Emil Chukalov · Cybersecurity executive & engineering leader
I turn security strategy into systems that hold up in practice.
I bring over 20 years across technology and cybersecurity, including more than a decade leading security programs in regulated enterprises. I have built teams and led multidisciplinary programs across Fortune 500 and regulated enterprises.
My role is to connect business priorities, security risk, and engineering reality: set direction, establish ownership, give teams workable controls, and give leaders evidence they can trust. I stay technically engaged so I can ask better questions, remove blockers, and work alongside engineers when a difficult problem needs another set of hands.
Enterprise accountabilityOwned security-technology portfolios across enterprise tools, SaaS, and managed services, with accountability for budgets, vendors, roadmaps, standards, architecture review, and regulatory remediation
Team growth · 2 to over 20Built a multidisciplinary organization and developed college hires into principal engineers
100K+ hosts · 4K+ applicationsLed security engineering, application security, offensive security, automation, and risk work at enterprise scale
Why I write
Security at Depth examines the evidence behind security outcomes.
Across my career, I’ve learned from successes, setbacks, and decisions that appeared sound at a high level but did not produce the intended outcomes in practice. I write to share those lessons by connecting security decisions and reported outcomes to the architecture, operating realities, evidence, and tradeoffs behind them.
If that perspective helps someone avoid a mistake or make a stronger decision, the work has value. Publishing is also part of how I continue to learn, so I welcome thoughtful disagreement, questions, and experiences that challenge my assumptions and improve the next decision.
Career arc
Built from infrastructure upward.
Enterprise operations became security engineering, program building, organizational leadership, governance, and independent product work.
2025 — present
Principal Cybersecurity Advisor
Engenso LLC
Provide cybersecurity advisory across strategy, governance, risk, compliance, architecture, and engineering—turning complex requirements into workable programs, controls, and technology decisions. Build privacy-first products and automation spanning DevSecOps, cloud infrastructure, MCP integrations, and review-first AI controls.
2022 — 2024
Vice President & Director, Information Security Engineering
Fifth Third Bank
Led a nearly 20-person organization across Security Engineering, Vulnerability Remediation & Risk Management, and Application Security—including penetration testing and the enterprise bug bounty program. Owned technology and service portfolios, budgets, roadmaps, company-wide security standards, architecture review, and audit and regulatory remediation.
2017 — 2022
Director, Information Security Engineering
Freddie Mac
Progressed from Manager to Director, grew the organization from two to 20, and developed college hires into principal engineers. Expanded security engineering, offensive testing, control validation, automation, and security awareness across 100K+ hosts and 4K+ applications.
2016 — 2017
Information Security Consultant
Axxum Technologies
Transformed Freddie Mac’s enterprise vulnerability-management program and established web and wireless penetration-testing capabilities before joining the organization full time.
2013 — 2016
Lead Security Engineer · Penetration Tester
Booz Allen Hamilton
Built the enterprise vulnerability-management program, completed a zero-disruption enterprise platform migration, and implemented application-security testing before moving to Red Team penetration testing, adversary simulation, and threat hunting.
2007 — 2013
Lead Systems Engineer
CompuCom
Led enterprise infrastructure and security engineering work supporting more than 25,000 users—the operating foundation for the security leadership roles that followed.
How I operate
Direction is only useful when teams can carry it forward.
Set direction
Turn business priorities and security risk into explicit choices, funded priorities, and measurable outcomes.
Make ownership explicit
Give every material decision, control, and exception a named owner and a clear escalation path.
Build capability that lasts
Develop people, automation, and operating discipline so progress does not depend on one leader.
Lead close enough to help
Give teams autonomy, then step alongside them when judgment or technical depth can remove a blocker.
Raise the bar
Use meaningful indicators, candid lessons, and each new iteration to improve the next decision.
Governance beyond the enterprise
Finance, audit, and technology-risk oversight.
Board of Directors · Executive Committee · Finance/Audit Committee Chair
Love The Golden Rule Inc. · 2025–2026
Provided fiscal, audit-readiness, governance, and technology-risk oversight for a federally funded healthcare nonprofit with 340B pharmacy operations. Authored more than 75 governance and compliance documents with an adoption plan and evidence milestones.
Education
Master of Science, Computer Forensics
George Mason University · Summa Cum Laude · Minor in Penetration Testing and Malware Reverse Engineering · Additional graduate study in Incident Response
Bachelor of Science, Information Security
George Mason University · Summa Cum Laude
Primary credentials
- CISSP
- GSLC
- GCSA
- GCPN
- GXPN
- OSCP
Continue the conversation
If this work connects with yours, I’d welcome the conversation.
I value candid exchanges about security leadership, engineering tradeoffs, and the evidence behind durable programs.