MSMARCOS SAIZ

Cybersecurity architect & engineering leader · Maryland

Security architecture.
Engineering impact.

I’m Marcos Saiz, a cybersecurity executive and security architect with CISO experience, combining technical depth with business-focused leadership. I design security architectures, engineer detections, and turn complex telemetry into useful cyber intelligence across Zero Trust, IT/OT monitoring, adversarial validation, and AI/LLM security assessment.

Architecture through execution

Strategy, operations, and assurance connected by leadershipLeadershipSTRATEGYOPERATIONSASSURANCE

Technical depth. Operational judgment.

Enterprise · Federal · Military
25+ YEARS IN TECHNOLOGYCISSP · CISA · CCISOSTRATEGY THROUGH EXECUTION

01 / Perspective

Architecture that connects
engineering and outcomes.

My work spans security architecture, detection engineering, cyber analytics, IT/OT monitoring, and AI/LLM security assessment, supported by executive leadership and governance.

I connect architecture, engineering, and validation so security capabilities work in practice.

I started in infrastructure and network operations, then moved into security leadership, incident response, and CISO responsibilities. That progression gives me a practical understanding of how strategic decisions affect the people delivering the work.

At Big Impact Technology, I combine hands-on architecture and engineering with technical direction, cyber operations, Zero Trust planning, and AI/LLM security assessment. I also bring experience in managed security services, executive communication, governance, and business development.

01

Security architecture
& Zero Trust

Translate mission needs into security architectures, implementation plans, and capability roadmaps aligned with NIST Zero Trust principles and CISA’s Zero Trust Maturity Model.

NIST SP 800-207 · CISA ZTMM v2 · Capability roadmaps
02

Detection engineering
& purple-team validation

Author and migrate Elastic correlation searches, map detections to MITRE ATT&CK, and lead purple-team validation with penetration testers to assess alerts and tune detection gaps.

Elastic · MITRE ATT&CK · Adversarial validation
03

Cyber analytics
& data engineering

Provide technical direction to a data product team, define cyber analytical requirements, and debug and refine SQL across table selection, array handling, and event-correlation logic to improve asset context and result quality.

SQL · Event correlation · Analytical requirements
04

IT/OT monitoring
& network detection

Design passive monitoring architectures and implementation plans integrating network detection, OT visibility, and SIEM capabilities. Approved designs have been implemented to extend security into critical operational environments.

Passive monitoring · Network detection · SIEM integration
05

AI & LLM
security assessment

Advise on security policy, monitoring, and access safeguards for internal generative AI systems. Assess AI-generated security metrics for measurement validity and NIST CSF alignment, including detection and response performance.

Generative AI safeguards · Measurement validity · NIST CSF

02 / Selected impact

From architecture
to operational capability.

Selected technical work spanning implemented monitoring architectures, validated detections, and analytics designs approved for development.

ARCHITECTURE INTO OPERATIONS

Passive IT/OT visibility

Authored passive monitoring architectures and implementation plans integrating network detection, OT visibility, and SIEM capabilities. Approved designs were implemented in operational environments.

VALIDATED DETECTIONS

Purple-team validated detections

Led targeted validation of authored Elastic detections with penetration testers, using observed alert behavior to identify and tune detection gaps.

APPROVED FOR DEVELOPMENT

Operational architecture for analytics

Authored an operational architecture that was approved for development into cyber and intelligence analytics products.

Commercial leadership results

Selected achievements from my work at TBConsulting, where I combined cybersecurity leadership with managed-services product ownership.

$2.93M

Annual services revenue

Built and led an MSSP portfolio combining product resale with 24/7 managed SIEM, EDR, and cloud-security services.

$350K

One-time cost savings

Modernized hardware-intensive deployments with lower-cost sensors, centralized cloud tooling, and right-sized storage.

72%

Faster SOW turnaround

Aligned product catalogs, pricing, sales materials, and self-validating cost sheets. The process expanded to other products.

Selected historical portfolio results, not a forecast or a claim of company-wide profit.

03 / Experience

Executive scope.
Grounded in the work.

Architecture, engineering, and leadership across commercial services and federal environments.

OCT 2025 – PRESENT

Sr. Director of Cybersecurity

Big Impact Technology

Program assignment: Senior Cybersecurity Architect. Lead architecture and technical engineering work across Zero Trust, cyber operations, analytics, IT/OT monitoring, and AI/LLM security assessment.

  • Author and migrate Elastic correlation searches, map detections to MITRE ATT&CK, and lead purple-team validation with penetration testers.
  • Provide technical direction to a data product team, define cyber analytical requirements, and debug and refine SQL correlation logic and asset context.
  • Design Zero Trust-aligned capability roadmaps and passive monitoring architectures integrating IT/OT visibility, network detection, and SIEM capabilities.
  • Advise on generative AI safeguards and assess AI-generated security metrics for measurement validity and NIST CSF alignment.
  • Develop evidence-based assessments, executive recommendations, and governance guidance; contribute technical expertise to RFP responses and qualified client and partner discussions.
MAR 2025 – JAN 2026

Manager, Cybersecurity & Risk Management

RTX BBN Technologies

Directed ISSO/ISSM teams across six sites, standardized authorization-evidence workflows, and strengthened internal assessment readiness and security monitoring.

SEP 2021 – MAR 2025

Chief Information Security Officer

TBConsulting

Led cybersecurity strategy and operations while owning a managed security services portfolio, vendor relationships, customer renewals, and product development within a SAFe program.

Led internal readiness across three SOC 2 Type 2 examination cycles, supporting two consecutive zero-exception examinations by an independent external firm.

Earlier leadership & technical foundation

Valley Metro: Information Security Lead Engineer, 2021. Oversaw outsourced SOC delivery, service measures, and security policy.

Department of the Army: Chief of Data Processing Installation, 2019–2021. Led data-center security, enterprise risk, and continuity planning.

TBConsulting: IT Operations Manager, 2018–2019. Led 24/7 managed-service operations and team development.

Earlier network and infrastructure experience with CenturyLink, the Department of Defense, EMW, and the U.S. Air Force.

Military service

U.S. Air Force veteran and current Air National Guard Cyber Systems Operator. My service includes network operations, state-agency cyber assessments, incident response, and joint cyber team leadership.

04 / Published perspectives

Ideas from practice.

I write about cybersecurity leadership, evolving threats, and the gap between frameworks and real-world execution. Read on Medium ↗

05 / Credentials & continued learning

Experience backed by
continued development.

ISC2CISSP

Information systems security

ISACACISA

Information systems auditing

EC-COUNCILCCISO

Information security leadership

Education

B.S., Technical Management, DeVry University.
A.S., Information Systems Technology, Community College of the Air Force.

M.S., Cybersecurity, Grand Canyon University, in progress. Expected June 2027.

Engineering & labs

I share public security engineering projects and technical labs on GitHub. My OSCP preparation work documents offensive-security study, separate from my professional architecture and leadership experience.

Start a conversation

Let’s talk cybersecurity
and leadership.

Connect with me about security strategy, cyber operations, governance, and building effective security services.