BRIAN BURNETTExecutive Security and Technical Leadership

Cybersecurity Leadership and Responsible AI Implementation

Experienced Cyber,
AI and Tech Executive

I help organizations turn cybersecurity and AI priorities into practical programs, clear accountability, and useful board reporting. My approach draws on security leadership at Deutsche Bank, NCEMC, IQVIA, Deloitte and BB&T, including a support program at NCEMC designed around the individual needs of 26 electric cooperatives.

Request a 3-minute intro callSend a message
Brian Burnett, cybersecurity, AI and technology executive advisor
BRIAN BURNETTTechnology. Security. Business.

EXPERIENCE ACROSS
complex, critical environments

Banking & finance
Electric utilities & IT/OT
Healthcare & life sciences
Professional services

PRACTICAL RESOURCES · BOOKS & TOOLKITS

Toolkits & Resources

Explore the Executive Cybersecurity Reporting Toolkit and my book, Building a Cybersecurity Program in the AI Era.

Explore toolkits & resources

01 / WAYS TO WORK TOGETHER

Clear scope.
Practical progress.

Start with a focused assessment, establish the foundations for responsible AI, or bring experienced security leadership into your organization on an ongoing basis. Scope, priorities and responsibilities are agreed around your needs.

Fractional CISO and advisory engagements are scoped through Legion Cyberworks.

01

Security Maturity Assessment

Who it’s for
Organizations that need a clear view of their current cybersecurity program and a practical plan for what to do next.

What’s included
Leadership and stakeholder interviews; review of agreed policies, controls and evidence; maturity assessment against an agreed framework; risk and investment prioritization; an executive findings discussion. Technical testing is included only if explicitly scoped.

You receive
A current-state assessment, prioritized improvement roadmap, executive summary, and action register with proposed owners and sequencing.

Typical timeline
3–4 weeks after kickoff and access to agreed evidence. Timing varies with organizational scope and stakeholder availability.

Discuss this package
02

AI Governance Readiness

Who it’s for
Organizations introducing AI or expanding existing AI use that need clear policies, decision rights and practical safeguards.

What’s included
AI-use and readiness review; acceptable-use policy development; use-case intake and risk review; third-party AI considerations; ownership and approval guardrails; an implementation workshop and guidance for one agreed priority use case. Production integration or deployment is separately scoped.

You receive
A tailored AI acceptable-use policy, intake and approval workflow, documented risk review, responsibility matrix, and phased implementation roadmap with guardrails and monitoring expectations.

Typical timeline
4–6 weeks for the initial readiness package. Implementation support depends on the selected use case and agreed scope.

Discuss this package
03

Fractional CISO Retainer

Who it’s for
Organizations that need ongoing security leadership, executive communication and program oversight without a full-time CISO appointment.

What’s included
A regular leadership cadence; security roadmap oversight; risk and investment prioritization; coordination with internal teams and service providers; executive and board reporting; incident-readiness planning. Response coverage and operational responsibilities are agreed explicitly.

You receive
An initial priorities plan, maintained security roadmap, risk and decision register, recurring executive updates, and board reporting at an agreed cadence.

Typical timeline
An initial 90-day planning and delivery cycle, followed by an agreed ongoing cadence. Contract terms are agreed during scoping.

Discuss this package

02 / EXPERIENCE THAT INFORMS THE WORK

An executive’s perspective.
An investigator’s discipline.

My career began investigating fraud and computer crimes. That foundation still shapes how I work: understand the evidence, ask the right questions, and focus on what matters.

Today, I bring more than 15 years of cybersecurity leadership across global banking, electric utilities, healthcare, and professional services.

15+ yearsof cybersecurity leadership
Leadership for the AI Era
Read executive bio
FRACTIONAL CISO & ADVISORY

Legion Cyberworks

Fractional CISO

Help organizations assess maturity, set security priorities, strengthen governance, and translate technical risk into decisions for executives and boards.
GLOBAL FINANCIAL SERVICES

Deutsche Bank

Chief Security Office Director
Head of Network Security Product & Delivery

Lead global network security strategy, architecture, engineering delivery, budgets, and strategic vendor relationships in a highly regulated environment.
CRITICAL INFRASTRUCTURE · 2020–2025

North Carolina’s Electric Cooperatives

Director of Cybersecurity

Cybersecurity leadership across the statewide organization and its cooperative support program.

SELECTED OUTCOMES

Programs built.
Leadership put into practice.

Selected work in program leadership, governance, and professional engagement.

01 / PROGRAM MATURITY & GOVERNANCE

A statewide program.
Individual cooperative needs.

I strengthened the statewide organization’s cybersecurity program and developed it to support 26 electric cooperatives, with assistance shaped around each cooperative’s needs as requested.

I aligned the program to CIS and provided executive and board communications to inform risk and program decisions.

What this establishedA stronger statewide foundation, a tailored support model, and leadership visibility into cybersecurity priorities.

02 / ENGINEERING & CYBER RISK

Bringing Cyber-Informed Engineering to cooperatives.

I built relationships with Idaho National Laboratory and introduced Cyber-Informed Engineering to the electric cooperatives.

The approach connects cybersecurity with engineering decisions throughout a system’s life, including how design can limit the operational consequences of a cyberattack.

What this introducedAn engineering perspective on cyber risk, alongside traditional security controls.
About CIE at Idaho National Laboratory

03 / RESPONSIBLE AI ADOPTION

From AI policy
to practical use.

I developed board-level AI policy and guidance, implemented AI tool usage and AI-enabled cybersecurity capabilities, and incorporated AI risk assessment into the work.

This connected the adoption of new tools with governance, security considerations, and executive oversight.

What this establishedA policy foundation and practical guardrails for responsible AI adoption.

CONFERENCE SPEAKING & CREDENTIALS

Industry practice. Shared knowledge.

Conference sessions, professional credentials and colleague recommendations are available in my executive profile.

EDUCATION IN PRACTICE

Teaching & mentoring

Teaching cybersecurity and digital forensics since 2011, with experience in online instruction, course development, live simulations, and student career counseling. Teaching history and education

04 / A PRACTICAL WAY FORWARD

Meet you where you are.
Build toward what’s next.

A useful strategy reflects the way your organization actually operates: its people, budget, obligations, and tolerance for risk.

  1. 01 / UNDERSTAND

    Get the full picture.

    Understand business goals, critical services, existing capabilities, and the risks creating the most uncertainty.

    A shared view of priorities
  2. 02 / PRIORITIZE

    Make the choices clear.

    Translate findings into a practical roadmap with ownership, investment choices, and a sequence your team can execute.

    A plan grounded in your resources
  3. 03 / ADVANCE

    Keep progress visible.

    Support execution, review the evidence, and communicate progress and remaining risk to leaders and the board.

    Clear accountability and reporting

START A CONVERSATION

What’s your
next priority?

What security or AI priority would you like to move forward? Send a brief message about your organization, priorities and timing.

Based in North Carolina · Available for remote advisory engagements

Share your organization, priorities and timing.

Send a message

A few practical questions.

Who is the ideal client?

Any entity across any sector that needs experienced security and AI governance leadership with a practical understanding of business constraints. I work across sectors and can also support an established leadership team through a specific initiative or transition.

When does fractional CISO support make sense?

When your organization needs experienced security leadership but may not need a full-time CISO, or when an existing team needs additional direction through growth, change, or a specific initiative. The first conversation helps establish the scope and decision-making responsibilities.

Do you work beyond banking and electric utilities?

Yes. My background also includes healthcare, life sciences, and professional services. Advisory work can support small and mid-sized organizations as well as larger enterprises, with scope tailored to their operating environment and available resources.

Can an engagement focus on one issue?

Yes. A focused engagement can address a maturity assessment, AI governance, a technology roadmap, third-party risk, incident readiness, or executive and board reporting. Ongoing advisory support can be discussed separately through Legion Cyberworks.

Analytics privacy