Security architecture · cloud security · platform design
Security design.
Practical proof.
I bring enterprise security experience to practical control design. I led System and Organization Controls 2 (SOC 2) audit readiness for IBM Cloud teams and coordinated hardware security module (HSM) vulnerability remediation in financial services. Exposure Control shows how I translate that experience into an AI-assisted, synthetic security platform.
- Enterprise experience
- IBM Cloud assurance and financial-services security
- Design focus
- Connect security signals, business context, and controls
- Independent build
- Explore Exposure Control: AI-assisted, synthetic, non-production
“Alfe is a skilled security and compliance professional.”
“His work is meticulous and conclusions are well-developed.”
Start here
My work. Two perspectives.
Review my enterprise experience or my independent project.
Enterprise experience
Cross-team vulnerability leadership
From open-source software (OSS) and containers to applications and infrastructure: coordinating owners, technical context, urgent work, and evidence.
Read case study →Synthetic reference implementationExposure Control
I developed this AI-assisted project to explore prioritization, ownership, and closure. The data is synthetic. It is not a production client implementation.
Explore technical work →Questions about my synthetic project? Open ASTA Guide
Consulting
Security expertise. Practical delivery.
I help organizations turn security findings into coordinated action, with clear ownership, usable data, and practical remediation plans.
Available for paid project-based or hourly consulting, and W-2 contract assignments. We agree on objectives, deliverables, responsibilities, and authorized access before work begins.
Share your goals and project needs. Keep credentials and sensitive data out.
Lead cross-team vulnerability campaigns and urgent remediation coordination
Reconcile application, ownership, and vulnerability data into actionable dashboards
Assess cloud and application security designs and recommend practical improvements
Improve remediation workflows, reporting, documentation, and team enablement
Experience and credentials
Experience and results.
Professional credentials
ISC2 CISSP and Microsoft Certified: Azure Fundamentals.
Selected experience
Experience in finance, technology, and U.S. Navy submarine service.
Alfe Corona · Selected experience
Work delivered at each organization.
Remediation coordination, audit readiness, and testing documentation.
- Wells Fargo
I coordinated HSM vulnerability remediation and documented an application-vulnerability process with technical owners, deadlines, status, and escalation paths.
- IBM
I led SOC 2 audit readiness for IBM Cloud’s Cloud Shell, CLI, and Developer Experience teams, working with engineers and PwC auditors.
- Google
I created a step-by-step email QA guide for Google Maps Local Guides with developers and the program manager.
- U.S. Navy
I maintained 99.6% inventory validity. Also earned the Navy and Marine Corps Achievement Medal.
Professional recommendations
What colleagues and leaders say.
Perspectives from people who have managed my work or collaborated with me.
Caryn Woodruff
Former direct manager
“Alfe is a skilled security and compliance professional. He possesses excellent problem-solving and analytical skills and is able to effectively identify and mitigate potential risks and vulnerabilities.”
Ami Diaz, CRISC, CDPSE
Former direct manager
“His work is meticulous and conclusions are well-developed. He also shares insights and best practices with his peers. He was a great asset to the team.”
Ryan Inagaki
Former colleague
“During his tenure, I was consistently impressed by his deep understanding of the industry's best practices and regulations.”
Joel Pichardo
Cybersecurity peer
“Alfe is the kind of cybersecurity expert you hope to have on your team.”
Operator perspective
How I coordinated vulnerability work.
At Wells Fargo, I led vulnerability-remediation coordination across 8–15 teams at a time, spanning OSS, containers, repositories, applications, and infrastructure.
I connected technical findings with accountable owners, investigated Prisma–Qualys reporting differences, and escalated urgent blockers. I also improved repeatable reporting workflows and trained colleagues.
- Technical owner
- Identified
- Remediation date
- Agreed
- Status and escalation
- Documented
- Remediation and validation
- Status reconciled
Security leadership perspectives
CyberTainment TV
Videos on vulnerability priorities, remediation ownership, and the evidence needed to confirm closure.
Watch the series on YouTubeFeatured episode
Why Your Vulnerability Spreadsheet Is the Breach.
ExploitabilityAffected systemsValidation checksWatch episodeApproach
How I work.
I review finding evidence and business context, agree on remediation owners and next steps, and check whether the closure criteria were met.
Connect findings to assets and owners
Check evidence before escalation
Prioritize by exploitability and business impact
Agree on owners, deadlines, and closure checks
Direct answers
How prioritization and closure work.
What is cyber exposure architecture?
In this portfolio, cyber exposure architecture connects vulnerability findings to affected assets, business importance, controls, and remediation owners. Exposure Control demonstrates these links with fictional data.
How do organizations prioritize vulnerabilities by business risk?
Consider exploitability, whether the asset can be reached, its business importance, data sensitivity, and existing controls. Assign an owner and use those factors to decide which findings need attention first.
How does exposure control connect engineering, architecture, and executives?
The synthetic Exposure Control project shows finding priorities, affected applications, remediation owners, and closure checks. Engineers and leaders can inspect the same records when deciding what to fix and what remains open.
What does evidence-gated closure mean?
Closure requires validation data confirming that the finding was resolved or meets an approved control criterion. Without that evidence, the finding stays open or returns to remediation.
Explore my synthetic Exposure Control project.
Connect
Start a conversation.
Tell me the role, project, or speaking topic. Include the next step. Keep confidential information out.
Send me the contextRelationship BriefPreferredConnect With MeTell me what you want to discuss. Keep it professional and non-confidential.Exposure PortfolioFeaturedexposure.alfecorona.comInspect the synthetic finding, prioritization, remediation, and closure examples.LinkedInProfessionallinkedin.com/in/alfecoronaReview my experience and connect on LinkedIn.Latest writingWritingFrom Fragmented Vulnerability Data to a Clear Remediation PlanAn article on organizing vulnerability records and remediation follow-up.EmailFallbackalfe@alfecorona.comEmail me directly.