Gauthier Cyber Advisory

About

Security as an enabler — not a barrier.

I build security programs that work — ones that pass audits, enable growth, and actually get adopted by the teams they’re meant to protect.

With 25+ years of experience spanning network engineering, cloud infrastructure, application security, DevSecOps, compliance, and executive leadership, I bring a full-stack perspective that lets me engage credibly from the boardroom to the build pipeline. I’m equally comfortable presenting risk posture to a board as I am architecting a cloud security control or building an AI-powered security workflow.

Today I lead SideChannel’s vCISO delivery practice — overseeing a team of consultants delivering fractional CISO services to 40+ clients across a broad range of industries — while also advising clients directly, working hands-on to build and mature security programs across technology, manufacturing, hospitality, and higher education.

A consistent theme across my career: I show up where organizations need to build something. Whether that’s founding a security program at Wayfair, building Scout Exchange’s SOC 2-compliant security practice from scratch, or guiding a national manufacturer to completely remediate repeated failed penetration tests showing full-domain compromise — I build things that last.

I’m now focused on helping organizations navigate the AI era — both governing AI risk responsibly and deploying AI to make security programs smarter and more efficient. I've completed ISO 42001 (AI Management Systems) and ISO 31000 (Risk Management) training and actively build AI-powered tooling to enhance security delivery. I also contribute to the ISC² CISSP exam development process and co-authored “The Six Pillars of DevSecOps” for the Cloud Security Alliance.

“The brakes on a car are what allow it to go fast — without them, you drive fast but recklessly, endangering yourself and everyone around you. The right security program works like the brake pedal: invisible in daily use, instinctual for the people who rely on it, yet hiding vast complexity behind something deceptively simple.”

— Eric Gauthier

Security Program Design

End-to-end builds grounded in NIST CSF and ISO 27001 that pass audits and get adopted.

DevSecOps Integration

Embedding security throughout the SDLC with DAST/SAST/SCA scanning and CI/CD hardening.

AI Governance

ISO 42001-based programs and frameworks for responsible, secure AI adoption.

Risk & Compliance

SOC 1/2, PCI-DSS, GDPR, ISO 27001 — audit-ready programs that drive revenue.

Cloud Security (AWS)

Infrastructure-as-code, container and serverless hardening, AWS cost governance.

Incident Response

Led major IR efforts — reduced median resolution from 1 week to 1 day at Lightcast.

Featured Writing

Published thinking on security practice.

A couple of pieces worth a read — one on rethinking phishing defense, one a foundational contribution to DevSecOps practice.

Article

The Problem with Phishing

Why user-blaming falls short as a phishing defense — and how DMARC, email gateway controls, and rethinking internal email entirely stop attacks at the source.

SideChannel Blog Read article →

Research Paper

The Six Pillars of DevSecOps: Pragmatic Implementation

Co-authored for the Cloud Security Alliance — a framework-agnostic model for implementing DevSecOps in practice, covering team structure, culture, and the technologies that underpin it.

Cloud Security Alliance View paper →

Expertise

Security that gets adopted — not worked around.

That means embedding it into the culture, the pipeline, and the default — not bolting it on at the end and hoping it sticks.

Security Program Design & Execution

Building programs from the ground up or maturing existing ones — policy, governance, and operations that pass audits and actually get adopted by the teams they protect.

Risk & Compliance Leadership

NIST CSF/SSDF, ISO 27001, SOC 1/2, PCI-DSS, GDPR. Translating audit requirements into prioritized, business-aligned roadmaps rather than checkbox exercises.

AI Governance & Strategy

ISO 42001-based governance frameworks for organizations adopting AI — balancing responsible risk management with practical, secure deployment.

Cloud Security & Zero Trust Architecture (AWS)

Infrastructure-as-code, container and serverless hardening, and Zero Trust design for cloud-native environments with no legacy perimeter to fall back on.

DevSecOps & Application Security

Embedding security throughout the SDLC — automated DAST/SAST/SCA scanning, secure design checklists, and CI/CD pipeline integration that engineering teams actually use.

Incident Response & Board Communication

Leading response efforts across endpoint compromise, BEC, and targeted attacks — then translating risk posture clearly for boards and executive leadership.

Expertise

Frameworks & Technologies

Equally at home in a board meeting, a risk assessment workshop, and a CI/CD pipeline review.

Certifications & Credentials

CISSP

ISO 42001 — AI Management Systems

ISO 31000 — Risk Management

ITILv3

ISC² CISSP Exam Development Contributor

Co-author — “The Six Pillars of DevSecOps,” CSA

InfraGard Member

CSA DevSecOps Working Group

Compliance & Standards

NIST CSFNIST SSDFNIST 800-53ISO 27001ISO 42001ISO 31000SOC 2PCI-DSSGDPRCCPACSA CCMCIS Controls

Security Governance

Security Program DesignRisk AssessmentThird-Party Risk MgmtVendor ManagementSecurity PolicySecurity Awareness TrainingBoard & Executive ReportingAudit ReadinessBusiness ContinuityDisaster RecoverySecurity Committee Leadership

Security Operations & AppSec

SIEMDAST / SAST / SCAEDR / XDRCASB / DLPVulnerability MgmtThreat ModelingPenetration TestingWAF / DDoSIncident ResponseVanta GRC

Cloud, Infrastructure & DevSecOps

AWSDockerServerlessInfrastructure as CodeCI/CDKubernetesDevSecOpsGoogle Workspace

Experience

25 years across security, infrastructure & engineering leadership.

A track record built at some of the web’s largest platforms and SaaS companies. Scroll to explore.

2023–Present

2020–2022

2016–2020

2013–2016

2011–2013

2001–2011

Jan 2023 – Present

VP of Cybersecurity Services & vCISO

SideChannel Security

Lead SideChannel’s vCISO delivery practice — overseeing a team of 10 consultants serving 40+ active clients — while serving as the firm’s named CISO. Promoted to VP in January 2024 after joining as Principal Consultant in January 2023.

› Details

Drove a multi-year security transformation at a large U.S. manufacturer, reversing consecutive annual pen test findings of full domain compromise — including exfiltration of all password hashes and sensitive PII — to verified remediation of all critical and high-risk vulnerabilities by year three, improving NIST CSF/CIS scoring from ~25% to over 75%
Guided a billion-dollar online marketplace through SOC 2 certification and implementation of a threat modeling program, security champions program, and third-party risk review process — maturing their InfoSec program to self-sufficiency
Built a complete security program from scratch for an early-stage AI startup — full policy suite, EDR/XDR deployment, AWS and Google Workspace hardening, Vanta GRC implementation, and simultaneous SOC 2, ISO 27001, and ISO 42001 readiness
Led multiple major incident response efforts across clients, spanning endpoint compromise, BEC, financial fraud, and targeted attacks on executive leadership
Reduced attack surface at a national hospitality company by cutting active user accounts from 5,000+ to approximately 1,000; implemented third-party risk management, access reviews, and a security awareness program
Pioneered AI-augmented delivery — building Claude-based assessment skills and AI-generated first-pass roadmaps, driving team adoption ahead of formal rollout
Analyzed ~750 client assessments over three years to build a statistical benchmarking model: clients average a 50% improvement in control scores within their first year of engagement
Designed and launched the firm’s updated Cybersecurity Strategy Assessment offering end-to-end, and contributed to a new Private Equity portfolio services model

Aug 2020 – Dec 2022

VP, Infrastructure & Security

Lightcast (formerly Burning Glass Technologies)

Led global IT, infrastructure, and security for a labor market analytics SaaS company, with an explicit mandate to build the organization’s holistic security program from the ground up.

› Details

Improved incident response process, reducing median time to resolve critical/high events from one week to one day and eliminating 90%+ of open historical alerts
Reduced cloud and on-premises hosting costs by 25% through tooling consolidation, data center contract renegotiation, AWS tagging and budget monitoring, and infrastructure right-sizing
Conducted an internal security assessment using the NIST CSF and built a prioritized security improvement roadmap from the resulting maturity model

Sept 2016 – Aug 2020

Information Security Officer / Director of Technology

Scout Exchange

Built and led the security program for a cloud-based SaaS recruiting marketplace, operating at the intersection of security governance, DevOps, and compliance.

› Details

Built Scout’s security program from the ground up; repeatedly passed SOC 1 and SOC 2 audits and drove revenue by enabling the sales team to close contracts with major banks, healthcare organizations, and multinationals
Architected corporate security controls on a Zero Trust model — CASB/DLP, device hardening, identity lifecycle management, and just-in-time provisioning — for a cloud-native SaaS environment with no legacy perimeter to fall back on
Implemented an AppSec program using a Security by Design model, embedding controls throughout the SDLC including design checklists, automated DAST/SAST/SCA scanning, pipeline and merge requirements, and hardening benchmarks
Transitioned infrastructure to full infrastructure-as-code, containers, and serverless execution on AWS, underpinned by a fully automated CI/CD pipeline
Established a formal risk assessment cadence using NIST CSF and CSA CAIQ, maintained full GDPR compliance, and drove prioritized remediation roadmaps from structured control gap analysis

Oct 2013 – Sept 2016

Director of Infrastructure & Security

ShoeBuy.com

Built ShoeBuy’s security program from scratch, directing the full scope of infrastructure and information security for the e-commerce platform.

› Details

Built ShoeBuy’s security program from scratch and passed a third-party PCI DSS compliance audit, deploying a comprehensive SIEM, WAF/DDoS protection, federated identity and MFA, secure coding practices, and security awareness training
Developed ShoeBuy’s continuous integration environment and drove its adoption across the engineering organization

Nov 2011 – Sept 2013

Senior Manager of Systems Engineering

Wayfair

Founded Wayfair’s Information Security and compliance program while leading systems engineering for the company’s rapidly scaling e-commerce infrastructure.

› Details

Founded Wayfair’s Information Security and compliance program
Led a team of 20 engineers supporting Wayfair’s e-commerce infrastructure spanning 1,000+ systems, a half-petabyte of storage, networking, and data center facilities

Aug 2001 – Oct 2011

Sr. Engineer & Manager, Network Engineering & Ops

Boston University

Served as network representative on BU’s IT security team across a ten-year tenure spanning individual contributor and management roles in network engineering and operations.

› Details

Served as network representative on BU’s IT security team and disaster recovery/business continuity working group across a ten-year tenure spanning individual contributor and management roles
Developed the University’s Network Admission Control (NAC) system and authored associated design documents for Internet2’s SALSA-Netauth working group

Eric Gauthier

Security as an enabler — not a barrier.

Security Program Design

DevSecOps Integration

AI Governance

Risk & Compliance

Cloud Security (AWS)

Incident Response

Published thinking on security practice.

Security that gets adopted — not worked around.

Security Program Design & Execution

Risk & Compliance Leadership

AI Governance & Strategy

Cloud Security & Zero Trust Architecture (AWS)

DevSecOps & Application Security

Incident Response & Board Communication

Frameworks & Technologies

25 years across security, infrastructure & engineering leadership.

Let’s connect.