Alex del Rio

Why buyers pick up the phone

Most security programs get built by people who have never sat across the table from a customer under real pressure — a breach in progress, a failed audit, a board asking why the last incident happened. Alex has spent three decades on that side of the table. He shows up as the person a CISO, CTO, or CIO can hand a problem to and get an answer that survives contact with reality.

He is not a vendor pitching a platform. He is not a course marketer selling awareness training by the seat. He is the practitioner customers keep on speed dial when what they need is judgment, not a slide deck.

Verticals he has actually worked

Alex's engagement history is San Diego-anchored and regionally deep across the industries that carry the highest regulatory and operational risk in Southern California and the West:

• Healthcare and medical systems — 10+ years across Scripps Health, Sharp HealthCare, Hoag, UCI Health, Rady Children's, Banner Health, St. Joseph's Health, and regional IDNs. HIPAA architecture, DDI, DNS security, wireless and NAC advisory at CIO level.
• Biopharma and pharmaceutical (San Diego) — acting-CISO engagements, FDA and SOX-aligned programs, malware incident response and remediation.
• Utilities in Southern California — NERC-CIP program work and control-network security advisory for the operators that keep the region's lights on.
• Financial institutions — vendor risk management, breach notification programs, and GRC modernization for firms serving thousands of registered brokers, plus PCI-DSS advisory across the payments stack.
• Gaming and entertainment — enterprise security architecture for the studios, casino operators, and content companies where uptime and IP protection are the business.
• Defense — CMMC and NIST SP 800-171 readiness for small defense contractors heading into 3PAO assessment.

Trusted-advisor engagement model

At his last enterprise post, Alex held a CEO-approved director-of-cybersecurity mandate covering the Western US for the better part of a decade — one of only a handful of technical leaders globally with that scope. He was the person the largest enterprise accounts in the West called when their CISOs wanted a second opinion. CEOs called him for strategic input. CISOs called him for architecture reviews. CIOs called him when a program needed to survive an audit.

That access wasn't granted because of a title. It was granted because when an executive handed him a hard problem, the answer came back grounded in the customer's actual environment, actual regulatory scope, and actual operating budget.

Regulatory and framework fluency

Alex works fluently across the frameworks that matter for regulated industries in the US:

• NIST — CSF, SP 800-53, SP 800-171, SP 800-81r3, and the AI RMF
• ISO — ISO 27001 and ISO 42001 (AI management)
• HIPAA — Security Rule architecture, risk analysis, and DNS/network posture for covered entities and business associates
• PCI-DSS — merchant and service-provider scoping, segmentation, and control mapping
• NERC-CIP — critical infrastructure protection for utility operators
• CMMC — Level 1 and Level 2 readiness, mapped to SP 800-171
• SOX — IT general controls and change management for public and pre-IPO firms
• FedRAMP — advisory for cloud service providers pursuing federal customers

Frameworks are the language of compliance. They are not the point. The point is a program that would actually survive an incident and would actually pass an audit. Alex builds and advises to that standard.

Technical depth

Fifteen-plus years of hands-on multi-domain security architecture, still doing the work:

• DNS security — offense and defense. Co-developed a DNS exfiltration detection methodology deployed in customer environments. On the offensive side, ten years of practitioner-level tradecraft demonstrating DNS tunneling C2 and data exfiltration through commercial next-gen firewalls in live customer proof-of-concept engagements — the credibility comes from having built and broken it.
• Incident response. Malware, business email compromise, cryptocurrency fraud, insider events. Containment, recovery, forensic documentation, and law-enforcement coordination.
• Multi-vendor architecture. AI security, network security, cloud security across AWS / Azure / GCP, IAM (Okta, Duo, Ping, Active Directory, RSA), SIEM/SOAR (Splunk, ELK), endpoint and XDR (CrowdStrike, Carbon Black), zero trust, data protection.
• AI security. Governance framing for boards, technical review of LLM and agentic deployments, and hands-on delivery of production agentic AI infrastructure with MCP tool integrations.

Teaching and mentorship

Teaching is not a side project for Alex — it is the through-line of a thirty-year career. Three decades of training and mentoring technical people, and almost twenty of those years leading seminars and workshops focused on what he calls the most important aspect of cybersecurity: the human element. Presenting complex concepts accessibly — to executives, engineers, and end users alike — has been the core of his professional practice for most of his career. He built and led a formal training initiative for a team of security architects and has spent years mentoring architects, engineers, and early-career security professionals into senior roles.

He was selected as an inaugural instructor at his former employer's global customer conference in Boston, chosen from eight in the global field organization. He presented at RSA Conference 2022 — the first security architect from his company ever selected. He was chosen as the sole company representative for cyber intelligence at Cisco Live San Diego 2019.

That teaching orientation is the DNA of SecurityROX. The classes here — the CMMC Level 1 module, the AI compliance module, the workforce awareness module — are built the same way Alex has always taught: take the hardest concept, make it the plainest thing in the room, and hand the human on the other side something they can actually use on Monday morning.

Credentials

• CISSP — ISC2, first attained 2005, continuously active
• CRISC — ISACA, candidate
• CTIA — Certified Threat Intelligence Advisor
• Microsoft Certified Trainer (MCT) — former; delivered official Microsoft curriculum to enterprise IT and security audiences
• Citrix Certified Instructor (CCI) — former; delivered official Citrix technical training
• Microsoft Azure Fundamentals
• Google Cloud Digital Leader
• Vista Value Selling and MEDDPICC — enterprise sales qualification methodologies
• Bachelor of Business Administration, Management Information Systems — University of Houston
• Spanish — professional working proficiency

How to work with him

• Fractional vCISO — embedded advisor for an executive team that needs security judgment at the table, not another vendor at the door
• Field CISO / Advisory CISO — trusted-advisor coverage for a customer-facing security organization
• Program and architecture advisory — HIPAA, PCI, NERC-CIP, CMMC, NIST, ISO — including the readiness work in front of a 3PAO or auditor
• Incident response leadership — containment, recovery, executive communication, law-enforcement coordination
• AI security and governance — board briefings, technical assessments, agentic deployment review
• Training and enablement — SecurityROX classes plus custom, role-based workforce awareness