Chris Day

Security leader. GRC and offensive security.Offensive security lead. Penetration tester.

Read this page as

Where offensemeets governance.

I build security programs that hold up under audit because they were tested first. 90+ authorizations carried to a decision on controls built once and inherited everywhere. U.S. Air Force veteran.I break things so the controls that protect them get better. 100+ penetration tests across web, mobile, SaaS, and enterprise, each finding written so the fix actually lands. U.S. Air Force veteran.

Message me on LinkedIn

How I workRules of engagement

Switch to offense for the rules I test by.Switch to governance for the principles I build programs on.

  1. A control is only real if it holds under test.

    Policies describe intent. Testing proves it. Before I accept a control as implemented, I want evidence it survived someone actively trying to break it.

    In practice// see B-5: Authorizing aircraft that fly three classification levels at once

  2. Build it once. Let everything else inherit it.

    Across 90+ authorizations the lesson was inheritance. Prove a common control baseline once and every new system draws from it. That cut package burden by about 83 percent.

    In practice// see B-1: Cutting a 352-control baseline down to 60 per system

  3. Get access. Collect the evidence yourself.

    Evidence requests slow engineers down and arrive stale. I get read access and pull evidence directly, with queries I can rerun every audit cycle.

    In practice// see B-4: Dashboards that caught what people missed

  4. Leave a program that runs without you.

    Runbooks, registers, and automation outlast any one person. A parameter changes in one place and flows to every document that uses it.

    In practice// see B-2: Real-time package health instead of quarterly surprises

  1. Every finding is a control that failed.

    I have led more than 100 penetration tests. A finding is half the job. I write it so the fix lands in the control framework, not just the ticket queue.

    In practice// see ENG-04: Closing the gap the network scanner could not see

  2. Prove impact, not presence.

    A scanner reports a version number. A tester shows what an attacker can do with it. Then I brief that impact in the words a CISO acts on.

    In practice// see ENG-03: ~200 vulnerabilities across 100+ applications

  3. Start where the last test ended.

    Prior findings are free reconnaissance. I map them to current test IDs before testing starts, so the hours go into new ground.

    In practice// see ENG-01: 32 prior findings triaged in under 20 minutes

  4. Grow the next operator.

    Tradecraft compounds when it is shared. I review every report, coach the leads around me, and build on-ramps into testing.

    In practice// see ENG-06: A coordination gap turned into a talent pipeline

Field notesEngagement log

Programs I built or fixed: the problem, what I did, and what changed. Clients are not named.Selected engagements: the target, the objective, and the outcome. Clients are not named.

  • Federal agencyB-12024 to 2025[2024..2025] Federal agency

    Cutting a 352-control baseline down to 60 per system

    Challenge
    A NIST SP 800-53 Rev. 4 to Rev. 5 transition landed on top of a common control program. Every new system meant analysts re-reviewing controls the program already owned.
    Action
    Took the common control program through its own ATO and right-sized controls against real program risk, so new systems could inherit them.
    Result
    The 352-control Moderate baseline dropped to ~125 after facility, datacenter, and privacy common controls absorbed ~227. System-level common controls across SaaS cut the remaining ~125 to ~60 per application. The A&A team of 10 delivered 15 ATO packages and moved all 49 systems to Rev. 5.

    Role// role: Agile Defense, Program Manager

    // ATO Authority to Operate. The formal decision that a system is secure enough to run.

    // A&A Assessment and authorization. The process that leads to an ATO.

  • Federal agencyB-22024 to 2025[2024..2025] Federal agency

    Real-time package health instead of quarterly surprises

    Challenge
    Nobody could see the state of authorization packages until something was already late: missing artifacts, misclassified systems, overdue POA&M milestones.
    Action
    Built an automation tool on Power Query and the CSAM API that gave the A&A team a live view of every package.
    Result
    Missing artifacts, misclassified systems, overdue POA&M milestones, and aged findings surfaced on their own, with the system owners who needed a nudge.

    Role// role: Agile Defense, Program Manager

    // A&A Assessment and authorization. The process that leads to an ATO.

    // POA&M Plan of action and milestones. The tracked list of open security weaknesses and their fix dates.

  • $45M federal cybersecurity programB-32024 to 2025[2024..2025] $45M federal cybersecurity program

    Two contracts, 19 people, and a margin that held

    Challenge
    Two GRC and configuration management contracts, each with its own stakeholders, sat inside a five-year cybersecurity program.
    Action
    Ran both as program manager, covered vulnerability management directly through vacancies, and later carried the A&A team lead role at the same time.
    Result
    19 staff across eight contract line items, more than $2.5M a year combined, regulatory obligations met, and a 10 percent profit margin sustained.

    Role// role: Agile Defense, Program Manager

    // A&A Assessment and authorization. The process that leads to an ATO.

  • Federal security operationsB-42020 to 2021[2020..2021] Federal security operations

    Dashboards that caught what people missed

    Challenge
    Vulnerability and POA&M data sat in reports nobody could read at a glance. Patterns were invisible.
    Action
    Taught myself Splunk query language and built two dashboards from scratch, one for enterprise vulnerability KPIs and one for POA&M visibility.
    Result
    The dashboards surfaced anomalies human review had missed and directly informed an investigation that confirmed an insider threat.

    Role// role: XOR Security, Senior Penetration Tester

    // POA&M Plan of action and milestones. The tracked list of open security weaknesses and their fix dates.

  • U.S. Air Force programsB-52010 to 2020[2010..2020] U.S. Air Force programs

    Authorizing aircraft that fly three classification levels at once

    Challenge
    Special mission and executive aircraft carried segregated Unclassified, Secret, and TS/SCI networks joined by cross-domain solutions.
    Action
    Managed security authorization as ISSO and later ISSM, and took over planning and execution of all annual testing for the fleet.
    Result
    About 25 ATOs across 6 aircraft, plus a ground station, four UAVs, and their ground systems.

    Role// role: Booz Allen Hamilton, ISSO to ISSM

    // ISSM Information System Security Manager. Owns security authorization for a portfolio of systems.

    // TS/SCI Top Secret, Sensitive Compartmented Information. The highest common U.S. classification level.

  • Mobile application testingENG-012025 to 2026[2025..2026] Mobile application testing

    32 prior findings triaged in under 20 minutes

    Target
    Android and iOS applications on a recurring test cycle, each assessment starting from a blank MASVS checklist.
    Objective
    Stop throwing away what earlier engagements found. Built an AI-assisted pre-assessment that analyzes the APK statically and dynamically and maps open prior findings to current MASVS test IDs.
    Outcome
    On one assessment it triaged 32 prior findings in under 20 minutes and handed testers a pre-scoped plan with evidence before manual testing began.

    Role// role: OnDefend, Lead Penetration Tester

    // MASVS OWASP Mobile Application Security Verification Standard.

  • Commercial client, PCI DSSENG-022025 to 2026[2025..2026] Commercial client, PCI DSS

    Three cardholder data environments nobody had mapped

    Target
    Five applications assigned to my team when the client shifted its program to PCI DSS penetration testing.
    Objective
    Scope it right before testing anything. Led the scoping effort and traced where cardholder data actually flowed.
    Outcome
    Identified 3 distinct CDEs, delivered a CDE map to the wider program, and coached the 3 other pod leads on PCI DSS scoping.

    Role// role: OnDefend, Lead Penetration Tester

    // PCI Payment Card Industry Data Security Standard. The security rules for systems that handle card data.

  • Four government clientsENG-032020 to 2021[2020..2021] Four government clients

    ~200 vulnerabilities across 100+ applications

    Target
    More than 100 web and SaaS applications across four government clients.
    Objective
    50+ adversarial assessments, then briefing the findings to client leadership on calls of 30+ people, CISOs and directors included.
    Outcome
    About 200 vulnerabilities uncovered, framed in the risk and remediation terms decision-makers needed to act on.

    Role// role: XOR Security, Senior Penetration Tester

  • Federal clientENG-042020 to 2021[2020..2021] Federal client

    Closing the gap the network scanner could not see

    Target
    A federal client's web applications, covered only by network and OS scanning that missed application-layer flaws.
    Objective
    Close a contractual gap in the testing program. Drafted a penetration testing framework with the government lead, introduced Burp Suite Enterprise, wrote the SOPs, and negotiated rules of engagement.
    Outcome
    5 web applications onboarded into a continuous cadence: automated monthly scans plus regular manual assessments.

    Role// role: XOR Security, Senior Penetration Tester

  • Global security initiativeENG-052022 to 2024[2022..2024] Global security initiative

    A testing program for 10,000+ devices in 8 countries

    Target
    A $300M+ security initiative spanning more than 10,000 devices across 8 countries.
    Objective
    Architect a global vulnerability testing program, centralize the risk data, and pick tools that actually see the estate.
    Outcome
    Scanning coverage up about 45 percent and operating costs down 25 percent.

    Role// role: KPMG, Solution Architect

  • Fortune 100 bankENG-062022 to 2024[2022..2024] Fortune 100 bank

    A coordination gap turned into a talent pipeline

    Target
    A global testing program with no structured way to coordinate assessments.
    Objective
    Build the coordination workstream from scratch, codify it in a runbook, and design it as an entry point for junior testers.
    Outcome
    Assessments ran on a repeatable path, and at least four coordinators moved into penetration testing roles.

    Role// role: KPMG, Solution Architect

One finding, three audiencesFrom exploit to fix

The same problem has to land with an auditor, an engineer, and a board. Pick a finding to see how I'd say it to each.Pick a finding. See how an attacker uses it, what proof I capture, and what closes it.

Attacker's view

T1078.001 Valid Accounts: Default Accounts

Try the vendor's documented login on every management interface found during recon.

Proof I capture

An authenticated admin session, captured with the exact request and timestamp.

To the auditor

  • IA-5 Authenticator Management
  • CM-6 Configuration Settings

Evidence that closes it: Configuration baseline scan showing no default accounts; credential inventory with rotation dates.

To the engineerFix

The vendor default login works on the management interface. Rotate it, enforce a password policy, and add the setting to the hardened build.

To the boardImpact, in one line

Anyone who read the vendor manual could have logged in as an administrator.

Control IDs come from NIST SP 800-53 Rev. 5, the federal catalog of security controls that most frameworks map back to.

// Technique IDs come from MITRE ATT&CK, the public catalog of how real attackers operate.

ExperienceOperator history

A career braided between two disciplines. Each move into one made me better at the other.Where I have tested, what I tested with, and who I trained along the way.

Career[ timeline ]

  1. Quartermaster AIGRC Manager2026 to now
  2. OnDefendLead Penetration Tester2025 to 2026
  3. Agile DefenseProgram Manager2024 to 2025
  4. KPMGSolution Architect, Application Penetration Testing2022 to 2024
  5. XOR SecuritySenior Penetration Tester2020 to 2021
  6. Booz Allen HamiltonForensics engineer to ISSM and Solution Architect2010 to 2020

90+

ATOs carried to a decision across 75+ systems, built on inherited controls.

How this is counted--source

Authorization packages taken to an authorizing official, 2010 to 2025. Includes about 25 ATOs for Air Force airborne platforms and 15 packages at Agile Defense.

~83%

Less control burden per system, from 352 Moderate baseline controls down to ~60 through two layers of inheritance.

How this is counted--source

NIST SP 800-53 Moderate baseline starts at 352 controls. Facility, datacenter, and privacy common controls absorbed ~227. System-level common controls across SaaS reduced the remaining ~125 to ~60 per application.

60

Controls per system after two layers of inheritance cut a 352-control Moderate baseline by ~83%.

How this is counted--source

Common Control Program at Agile Defense. Facility, datacenter, and privacy controls absorbed ~227 of 352; system-level SaaS commonality cut the remaining ~125 to ~60.

100+

Penetration tests led across web, mobile, SaaS, and enterprise environments.

How this is counted--source

Engagements led as tester or lead. Includes 50+ adversarial assessments across 100+ applications at XOR Security and the mobile program at OnDefend.

~200

Vulnerabilities uncovered across 50+ adversarial assessments for four government clients.

How this is counted--source

XOR Security, 2020 to 2021. Findings briefed to client leadership including CISOs and directors.

5x

Managed penetration testing revenue growth at KPMG in 18 months.

How this is counted--source

From about $500K to more than $2.5M, selling NIST-aligned testing to Internal Audit clients across the firm.

Leadership

  • 19staff across eight contract line items on a $45M program
  • 10person A&A team through 15 ATO packages
  • 49systems migrated to NIST SP 800-53 Rev. 5

[ team ]

  • 3direct reports and a project manager across 5 mobile tests, all on time
  • 3pod leads coached on PCI DSS scoping
  • 4+coordinators moved into penetration testing roles

Frameworks I have worked in

  • NIST SP 800-53
  • NIST RMF
  • FedRAMP
  • ICD 503
  • ISO 27001
  • CMMC
  • PCI DSS
  • OWASP MASVS
  • Cyber Essentials

[ tradecraft ]

  • Burp Suite Enterprise
  • Static and dynamic APK analysis
  • iOS and Android testing
  • Splunk SPL
  • Tenable.sc
  • Claude Code
  • OWASP MASVS
  • PCI DSS scoping

Environments

  • Airborne platforms with cross-domain networks
  • Federal enterprise and cloud
  • FedRAMP Moderate SaaS
  • Common control programs across 49 systems

[ targets ]

  • 100+ web and SaaS applications
  • iOS and Android applications
  • A 10,000+ device estate across 8 countries
  • Cardholder data environments

Credentials

CISSP
Certified Information Systems Security Professional
PMP
Project Management Professional
GXPN
GIAC Exploit Researcher and Advanced Penetration Tester
GPEN
GIAC Certified Penetration Tester

[ certs ]

GXPN
GIAC Exploit Researcher and Advanced Penetration Tester
GPEN
GIAC Certified Penetration Tester
CISSP
Certified Information Systems Security Professional
PMP
Project Management Professional

Education[ education ]

  • M.S., Information Security AssuranceGeorge Mason University
  • B.S., Information System Security EngineeringAmerican Public University

U.S. Air Force veteran.

Then ten years at Booz Allen securing Air Force special mission and executive airborne platforms, ground stations, and enterprise cloud. Four promotions, from hardware forensics to ISSM.

The first 90 days of a security programHow I run an engagement

How I start when a program is new or needs a reset. Offense first, so the governance that follows is built on what is actually true.Three phases, every time. The report is the product, so it starts on day one.

  1. Days 1 to 30

    Get access and listen

    Read-only access to cloud, identity, and code. Meet every leader. Map what exists before changing anything.

  2. Days 31 to 60

    Test what is claimed

    An outside-in look at the attack surface. Check the controls everyone assumes are working. One risk register, ranked.

  3. Days 61 to 90

    Build the baseline once

    A common control baseline mapped to the frameworks the business needs, evidence collection automated, and a one-page report a board can act on.

  1. Phase 1

    Scope and rules of engagement

    Targets, limits, and what success looks like, agreed in writing. Prior findings mapped first, so testing starts on new ground.

  2. Phase 2

    Exploit and prove impact

    Chain findings into the path a real attacker would take. Capture evidence a skeptic cannot argue with.

  3. Phase 3

    Report, brief, retest

    Peer-reviewed findings mapped to the fix and the control. Leadership briefed in risk terms. Retest until it is closed.

Get in touchOpen a channel

I like comparing notes with founders and security leaders. LinkedIn is the fastest way to reach me.Always happy to talk tradecraft with testers, red teamers, and the leaders who fund them.

  • Compare notes on a security program
  • Talk about building a security function
  • Invite me to speak or join a panel
  • Compare notes on tradecraft
  • Talk about building a testing program
  • Invite me to a con, panel, or podcast
Message me on LinkedIn

When to call me

  1. Build your compliance program from scratch.

    Customers or regulators require a framework, and there is no program behind it yet.

    Done before: 90+ authorizations carried to a decision, with controls built once and inherited across 75+ systems.

  2. Build your security program from zero.

    You are hiring your first security leader and need policy, testing, and a team stood up in the right order.

    Done before: Led 19 staff on a $45M program and took a 10-person team through 15 authorization packages.

  3. Turn security risk into board decisions.

    Your board hears about security in jargon, or not at all, and cannot tell what to fund.

    Done before: Findings briefed to client leadership, CISOs and directors included, in risk terms they acted on.

  4. Stand up an offensive testing program.

    You want to know what an attacker would find before a customer or an auditor does.

    Done before: 100+ penetration tests, and a testing program for 10,000+ devices in 8 countries.

  1. Stand up an offensive testing program.

    You want to know what an attacker would find before a customer or an auditor does.

    Done before: 100+ penetration tests, and a testing program for 10,000+ devices in 8 countries.

  2. Build your security program from zero.

    You are hiring your first security leader and need policy, testing, and a team stood up in the right order.

    Done before: Led 19 staff on a $45M program and took a 10-person team through 15 authorization packages.

  3. Build your compliance program from scratch.

    Customers or regulators require a framework, and there is no program behind it yet.

    Done before: 90+ authorizations carried to a decision, with controls built once and inherited across 75+ systems.

  4. Turn security risk into board decisions.

    Your board hears about security in jargon, or not at all, and cannot tell what to fund.

    Done before: Findings briefed to client leadership, CISOs and directors included, in risk terms they acted on.

Open to full-time security leadership roles, and happy to have an advisory conversation.

Message me on LinkedIn