Mark Johnson

Background

About Mark Johnson

With more than 25 years of hands-on experience in information security, risk management, and IT infrastructure, I am dedicated to protecting organizations from evolving cyber threats and driving transformational change across the enterprise. My background spans leadership roles at industry leaders including KG & P, Cisco, BroadSoft, and URS/AECOM, where I built and led information security programs from the ground up and guided teams through fast-paced, high-stakes environments. As Information Security Officer (acting CISO) at KG & P, I established and scaled the company’s first comprehensive security program, authoring and implementing over 12 enterprise security policies and 20 NIST 800-53 Rev 5 control family policies, including pioneering AI usage and data retention policies. I’ve delivered project success by deploying advanced controls such as CrowdStrike endpoint protection (with USB and browser-based DLP enforcement) and DarkTrace behavioral analytics, while maintaining compliance with NIST, FedRAMP, and CMMC standards. My work has driven a 55% reduction in employee phishing susceptibility and helped position KG & P for federal business growth. Previously, at Cisco and BroadSoft, I led cross-functional teams in automation, vulnerability data management, and continuous monitoring, streamlining reporting through custom SQL/JIRA platforms and slashing manual effort by 85%. During my tenure with URS/AECOM, I directed multimillion dollar network upgrades, completed complex compliance audits (NIST/FISMA/HIPAA), and reduced utility costs by 35% through virtualization initiatives. I thrive in dynamic environments, collaborating with executive leadership, coaching cross-functional teams, and driving business alignment between security, technology, and growth objectives. My key competencies include regulatory compliance, policy development, incident response, security awareness, data privacy, cloud and infrastructure security, and strategic risk management. As an active member of ISC2, I continue to advance my expertise, and maintain top industry certifications (CISSP, MCSE, GSEC, FEMA ISSO, Cisco Security Ninja), and share knowledge with my peers at regional and national conferences. My mission is to create resilient, innovative security programs that enable organizations to safeguard their assets, reputation, and future while empowering teams and stakeholders to succeed.