Security architecture · vulnerability remediation
Secure by design. Focused on risk reduction.
I help teams prioritize vulnerability work, assign remediation owners, and verify closure with evidence.
- Proof
- Coordinated HSM vulnerability remediation
- Method
- Findings, affected assets, owners, validation
- Outcome
- Owners, deadlines, status, and escalation
Start here
Two ways to review the work.
Start with enterprise experience or inspect the independent synthetic implementation.
Enterprise experience
HSM remediation coordination
Read how I coordinated HSM vulnerability work and documented application-vulnerability owners, deadlines, status, and escalation.
Read case study →Synthetic reference implementationExposure Control
Inspect finding scores, remediation owners, and closure checks using fictional enterprise data. No customer or employer data.
Explore technical work →Optional guide to the synthetic project: Open ASTA Guide
Review scope
AI assistant permissions & boundary review.
A scoped review covers the systems an assistant can access, actions it can take, and steps requiring human approval.
We agree on the systems, approved access, safe test cases, and exclusions before testing begins.
Share your goals and system context, without credentials or sensitive data. Scope and deliverables are agreed for each project.
Review approved access and permission boundaries
Test only the agreed actions and systems
Document tested actions, observed results, and recommended fixes
Hand off findings and next steps; negotiate a retest if needed
Experience and credentials
Experience and results.
A summary of my experience, credentials, and selected results, with links to my résumé and portfolio for more detail.
Professional credentials
ISC2 CISSP and Microsoft Certified: Azure Fundamentals.
Selected experience
Experience in finance, technology, and U.S. Navy submarine service.
Alfe Corona · Selected experience
Work delivered at each organization.
Remediation coordination, audit readiness, and testing documentation.
- Wells Fargo
Coordinated HSM vulnerability remediation and documented an application-vulnerability process with technical owners, deadlines, status, and escalation paths.
- IBM
Led SOC 2 audit readiness for IBM Cloud’s Cloud Shell, CLI, and Developer Experience teams, working with engineers and PwC auditors.
- Google
Created a step-by-step email QA guide for Google Maps Local Guides with developers and the program manager.
- U.S. Navy
Maintained 99.6% inventory validity. Also earned the Navy and Marine Corps Achievement Medal.
Professional recommendations
What colleagues and leaders say.
Perspectives from people who have managed my work or collaborated with me.
Caryn Woodruff
Former direct manager
“Alfe is a skilled security and compliance professional. He possesses excellent problem-solving and analytical skills and is able to effectively identify and mitigate potential risks and vulnerabilities.”
Ami Diaz, CRISC, CDPSE
Former direct manager
“His work is meticulous and conclusions are well-developed. He also shares insights and best practices with his peers. He was a great asset to the team.”
Ryan Inagaki
Former colleague
“During his tenure, I was consistently impressed by his deep understanding of the industry's best practices and regulations.”
Joel Pichardo
Cybersecurity peer
“Alfe is the kind of cybersecurity expert you hope to have on your team.”
Operator perspective
How I coordinated vulnerability work.
At Wells Fargo, I coordinated HSM vulnerability remediation and documented an application-vulnerability process.
I worked through teams’ preferred channels and a weekly cadence. The documented process clarified technical owners, deadlines, status, and escalation paths, and reconciled findings with remediation and validation status.
Read the coordination case study
Security leadership perspectives
CyberTainment TV
Videos on vulnerability priorities, remediation ownership, and the evidence needed to confirm closure.
Watch the series on YouTubeFeatured episode
Why Your Vulnerability Spreadsheet Is the Breach.
How exploitability, affected systems, and validation checks help teams prioritize vulnerability work.Watch episodeApproach
Prioritize findings. Assign owners. Verify closure.
I review finding evidence and business context, agree on remediation owners and next steps, and check whether the closure criteria were met.
Connect findings to assets and owners
Check evidence before escalation
Prioritize by exploitability and business impact
Agree on owners, deadlines, and closure checks
Direct answers
How prioritization and closure work.
What is cyber exposure architecture?
In this portfolio, cyber exposure architecture connects vulnerability findings to affected assets, business importance, controls, and remediation owners. Exposure Control demonstrates these links with fictional data.
How do organizations prioritize vulnerabilities by business risk?
Consider exploitability, whether the asset can be reached, its business importance, data sensitivity, and existing controls. Assign an owner and use those factors to decide which findings need attention first.
How does exposure control connect engineering, architecture, and executives?
The synthetic Exposure Control project shows finding priorities, affected applications, remediation owners, and closure checks. Engineers and leaders can inspect the same records when deciding what to fix and what remains open.
What does evidence-gated closure mean?
Closure requires validation data confirming that the finding was resolved or meets an approved control criterion. Without that evidence, the finding stays open or returns to remediation.
For a synthetic example, review the Exposure Control portfolio for cyber exposure management and risk-based vulnerability prioritization.
Connect
Start a conversation.
Use the relationship brief to describe a role, project, or speaking topic. Include the purpose and next step, without confidential information.
Start Relationship BriefRelationship BriefPreferredConnect With MeShare the role, project, or speaking topic you want to discuss. Do not include confidential information.Exposure PortfolioFeaturedexposure.alfecorona.comInspect the synthetic finding, prioritization, remediation, and closure examples.LinkedInProfessionallinkedin.com/in/alfecoronaReview my experience and connect on LinkedIn.Latest writingWritingFrom Fragmented Vulnerability Data to a Clear Remediation PlanAn article on organizing vulnerability records and remediation follow-up.EmailFallbackalfe@alfecorona.comUse direct email for simple notes or follow-up after submitting the relationship brief.