Andrew Black
Chief Information Security Officer
Cyber risk and resilience across healthcare, defense, and the federal enterprise.
Andrew Black is a cybersecurity executive who builds and leads security programs across highly regulated healthcare, defense, and federal environments. His work spans enterprise cyber risk, resilience, security architecture, organizational leadership, and federal assurance.
As CISO of the federal health services division of a Fortune 3 healthcare enterprise, he is accountable for cybersecurity strategy, risk, and compliance across programs serving the Department of Defense, Department of Veterans Affairs, HHS, and CMS. He transformed the division's security program from recurring conditional authorizations into its first multi-year federal ATOs, backed by clean SOC 1 and SOC 2 Type II reports — removing security as a constraint on federal growth. He has also taken programs through some of the federal government's most demanding assessments, including DIBCAC High and FedRAMP High Ready, with the latter listed on the FedRAMP Marketplace. He created the security architecture and supply chain risk management functions, hired or promoted every director on his leadership team, serves as the enterprise's federal cybersecurity subject-matter expert, and is the executive counterpart to agency CIOs and CISOs on audits, assessments, and incidents. He led cybersecurity preparation for the CEO's testimony before the House Veterans' Affairs Committee.
Earlier, as global head of cybersecurity engineering for a Fortune 500 life-sciences and clinical-research company operating in more than 100 countries, he took detection and response from days to minutes. Before that, he spent twelve years building DoD-accredited product security programs for connected systems deployed across Army, Navy, and Air Force installations worldwide.
Leadership
- Cyber risk and resilience
- Translating regulatory and threat risk into decisions executives and boards can act on.
- Security program leadership
- Standing up security organizations and taking established programs to audit-ready and beyond.
- Leadership development
- Building director-level teams and the functions that outlast any single leader.
- Agency engagement
- Executive counterpart to federal CIOs, CISOs, and authorizing officials on audits, assessments, and incidents.
Selected experience
- Federal assurance
- Programs taken through FedRAMP High, DIBCAC High, CMMC, and multi-agency authorization, including the first multi-year ATOs for a federal health division.
- Healthcare and defense platforms
- Secure cloud, Zero Trust, HIPAA, and SOC 2 environments serving DoD, VA, HHS, and CMS missions.
Publication
Modernizing Healthcare: Critical Insights into FedRAMP High and Cloud Transformation
Co-authored with Coalfire, 2026. FedRAMP High as the mission-assurance baseline for federal healthcare: boundary design, identity, continuous assurance, and a HIPAA–FedRAMP–CMMC control mapping.
Education and credentials
- M.Sc., Information Assurance — Norwich University (NSA/DHS Center of Academic Excellence)
- B.S., Computer Engineering — Binghamton University
- CISSP — ISC2
- CISM — ISACA
- Executive Presence and Influence — Wharton Executive Education