Michael York
Technology & Infrastructure Executive · CIO / CISO
About
I lead information security and DevOps for a fintech platform serving 1,500+ financial institutions as they deliver credit and financial-wellness products to the people they serve. My work sits at the intersection of three things that don't always get along: moving fast, staying secure, and proving it to auditors, regulators, and demanding partners.
I came up through security and risk (holding the CISSP, CISA, CISM, and CRISC), but I also own DevOps, so I don't treat security as something that happens to other people's systems. I'm responsible for the pipelines, the cloud architecture, and the uptime as well as the controls that protect all of it. That dual mandate shapes how I think: the best security makes the business faster and more credible, not slower and more annoyed.
Lately I spend a lot of time on AI (as a threat and as a tool) and on the controls layer underneath it: audit trails, scoped tool authority, and the boundary between an output a system can act on and one that needs a human first.
Track record
6 security and infrastructure leadership roles since 2014, across fintech, healthcare, nonprofit, machine learning, and a publicly traded REIT. Each one owned both the build and the protect side of the estate.
- Built a security program scoring above the industry average on the NIST Cybersecurity Framework.
- Achieved and sustained SOC 2 Type II attestation and operates under a CSA STAR Level II continuous-audit posture.
- Designed and runs a multi-region AWS architecture with warm-standby disaster recovery.
- Runs the dual build-and-protect mandate (DevOps and information security under one roof) across the platform.
- Stood up AI governance for financial services: a design-time 'act vs interpret' boundary for automated decisions, mapped to NIST AI RMF, ISO 42001, and the incoming CCPA ADM rules.
Education
-
Master of Information and Cybersecurity (MICS)
UC Berkeley, School of Information
-
Master of Information and Cybersecurity (MICS)
UC Berkeley, School of Information
Credentials
Certifications
- CISSP: Certified Information Systems Security ProfessionalISC2 ·
- CISA: Certified Information Systems AuditorISACA ·
- CISM: Certified Information Security ManagerISACA ·
- CRISC: Certified in Risk and Information Systems ControlISACA ·
- AWS Certified Solutions Architect - ProfessionalAmazon Web Services ·
- AWS Certified Solutions Architect - AssociateAmazon Web Services ·
- AWS Certified Security - SpecialtyAmazon Web Services ·
- AWS Certified Advanced Networking - SpecialtyAmazon Web Services ·
- AWS Certified Big Data - SpecialtyAmazon Web Services ·
- AWS Certified SysOps Administrator - AssociateAmazon Web Services ·
- AWS Certified Cloud PractitionerAmazon Web Services ·
- Microsoft Certified: Azure Solutions Architect ExpertMicrosoft ·
- Microsoft 365 Certified: Enterprise Administrator ExpertMicrosoft ·
- Microsoft Certified: Azure Administrator AssociateMicrosoft ·
- Microsoft Certified Systems Engineer: Security (MCSE)Microsoft ·
- Microsoft Certified Trainer (MCT)Microsoft ·
- CompTIA Network+CompTIA ·
- CompTIA Linux+CompTIA ·
- CompTIA A+CompTIA ·
- CompTIA CTT+ (Certified Technical Trainer)CompTIA ·
- Apple Certified Macintosh Technician (ACMT)Apple ·
- SAP Certified Application Associate - SAP S/4HANA Cloud (Finance)SAP ·
- Sage Business Cloud Accounting CertificationSage ·
- QuickBooks CertificationIntuit ·
Professional affiliations
- Cloud Security AllianceWorking Group Member, CxO Trust · since 2021
- (ISC)²Member · since 2010
- ISACA Silicon Valley ChapterMember · since 2010
- InfraGardMember · since 2018
Skills
Information Security · DevOps · Cloud Security Architecture · Governance Risk & Compliance (GRC) · Security Operations & Automation · Threat Intelligence & Threat Modeling · Incident Response · AI Governance · Vendor & Third-Party Risk · SOC 2 Type II · CSA STAR Level II · NIST CSF · HITRUST r2 · FedRAMP Moderate · DoD SRG · CMMC · CJIS · ITAR · PCI DSS 4.0 · SOX · ISO 27001 · HIPAA · CCPA · GDPR · Multi-Region AWS · Terraform · Board- & Investor-Level Risk Reporting
Privacy
This is a personal site. The short version: I collect the minimum needed to reply to you or send what you asked for, analytics only run if you opt in, nothing follows you across other sites, and I don't sell your data.
- Contact form
- Your name, email, and message are sent to me by email (via Resend) so I can reply. They aren't stored in a database beyond what's needed to deliver the message and prevent abuse. Cloudflare Turnstile screens for bots. It doesn't set tracking cookies.
- Newsletter
- If you subscribe, your email is stored on Cloudflare (D1) and used only to send Field Notes. Sign-up is double opt-in (you confirm first), and every issue has a one-click unsubscribe. Sending is handled by Resend.
- Ask Michael (AI)
- Questions you type are sent to Cloudflare Workers AI to generate an answer grounded in this site's public content. Conversations aren't stored or used to train models. The chat is rate-limited and bot-protected.
- Cookies & local storage
- First-party storage: your theme choice, your cookie-consent decision, and (if you allow it) anonymized thumbs-up/down on AI answers. No advertising and no cross-site tracking. Global Privacy Control (GPC) is honored.
- Analytics
- Google Analytics runs only if you turn Analytics on in the cookie banner. It is off by default, and all it records is which pages get viewed. Google's advertising features (Google Signals, ad personalization) are disabled, and IP addresses are anonymized. It never loads if your browser sends a Global Privacy Control or Do Not Track signal, even with consent stored. Turn it off in the banner and collection stops and its cookies are deleted from your browser.
- Your data, your rights
- Your information is never sold or shared, and is used only for the purpose you provided it. To access, correct, or delete anything, email michael@ypro.dev and I'll handle it promptly.