I’m Matt Saucedo, a cybersecurity leader who connects technical depth with business priorities. I build security programs, develop people, and turn complex risks into clear action.
Measurable improvements backed by engineering partnership, disciplined prioritization, and clear ownership.
Embedded application security across five engineering domains and expanded automated scanning across approximately 80 repositories.
Integrated secure SDLC reviews, threat modeling, and security requirements into development workflows. Used risk severity, business impact, and exploitation likelihood to guide remediation priorities and SLAs.
Partnered with engineering to reduce critical findings in the AWS EKS environment and strengthen cloud security controls.
Worked across cloud exposure, IAM, network controls, and configuration remediation using Wiz, Tenable, and AWS Inspector, translating findings into accountable engineering work.
Improved defensive controls and security operations across a distributed retail and technology environment.
Combined defensive tuning, security engineering, and operational improvements. Additional reported results included a 95% reduction in false positives and a 90% reduction in firewall-change downtime.
Established information-security and GRC practices while coordinating control remediation and audit preparation for a healthcare platform.
Built on hands-on infrastructure experience across enterprise Windows systems, networking, firewalls, virtualization, endpoint protection, and vulnerability management to turn control gaps into practical improvements.
My work sits at the intersection of people, engineering, and enterprise risk.
Connect security priorities to business impact. Give leaders clear options, practical roadmaps, and visibility into progress and tradeoffs.
Bring security into the way teams build and operate technology—from threat modeling and cloud controls to incident readiness and resilient infrastructure.
Set clear ownership, coach emerging leaders, and develop the expertise teams need. My leadership experience spans analysts, engineers, leads, and managers.
My AI experience spans security operations, enterprise access controls, and the review of new AI use cases. I focus on using AI where it adds value and putting practical safeguards around how it is adopted.
Leveraged AI capabilities within CrowdStrike EDR and ReliaQuest as part of security operations, combining platform capabilities with the team’s security expertise.
Used Palo Alto tools to understand where data was going when employees used AI tools and to restrict AI access for specific teams. Connected AI adoption with practical data visibility and access controls.
At OppFi, reviewed AI models and tools proposed by data science teams, assessed third-party AI features against company policy, and participated in security review of a customer-facing loan-process chatbot.
Worked with GitHub Copilot and reviewed AI-generated code, bringing hands-on experience with AI-assisted development to my application security background.
Start with a clear business purpose and an accountable owner. Understand what data an AI tool receives and where it goes. Match access to business need, retain human judgment for consequential decisions, and turn policy into controls that can be monitored and reassessed.
My experience includes NIST-based risk management, enterprise policies, risk registers, and security practices for distributed technology and legacy manufacturing systems. Frameworks provide a shared language for connecting that work to business priorities.
The CSF’s six functions provide a useful way to organize the breadth of my experience:
My leadership approach is to connect identified gaps to an owner, a business priority, and a measurable improvement.
Explore NIST CSF ↗The AI RMF extends the conversation beyond cybersecurity to the trustworthiness and impacts of AI. Its four functions offer a structure for the principles I bring to AI adoption:
My experience reviewing AI tools against policy, monitoring AI-related data movement, restricting access by team, and reviewing Copilot-generated code provides practical foundations for this approach.
Explore the NIST AI RMF ↗Security leadership informed by the realities of running infrastructure, supporting product teams, and operating complex environments.
Led Application Security, Security Engineering, and Security Operations. Managed a seven-person team and $2M budget, with responsibility for program priorities, incident response, and technical risk reduction.
Partnered with GRC on SOX, PCI, Federal Safeguards, audit evidence, and risk acceptance. Presented dashboards, roadmaps, and emerging risks to leadership.
Progressed from Senior Information Security Analyst to director-level leadership across security engineering, operations, governance, and infrastructure.
Led managers and senior engineers, including a 12-person infrastructure organization. Oversaw enterprise risk practices and security architecture for distributed kiosks, embedded technology, and legacy manufacturing systems.
Built and operated foundational infrastructure and security controls. Developed security and GRC practices, supported SOC audit readiness, and introduced secure-development awareness.
I’m exploring opportunities in security leadership, security operations, and security engineering. I’m most interested in where I can contribute, build strong partnerships, and deliver meaningful results.
Based in Friendswood, Texas.