Compliance Training That Doesn't Suck
Practical. Punchy. Sticks.
Your team clicks the wrong link. Prints CUI at Kinko's. Reply-alls the salary spreadsheet. We make training they'll actually watch — and remember.
Your team clicks the wrong link. Prints CUI at Kinko's. Reply-alls the salary spreadsheet. We make training they'll actually watch — and remember.
CMMC L1 / L2 training for the humans who touch federal contract data. Even after the July 2026 Phase 2 suspension, self-assessment stays required — and your team has to defend it.
Data-handling training for the humans who send the email, share the drive link, and hit Reply-All at the worst possible moment. Because one $3M mistake is enough.
AI-use training for the humans who paste the customer list into a public chatbot, ship the model card with the risk row still blank, or wave off ISO 42001 as "the AI team's problem." Built to NIST AI RMF and ISO 42001 — beta cohorts help shape the final curriculum.
The 17 controls that self-assessment actually cares about. One page. Post-it density.
The NIST AI RMF + ISO 42001 crossover checklist your procurement team will actually read.
Most security programs get built by people who have never sat across the table from a customer under real pressure — a breach in progress, a failed audit, a board asking why the last incident happened. Alex has spent three decades on that side of the table.
He is not a vendor pitching a platform. He is not a course marketer selling awareness training by the seat. He is the practitioner CISOs, CTOs, and CIOs hand a problem to when they need judgment, not a slide deck.
Verticals worked, deeply: healthcare and medical systems across Southern California (Scripps, Sharp, Hoag, UCI Health, Rady Children's, Banner, St. Joseph's), biopharma in San Diego, utilities in SoCal, financial institutions, gaming and entertainment, and defense contractors.
Frameworks: HIPAA, PCI-DSS, NERC-CIP, CMMC, NIST (CSF, 800-53, 800-171, 800-81r3, AI RMF), ISO 27001, ISO 42001, SOX, FedRAMP. Frameworks are the language of compliance — the point is a program that would actually survive an incident and actually pass an audit. Alex builds and advises to that standard.
Technical depth: DNS security (offense and defense — ten years of practitioner-level tradecraft demonstrating DNS tunneling exfil through commercial next-gen firewalls in live customer POCs), incident response leadership (malware, business email compromise, cryptocurrency fraud), multi-vendor architecture across AI security, network, cloud (AWS/Azure/GCP), IAM, SIEM/SOAR, XDR, and zero trust.
Teaching is the DNA of SecurityROX. Thirty years of training and mentoring technical people, and almost twenty of those as a seminar leader focused on the human element — the most important aspect of cybersecurity. Former Microsoft Certified Trainer (MCT) and Citrix Certified Instructor (CCI). Presenting complex concepts accessibly has been the core of his professional practice for most of his career, and he has built and led a formal training program for a team of security architects. The classes here — CMMC Level 1, AI compliance, workforce awareness — are built the same way: take the hardest concept, make it the plainest thing in the room, hand the human on the other side something they can use on Monday.