications for 5G cloud-native core products. Drove the Oracle Database 26ai Common Criteria certification through a mid-evaluation retarget from 23ai, issuing the certificate about three weeks after on-premises availability.
Dell
Dell Technologies Security Architect
Led the first Common Criteria evaluation of Dell iDRAC, establishing a recurring certification program for the platform. Built and operated the internal test lab, deploying Isilon, PowerScale, PowerMax, XtremIO, Unity, and VxRail platforms across the Dell EMC portfolio.
atsec
atsec information security Evaluator
NIAP-accredited Common Criteria Testing Laboratory evaluator across multiple product categories. FIPS 140-2 and 140-3 cryptographic module validation under CMVP, with CAVP algorithm testing and SP 800-90B entropy assessment.
2012 to 2016
Dell Inc. Software delivery and QA management
Managed a distributed QA organization of roughly fifty engineers across Austin, China, and Taiwan for consumer and platform software shipped on millions of Dell systems, and compressed the sprint cycle from five weeks to three.
Working vocabulary
Speaking
Recurring speaker at the International Common Criteria Conference (ICCC) and the International Cryptographic Module Conference (ICMC) on cloud-native evaluation, PP-Module design, and certification strategy.
Contact
For standards work, certification questions, or speaking, email is the reliable channel.