Security architecture · cloud security · platform design
Security design.
Practical proof.
I bring enterprise security experience to practical control design. I led SOC 2 audit readiness for IBM Cloud teams and coordinated HSM vulnerability remediation in financial services. Exposure Control shows how I translate that experience into an AI-assisted, synthetic security platform.
- Enterprise experience
- IBM Cloud assurance and financial-services security
- Design focus
- Connect security signals, business context, and controls
- Independent build
- Explore Exposure Control: AI-assisted, synthetic, non-production
“Alfe is a skilled security and compliance professional.”
“His work is meticulous and conclusions are well-developed.”
Start here
My work. Two perspectives.
Review my enterprise experience or my independent project.
Enterprise experience
HSM remediation coordination
Read how I coordinated HSM vulnerability work and documented application-vulnerability owners, deadlines, status, and escalation.
Read case study →Synthetic reference implementationExposure Control
I developed this AI-assisted project to explore prioritization, ownership, and closure. The data is synthetic. It is not a production client implementation.
Explore technical work →Questions about my synthetic project? Open ASTA Guide
Review scope
AI assistant permissions & boundary review.
I review what an assistant can access, what it can do, and where human approval is required.
I agree on scope, deliverables, systems, access, safe tests, and exclusions with you before testing.
Keep credentials and sensitive data out.
Review approved access and permission boundaries
Test only the agreed actions and systems
Document tested actions, observed results, and recommended fixes
Hand off findings and next steps; negotiate a retest if needed
Experience and credentials
Experience and results.
Professional credentials
ISC2 CISSP and Microsoft Certified: Azure Fundamentals.
Selected experience
Experience in finance, technology, and U.S. Navy submarine service.
Alfe Corona · Selected experience
Work delivered at each organization.
Remediation coordination, audit readiness, and testing documentation.
- Wells Fargo
I coordinated HSM vulnerability remediation and documented an application-vulnerability process with technical owners, deadlines, status, and escalation paths.
- IBM
I led SOC 2 audit readiness for IBM Cloud’s Cloud Shell, CLI, and Developer Experience teams, working with engineers and PwC auditors.
- Google
I created a step-by-step email QA guide for Google Maps Local Guides with developers and the program manager.
- U.S. Navy
I maintained 99.6% inventory validity. Also earned the Navy and Marine Corps Achievement Medal.
Professional recommendations
What colleagues and leaders say.
Perspectives from people who have managed my work or collaborated with me.
Caryn Woodruff
Former direct manager
“Alfe is a skilled security and compliance professional. He possesses excellent problem-solving and analytical skills and is able to effectively identify and mitigate potential risks and vulnerabilities.”
Ami Diaz, CRISC, CDPSE
Former direct manager
“His work is meticulous and conclusions are well-developed. He also shares insights and best practices with his peers. He was a great asset to the team.”
Ryan Inagaki
Former colleague
“During his tenure, I was consistently impressed by his deep understanding of the industry's best practices and regulations.”
Joel Pichardo
Cybersecurity peer
“Alfe is the kind of cybersecurity expert you hope to have on your team.”
Operator perspective
How I coordinated vulnerability work.
At Wells Fargo, I coordinated HSM vulnerability remediation and documented an application-vulnerability process.
I used teams’ preferred channels and weekly follow-ups.
- Technical owner
- Identified
- Remediation date
- Agreed
- Status and escalation
- Documented
- Remediation and validation
- Status reconciled
Security leadership perspectives
CyberTainment TV
Videos on vulnerability priorities, remediation ownership, and the evidence needed to confirm closure.
Watch the series on YouTubeFeatured episode
Why Your Vulnerability Spreadsheet Is the Breach.
ExploitabilityAffected systemsValidation checksWatch episodeApproach
How I work.
I review finding evidence and business context, agree on remediation owners and next steps, and check whether the closure criteria were met.
Connect findings to assets and owners
Check evidence before escalation
Prioritize by exploitability and business impact
Agree on owners, deadlines, and closure checks
Direct answers
How prioritization and closure work.
What is cyber exposure architecture?
In this portfolio, cyber exposure architecture connects vulnerability findings to affected assets, business importance, controls, and remediation owners. Exposure Control demonstrates these links with fictional data.
How do organizations prioritize vulnerabilities by business risk?
Consider exploitability, whether the asset can be reached, its business importance, data sensitivity, and existing controls. Assign an owner and use those factors to decide which findings need attention first.
How does exposure control connect engineering, architecture, and executives?
The synthetic Exposure Control project shows finding priorities, affected applications, remediation owners, and closure checks. Engineers and leaders can inspect the same records when deciding what to fix and what remains open.
What does evidence-gated closure mean?
Closure requires validation data confirming that the finding was resolved or meets an approved control criterion. Without that evidence, the finding stays open or returns to remediation.
Explore my synthetic Exposure Control project.
Connect
Start a conversation.
Tell me the role, project, or speaking topic. Include the next step. Keep confidential information out.
Send me the contextRelationship BriefPreferredConnect With MeTell me what you want to discuss. Keep it professional and non-confidential.Exposure PortfolioFeaturedexposure.alfecorona.comInspect the synthetic finding, prioritization, remediation, and closure examples.LinkedInProfessionallinkedin.com/in/alfecoronaReview my experience and connect on LinkedIn.Latest writingWritingFrom Fragmented Vulnerability Data to a Clear Remediation PlanAn article on organizing vulnerability records and remediation follow-up.EmailFallbackalfe@alfecorona.comEmail me directly.