Jackson State University

Shaping Cybersecurity through Multiple Lenses

My cybersecurity foundation was forged in military operations. Through major joint exercises such as Cyber Shield, a National Guard and Reserve exercise, I trained extensively in defensive cyberspace operations, forensic analysis, threat reporting and incident response alongside joint cyber units. This was my core duty, and it built my operational discipline from the ground up.

Over time, layering military officer training with corporate-sector experience and college adjunct instruction gave me a natural balance between tactical execution and high-level strategy.

When dedicated CISO positions were still emerging and uncommon across HBCUs, the university’s CIO demonstrated visionary leadership. When I originally applied for a different role, the CIO recognized that my hybrid background met an urgent strategic need and created an opportunity for me to step into the CISO role. Today, as cybersecurity continues to evolve, I draw heavily on that combination of military rigor, academic perspective and corporate agility to lead proactive, resilient defense teams.

Together, these experiences shaped my approach as a Chief Information Security Officer: security cannot exist in a vacuum. It must enable the core mission, whether that is defending an operational unit, protecting corporate assets or safeguarding an academic institution by combining military-grade risk management with business-aligned agility.

Confronting Higher Education’s Cybersecurity Challenges

Higher education operates in a uniquely open environment. Unlike closed corporate networks, universities must foster open research, decentralized departments, bring-your-own-device (BYOD) cultures and extensive guest access; all while safeguarding sensitive student records, intellectual property and critical research data.

The primary challenges stem from resource constraints, legacy infrastructure and targeted ransomware or phishing attacks. Additionally, higher education institutions often operate in complex compliance environments, requiring a balance between regulatory mandates (such as FERPA, CMMC and HIPAA) and academic freedom. Overcoming this requires building security maturity models that are sustainable and adaptable to the academic lifecycle.

Preparing Organizations to Respond Under Pressure

Preparedness requires shifting from static policies to active validation. Security assessments establish a realistic baseline, but tabletop exercises and threat/vulnerability simulations reveal how teams respond under stress.

To build true incident response capability:

1. Include non-technical stakeholders: Incident response isn't just an IT issue; executive leadership, legal, communications and operations must participate in tabletop exercises.

2. Focus on operational continuity: Assessments should evaluate not just technical controls, but the organization's ability to maintain core functions during an incident.

3. Institutionalize post-incident reviews: Every exercise or real incident should drive direct updates to response plans and risk models.

Forging Stronger Security Teams Through Practical Learning

As both a former military instructor and a university faculty member, I believe hands-on, practical application is essential. Theoretical knowledge provides a foundational understanding, but real-world capability is forged through active exercises, red or blue team simulations and experiential labs.

Furthermore, we must embrace nontraditional and diverse talent pipelines. Bringing individuals with varied academic, military and professional backgrounds into cybersecurity fosters innovative problem-solving and adaptable leadership, qualities essential for defending against complex threat actors.

Priorities for Building Cyber Resilience

Building long-term resilience requires CISOs to focus on three core priorities:

• Cultivating a Security-Minded Culture: Technology alone cannot stop an attack. Security awareness must be integrated into daily routines across all levels of the organization.

• Mastering Sustainable Fundamentals: Zero Trust principles, robust identity management, MFA enforcement and rigorous asset hygiene must be maintained consistently, not treated as one-time initiatives.

• Proactive Risk Management: Leaders must continuously align cyber risk with broader organizational strategy, ensuring resources are directed where they provide the greatest operational protection.