About
For more than 20 years I have designed risk and compliance programs at global financial institutions, usually from a blank page: a regulatory change program covering 300+ regulations, a firm's first technology risk reporting function, a policy office, a GRC model for a 5,000-person division.
The governance chain grew out of that work. At every firm the pattern was the same: compliance kept the regulations, the policy office kept the policies, risk kept the taxonomy, controls teams kept the controls, and audit kept the findings. Each was rigorous on its own. No one could see across them. The chain is the line that connects them, and the basis of a new way of working for risk and control functions.
Today I am Director, Governance Risk & Compliance at American Express in New York.
Each function keeps its own tools. One shared structure maps between them, so every team sees the same line from rule to proof.
Run the legacy and future-state data models side by side. Big-bang migrations are where programs fail.
A control without evidence is a promise. Every link in the chain ends in something you can show a regulator.
Selected programs, most recent first.
American Express
Director, Governance Risk & Compliance · 2025 to present
Own the operational risk policy portfolio of 20+ enterprise policies, wrote the GenAI risk tiering and explainability standards aligned to SR 11-7, and am building a risk ontology that links obligations, controls and audit evidence.
BNY Mellon
Director, Engineering Control Services · 2022 to 2024
Ran policy governance for a 5,000+ person Engineering and Operations organization and linked every policy to the controls that carry it out. Mapped 50+ regulations, 100+ policies and 40,000+ controls in Archer and ServiceNow, used NLP to cut control duplication by about 15%, moved the policy platform from Clausematch to ServiceNow, and authored the firm's Code of Conduct.
Wells Fargo
Regulatory Data Architect · 2019 to 2022
Built the regulatory change management program for 300+ global technology and information security regulations from the ground up, mapping each regulation to the policies and controls that meet it, with a common obligation taxonomy and self-serve reporting used by 50+ stakeholders.
MUFG Union Bank
Technology Risk Reporting Lead · 2017 to 2018
Stood up technology and information security risk reporting in both the first and second lines of defense, with risk appetite thresholds and escalation across four governance forums, and grew reporting scope by 40%.
Moody's
Cyber Risk Reporting Manager · 2015 to 2016
Set up the enterprise cyber metrics program across NIST and SANS control domains, with executive dashboards that improved audit readiness.
Morgan Stanley
Vice President, Technology, Operational and Fraud Risk · 2007 to 2015
Built and ran the firm's Identity Theft Prevention Program under the Red Flags Rule and FFIEC guidance across four business lines, led the global operational risk metrics program for 10+ business units, and launched the policy portal that became the Enterprise Policy Office.
Goldman Sachs
Associate, Compliance · before 2007
Implemented new enterprise functions for employee personal trading and gifts and entertainment, and developed the firm's first online Code of Conduct, bringing compliance documentation from several business lines into one place.
Email is the fastest way to reach me.