Tony Rossi
Security and GRC leader. Retired Navy Senior Chief. 21 years running cyber operations on nuclear submarines.
I build security and compliance programs from zero, then make them run without me.
CISSP · CISM · CEH · Active TS/SCI
Leadership Proof
- 21 yrsleading cyber operations in the U.S. Navy Submarine Force
- 8 → 35people on the security and IT team I built, with a $5M budget
- 100%audit pass rate across seven straight years
- 350 → 11STIG review hours after a tool I designed and shipped
- 4frameworks unified under one SOC 2 program, zero major findings
- 98%audit findings closed for a $50M+ research program at UW
- CMMC L2and FOCI remediation delivered for a federal business unit
- AIES '26program committee, and a working paper on continuous AI compliance
Timeline
-
2024 – present
Principal · Tony Rossi Consulting LLC
Built a GRC, cybersecurity, and privacy practice from a blank page.
Serves wealth management firms, high net worth individuals, and the defense industrial base. Subcontracts NIST 800-53 assessments through A-LIGN. SAM.gov registered with CAGE code. Engineered the entire delivery stack in-house: encrypted client vault, reporting pipeline, client portal.
-
Mar 2025 – May 2026
Federal Compliance Program Manager · Nutanix
Owned the federal compliance program for a public company's government business.
Led CMMC Level 2 readiness work. Ran FOCI remediation. Delivered the federal business unit's first SOC 2: four frameworks on Drata, zero major findings. Handled 100+ customer security reviews a year. Designed and shipped Security Scan Mapper, cutting STIG review from 350+ hours to 11. Read the case study.
-
Jul 2024 – Jun 2026
Co-Founder · leveld
Co-built a candidate-first hiring platform from idea to production.
Accepted into NVIDIA Inception. Shipped a 15-agent CI/CD pipeline with privacy and accessibility agents holding veto. Designed the ACIE framework: 28 vectors across 4 domains. Wrote a research paper on continuous compliance for AI hiring systems (working paper). Wound down in 2026. The governance design and the research carried forward.
-
Jan 2024 – Jun 2024
SMX (classified)
Supply chain hardware security and nation-state threat investigation.
Found 20 compromised switches. Cleared work. Details on request with appropriate authority.
-
Apr 2023 – Jan 2024
Security Lead · University of Washington, Office of Research
Stood up the office's first security risk function.
Built the first departmental risk assessment and the first third-party risk management program, across 25+ departments. Closed 98% of audit findings for a $50M+ research program. Brought 100+ systems into FERPA compliance in eight months. Established the baseline the office still runs on.
-
2023 – present
Founder · The sIQurity Foundation (501(c)(3))
K-12 cybersecurity education, run as a nonprofit.
Founded as CyberSmrt. Teaching kids to defend themselves online before someone else teaches them the hard way.
-
Jul 2002 – Aug 2023
U.S. Navy Submarine Force · Retired as Senior Chief, Senior Cyber Operations Chief
21 years. Led cyber operations where failure is not a ticket, it's a casualty.
Rose from enlisted sailor to the senior cyber chief on the boat. Wrote the submarine force's first cybersecurity policy. Grew the security and IT team from 8 to 35 people with a $5M budget. 100% audit pass rate for seven straight years, across a $1B+ fleet and 30+ commands. Led teams, trained sailors, owned mission systems at depth with no outside help available. Retired August 31, 2023.
On the overlap. The consulting practice and the nonprofit ran alongside my full-time roles, disclosed and conflict-checked in each case. No practice client overlapped an employer's customers or competitors while I held the federal compliance role.
Bio
I lead security the way I learned it on submarines: own the outcome, train the people, build the system so it holds when you're asleep.
I grew up in the inner city with no direction. My father dropped out of high school. My mother graduated, and that was as far as anyone in the house got. I fought. I skipped school. I got suspended for both. I repeated 10th grade because I barely showed up for the first one. The only reason I didn't drop out was the rule at home: you drop out, you move out.
In study hall I saw a man in uniform and had no idea what he did. He was a Navy recruiter. My friends had graduated a year ahead of me, and I watched them sink their money and their time into college with no clue what they actually wanted. That wasn't for me. I joined the Navy with a loose understanding of what that even meant.
I spent 21 years in the submarine force and retired as a Senior Chief, the senior cyber operations chief on the boat. I wrote the force's first cybersecurity policy. Then I went into industry and found the same problem everywhere. Compliance programs built from spreadsheets and hope, run by people who were never given the authority to fix them.
So I fixed them. At the University of Washington I stood up a risk function from nothing. At SMX I did cleared work on supply chain hardware and nation-state threats. At Nutanix I owned federal compliance for a public company: CMMC Level 2, FOCI, SOC 2 across four frameworks. When STIG review was eating 350 hours a cycle, I built the tool that brought it to 11.
I write the software too. My practice runs on a stack I engineered myself: a LUKS2 and YubiKey client vault, a hash-chained audit ledger, a deterministic reporting pipeline, and a client portal on Cloudflare Workers. I am building an OSCAL-native compliance evidence engine designed to map 12 control frameworks. When I automate security tooling, it ships authorization-first and disarmed by default, because a tool that can scan can also cause an incident.
Some of the work is less formal. I once recovered a hijacked X account for a Hollywood actor, which taught me more about how platforms actually handle account takeover than any vendor briefing has.
Now I run my own practice and I'm looking for the room where the security program is either broken or doesn't exist yet. That's where I'm useful. I build the program, hire and train the team, put the controls in code, and hand leadership a function that reports on itself.
I hold an active TS/SCI and CISSP, CISM, and CEH. I co-founded a hiring platform and a nonprofit that teaches kids cybersecurity. I sit on the AIES 2026 program committee and wrote a working paper on continuous compliance for AI hiring systems. I live in Poulsbo, Washington.
Straight edge. Tattooed. DIY. I'd rather build it than buy it, and I'd rather tell you the truth than tell you what you want to hear.
Work
- Security Scan Mapper STIG review cut from 350+ hours a cycle to 11. Designed, built, and shipped inside a public company. Nutanix, 2025 · case study
- Federal compliance program, Nutanix Owned CMMC Level 2 readiness, FOCI remediation, and SOC 2 across four frameworks for a public company's government business. CMMC L2 · FOCI · SOC 2 · Drata
- Tony Rossi Consulting delivery stack (opens in a new tab) The whole practice runs on software I wrote. Client work never touches a third-party SaaS I do not control. LUKS2 + YubiKey vault · hash-chained audit ledger · WeasyPrint report pipeline · Cloudflare Workers, Pages, D1, R2
- attest (opens in a new tab) Local-first compliance evidence engine. Collects posture facts inside the client boundary, maps them to controls, and emits signed OSCAL assessment results. designed for 12 frameworks · OSCAL output · spec published, source public · no release yet
- Operator agent Authorization-first automation for security tooling. Every run needs a signed rules-of-engagement grant, and the agent ships disarmed in production. Allowlisted argv · kill-switch pre-check · signed approval receipts
- UW Office of Research risk function Stood up the office's first security risk capability, which it still runs on. First risk assessment · first TPRM program
- leveld (opens in a new tab) Candidate-first hiring platform, built from idea to production. Accepted into NVIDIA Inception. 15-agent CI/CD · privacy and accessibility agents held veto · ACIE framework, 28 vectors across 4 domains · Wound down 2026
- Continuous compliance for AI hiring A 15-agent CI/CD pipeline that gated every deployment against six regulatory frameworks. Run on our own code, it issued a REJECT. working paper · 15 agents · 6 frameworks · 90 findings, self-audit
- The sIQurity Foundation (opens in a new tab) K-12 cybersecurity education as a 501(c)(3). Teaching kids to defend themselves online. 501(c)(3) · founded 2023 as CyberSmrt
- CGE-P document pipeline Reproducible build system behind the Seattle GRC Engineering Club's certification materials. 15 documents · byte-identical rebuilds · vendored fonts
- indee.music (opens in a new tab) DIY venue and show discovery for independent music. Early stage. Side project
Credentials
CISSP · CISM · CEH · Active TS/SCI · AIES 2026 Program Committee · SAM.gov registered (NAICS 541512) · Seattle GRC Engineering Club
M.S., Cybersecurity and Information Assurance, WGU, 2023 · B.S., Computer Science, Hawaii Pacific University, 2012
Contact
Ready to talk about a Director or VP role, or a program that needs rebuilding.
me [at] tonyrossi [dot] devlinkedin.com/in/tonyrossi-grc (opens in a new tab) Poulsbo, WA