The 21st EnergySec Security AND Compliance Summit

Katie Wilcox is VP, Business Development at Karta, where she helps utilities modernize governance, risk, and compliance programs through practical strategies, intuitive technology, and stronger stakeholder engagement. She works closely with utilities and energy organizations to address complex NERC compliance and enterprise GRC challenges. Katie leads Karta’s marketing, client engagement, strategic partnerships, and growth initiatives, bringing together industry insight, customer needs, and solution development. Infinitely curious and relentlessly growth-minded, she is passionate about creating meaningful connections, improving how people work, and translating complex ideas into clear, actionable strategies.

Kimberly Fellner serves as a Director of Security at American Electric Power (AEP), where she leads cybersecurity functions including Security Architecture, Engineering, and Vulnerability Management. With more than 20 years of experience across the public and private sectors, she has built and operated large-scale technology and security programs. Her work focuses on strengthening cyber resilience, enabling secure innovation, and helping organizations navigate an increasingly complex threat landscape.

Lisa has spent 25 years in the electric sector and has been around NERC Compliance since the beginning, which qualifies her as either an OG or an artifact, depending on who is doing the audit.

Her career has crossed public power, IOUs, regulatory compliance, cybersecurity, IT governance, supply chain, procurement, and digital change. In other words, she has collected utility functions the way some people collect Disney pins.

Lisa helped build EnergySec in its early days, focused on cybersecurity regulation, education, and collaboration across the electric sector. She has spent much of her career translating technical realities and compliance regulations into operational and business decisions, speaking fluent engineer, executive, auditor, and several ancient dialects of CIP that only appear in archived RSAWs.

Today, her work focuses on helping people build the confidence, curiosity, and judgment needed to adapt as technology, risk, and regulations keep changing.

She is also a mixologist and historian, which means she knows that great outcomes depend on good ingredients, careful balance, and occasionally, a very strong pour.

Samara Moore is a cybersecurity executive with more than 25 years of experience leading global security, risk, and compliance programs across government and industry. She has managed enterprise security for a major energy provider and shaped cloud security requirements for regulated sectors as a security leader at AWS. A former Director for Critical Infrastructure Cybersecurity on the White House National Security Council, she helped develop the NIST Cybersecurity Framework and architect the Electricity Subsector Cybersecurity Capability Maturity Model. Her current work focuses on secure innovation, AI, and resilience in critical infrastructure.

With leadership experience spanning government and private sector organizations, Samara has strengthened cybersecurity across cloud, IT, and OT environments, enabling secure modernization in critical sectors. As former Director for Critical Infrastructure Protection on the National Security Council, she helped develop the U.S. Cybersecurity Framework and architect the Electricity Subsector Cybersecurity Capability Maturity Model, both of which continue to shape global standards and cross-sector collaboration.

Christian Weule has been making cybercriminals' lives miserable for 30 years across Federal, Military, and Commercial battlefields. With more time hunting threats than most people spend binge-watching Netflix, he's the guy you want when your industrial control systems start speaking in tongues. The true Dobie Gillis of cybersecurity, Christian was tinkering with OT security and AI applications back when most people thought "machine learning" meant teaching your VCR to record properly. At PhishCloud, he architects defenses against sophisticated attacks that make traditional IT security look like a screen door on a submarine.

Sunny is the lead of NERC CIP solutions at Black & Veatch’s Industrial Cybersecurity practice. His expertise includes cybersecurity, control systems, compliance and audit. He brings a unique combination of technical expertise and cyber program implementation to help meet clients’ compliance and safety goals. During his time at ABS Group, he assessed, developed and implemented OT cybersecurity programs for maritime facilities and power generation facilities. In his tenure at CAMS Texas, he managed NERC CIP compliance for Medium and Low Impact power facilities and helped build the Remote Operations Center (meeting CIP Medium Impact Control Center requirements) and set up remote connections at sites. Sunny has a strong knowledge in OT/ICS systems, compliance requirements and guidelines (NERC CIP, IMO) and cybersecurity frameworks (NIST, ISA/IEC 62443). With a B.A. in Electrical Engineering, specialized in Control Systems, Master’s in Business Administration and certifications such as SANS GICSP, Sunny brings a wealth of expertise to the projects he executes.

https://www.threatlocker.com

Special Agent Justin Vallese has over 15 years of experience in information security from investigations and prosecutions of Criminal and National Security computer intrusions. These investigations include an international hacker-for-hire conspiracy, a Chinese-government backed intrusion which led to the arrest and US prosecution of a Chinese Cyber-spy, the Sony Pictures cyber-attack, the WannaCry ransomware outbreak, cryptocurrency exchange hacks, and financial institution computer intrusions. 

    Special Agent Vallese is assigned to the FBI Los Angeles Field Office where he serves as coordinator for the FBI Los Angeles Cyberhood Watch Program, a network of cybersecurity professionals which facilitates a collaborative and preventative approach to countering cyber threats. 

    Prior to his work in the Cyber arena, SA Vallese investigated Financial Crimes, Internet Fraud, and Intellectual Property Rights matters at the FBI Los Angeles.

Josh Ross is the Co-Founder & CEO of Ironloop, a cybersecurity startup helping energy, manufacturing, and defense keep operations secure and audit-ready. Ironloop turns industrial machine and network configurations into a continuously updated inventory, change alerts, and compliance-ready documentation, so teams can reduce risk without disrupting production. Before Ironloop, Josh led cloud infrastructure at Applied Intuition, where he built deployment automation, monitoring, and observability systems across cloud and on-prem environments, including government and defense networks. He holds a degree in computer science and economics from the University of Pennsylvania and is based in New York City.

Matt Downey is Vice President, Energy & Supply Chain Sales at Fortress Information Security, which secures the supply chain for critical infrastructure and protects over 40 percent of the US power grid. With more than two decades of experience in technology and analytics sales for asset-intensive industries, Matt has held leadership roles at Nokia, Oracle, and Space-Time Insight, focusing on advanced analytics, IoT, and risk management for utilities and critical infrastructure. He is based in the Dallas-Fort Worth Metroplex.

Marc Lemmond is an Industry Engagement Programs Manager in the Office of Cybersecurity, Energy Security, and Emergency Response of the U.S. Department of Energy. In that role, he leads a team facilitating collaboration between American energy asset owners and operators and federal government agencies on security and resilience issues. Through his work, Marc engages energy companies and government officials to advance federal energy policies on cybersecurity, physical security, wildfires, supply chain constraints, and other issues. 

Prior to this, Marc worked to broaden the adoption of cleaner transportation alternatives as a part of Virginia Clean Cities. He also led policy and partnership efforts in The Weather Company™ and Energy, Environment, and Utilities business units at IBM. Earlier in his career, Marc also worked in international trade policy and promotion as a part of the Department of Commerce and the Environmental Protection Agency. Marc earned a B.A. in government and public policy at the University of Alabama at Birmingham and a Master's in Science, Technology, and Public Policy at the Elliott School of International Affairs at The George Washington University.

Antoine Coudoux spent over 10 years in cybersecurity consulting, designing and deploying SOC capabilities for international organizations, handling incident response across complex environments, and leading global penetration testing teams.

He is now co-founder of MokN, a cybersecurity software company tackling credential theft through an innovative phish-back approach.

Todd Wedge is a Customer Solution Architect with Siemens Digital Industries, helping electric utilities and critical infrastructure organizations strengthen OT cybersecurity and accelerate digital transformation initiatives. With more than 25 years of technology sales and business development experience, Todd's background includes cybersecurity pioneers Sanctum (now IBM) and N2H2 (now McAfee), as well as Microsoft, where he served as a Global Alliance Manager for high-performance computing software partners. He holds an MSc in International Business Administration from the University of London (SOAS) and a BSc in Business Administration from The University of Texas at Dallas.

With more than 12 years dedicated to NERC CIP compliance, Brian Jackson has worked closely with utilities to strengthen their cybersecurity posture across IT and OT systems. His experience spans control implementation, change management, and the cross-functional coordination large-scale CIP programs demand. He currently serves as Regional Sales Director at Industrial Defender, supporting utilities and industrial operators through complex regulatory and operational security challenges.

Ian Annase is the Founder and CEO of ZingDrone Solutions, where he leads the development of drone detection, Remote ID, and airspace security technologies for public safety and critical infrastructure.

Marc Lemmond is an Industry Engagement Programs Manager in the Office of Cybersecurity, Energy Security, and Emergency Response of the U.S. Department of Energy. In that role, he leads a team facilitating collaboration between American energy asset owners and operators and federal government agencies on security and resilience issues. Through his work, Marc engages energy companies and government officials to advance federal energy policies on cybersecurity, physical security, wildfires, supply chain constraints, and other issues. 

Prior to this, Marc worked to broaden the adoption of cleaner transportation alternatives as a part of Virginia Clean Cities. He also led policy and partnership efforts in The Weather Company™ and Energy, Environment, and Utilities business units at IBM. Earlier in his career, Marc also worked in international trade policy and promotion as a part of the Department of Commerce and the Environmental Protection Agency. Marc earned a B.A. in government and public policy at the University of Alabama at Birmingham and a Master's in Science, Technology, and Public Policy at the Elliott School of International Affairs at The George Washington University.

Antoine Coudoux spent over 10 years in cybersecurity consulting, designing and deploying SOC capabilities for international organizations, handling incident response across complex environments, and leading global penetration testing teams.

He is now co-founder of MokN, a cybersecurity software company tackling credential theft through an innovative phish-back approach.

Steven Parker, CISA, CISSP, is a founding director of EnergySec. He has been engaged in critical infrastructure protection within the electric sector for more than 22 years, including eight years as a senior security staff member at a large west coast utility. He was also one of the original NERC CIP auditors for the WECC region. He has been with EnergySec full-time since 2010.

With a 15-year IT background, Kyle Jones transitioned to education, holding various roles, including Sr. Security Infrastructure Administrator. He possesses multiple CompTIA certifications and degrees in Network Engineering, Business and a Master in Information Assurance and Security. At Sinclair College, he's a Principal Investigator and a noted cybersecurity speaker in Ohio. His recognitions include IT Leader of the Year and Dayton's top 40 under 40, and he actively participates in the Ohio Cyber Reserves.

EnergySec Cyber Security Professional of the Year 2018

SAN ICS Cyber Security Principal Instructor

Hardware Hacking Essentials Training Course Author

Supply chipping attack feature at wired.com

60+ Security presentations at conferences including, DEFCON, RSA, EnergySec, S4 CS3STLM, Bsides LV, GridSecCon, Hack the Capitol and many others

Andrew Ginter is the VP Industrial Security at Waterfall Security Solutions, where he leads a team of experts that work with the world's most secure industrial sites. Before Waterfall, he led the development of high-end industrial control system products at Hewlett-Packard, IT/OT middleware products at Agilent Technologies, and the world's first industrial SIEM at Industrial Defender. Andrew is the author of two textbooks on industrial security, and a co-author of the IIoT Security Framework and the UITP guide to rail system cybersecurity procurement. He co-hosts the Industrial Security Podcast, is a lecturer at the Industrial Security Institute, and contributes regularly to industrial security standards and best-practice guidance.

Terry is a serial entrepreneur with over 20 years of experience safeguarding public, corporate, and government sectors from cyber threats. A certified ethical hacker and former government red team leader, he is also a renowned expert in ICS/OT incident response and preparedness training, driving innovation in cybersecurity defense strategies.

Credited with over 600 vulnerabilities impacting ICS and Medical systems (ICS-CERT), underscoring his profound understanding of the field, including Siemens, ABB, Rockwell, Honeywell, and more reported vulnerabilities. Recognized as a pioneer in IoT and ICS analytics, Terry has collaborated globally to build ICS SIEMs currently utilized by Fortune 100 companies.

David Reinecke has more than 25 years of experience in cyber security, technology, and regulatory compliance within the energy industry, including large investor-owned, municipally owned, and co-operative utilities. His experience encompasses systems administration and networking infrastructure, cyber security, incident management, and regulatory compliance.

Duke Randall is an IT leader with over 20 years of experience specializing in infrastructure

and regulatory compliance within the electrical cooperative sector. He currently

spearheads proactive cybersecurity initiatives for critical infrastructure, managing the

security and integration of telecommunications, IT, and OT networks to ensure the delivery

of safe, reliable power. Known for his strategic foresight and vision planning, Duke serves as

a trusted advisor to senior management, developing actionable plans that prioritize a

proactive security posture. His technical expertise spans systems administration,

networking infrastructure, and complex regulatory landscapes. Duke has built a

professional reputation as a dependable voice who consistently delivers resilient solutions

for the modern utility environment.

David Bernstein has over 15 years of experience in emergency response, emergency management, and business continuity and resilience planning. He has supported clients in developing and overseeing enterprise resilience strategies with local and global footprints. In addition to strategic program development, David has also developed facility recovery plans and acted as a Subject Matter Expert (SME) to support COVID-19 safety and recovery efforts. Prior to being a consultant, he was an Emergency Manager in healthcare, leading initiatives spanning individual hospitals to multi-facility health networks. David has also acted as a strategic advisor on multi-agency initiatives at the local and regional level, including coalitions and consortiums ranging in size and scope.

David holds internationally recognized credentials in Emergency Management and Business Continuity and brings significant experience in leading teams to develop corporate emergency response and business continuity programs, often from a ground zero start point.

Matt Griffin is the Principal Advisor of Cloud Technical Services at Midcontinent Independent System Operator (MISO), where Matt leads enterprise-scale cloud innovation with a focus on security, reliability, and regulatory compliance in the North American energy sector. Matt specializes in architecting and operationalizing secure cloud platforms, developing reusable Terraform modules for Azure and AI ecosystems, and enabling cloudnative scaling strategies in collaboration with MISO’s Data Architecture, Cyber Security, and Information Risk teams.

Timothy Starr is an IT Risk and Compliance Analyst for Arizona Public Service.  He has been involved in CIP for Infrastructure and Operations since 2016.  Starting his career in IT Operations he started to learn CIP standards by being handed the CIP NERC guidebook by his boss at the time.  In 2018, Tim became responsible for ensuring compliance and support for CIP Real Time System Windows servers, including EMS, Substation HMIs, and other CIP windows assets. Additionally, Tim supported the Industrial Defender application to ensure CIP-010 requirements were met for all I&O teams.  On top of the server administration and compliance work, Tim also became a CIP Standard Owner for CIP-010 R1.1 to R1.6 and R2.1 and all CIP-009 requirements.  Tim also was the SME for these Standards during WECC Audits.  In July 2022, Tim joined his current role as an IT Risk and Compliance Analyst and has been a cornerstone in the compliance program for I&O since.  His current role includes ensuring compliance with CIP standards, supporting I&O teams with all things CIP, supporting self-certifications, supporting I&O during WECC Audits, new CIP standard implementations, CIP-010 change management, CIP related documentation updates, and being a CIP Consultation for I&O CIP related projects.

Dennis Skarr is an educator, workforce training leader, and founder of SkarrNet Training Systems. He has led cybersecurity missions for the U.S. Air Force, developed training for cyber operators performing critical infrastructure assessments, and created technology programs for college and workforce learners. His work focuses on human-centered digital literacy, AI readiness, and cyber-aware judgment, helping non-technical learners build confidence with modern workplace technology without turning training into yet another joyless software hostage situation.

As the CEO and Founder of SecureCyber, Shawn leads a dedicated team committed to safeguarding organizations across the entire spectrum of cybersecurity needs. He brings over two decades of experience in cybersecurity and information systems from perimeter defense and secure network design, to vulnerability discovery and intrusion detection systems. Shawn specializes in leading security teams when bridging the gap between technology and business objectives. He has an exceptional track record in empowering informed decision-making that protects assets from both internal and external threats. Prior to joining SecureCyber, Shawn occupied a senior role in the FBI’s Criminal Justice Information System compliance framework. He developed a compliance training curriculum for agencies and vendors. His efforts in speaking, training, and writing on cyber issues are widely recognized and showcase his mission to make cybersecurity knowledge and best practice accessible to diverse audiences across multiple sectors. A highly experienced leader in this category, Shawn is committed to breaking new ground in the evolving – and often challenging – space of cybersecurity.

Christine Reid serves as the Political Director for IBEW Local Union 77, which represents more than 8,800 utility workers throughout Washington state, Northern Idaho, and a small part of Montana. A 20-year rank-and-file IBEW member, Christine brings firsthand experience and a strong labor perspective to her advocacy work. In her role, she works at the intersection of labor, policy, and politics to advance the interests of union members and ensure working people have a voice in public decision-making. She brings insight on utility work, infrastructure, energy, workforce development, and policies that support safe, family-wage jobs.

Dr. Paul Wagner is a Professor of Practice in the Cyber Operations program at the University of Arizona (U of A). Paul is the director of U of A’s Arizona Cybersecurity Academy which focuses on K-20 education initiatives, workforce development, and community outreach and awareness. He is also the director of the Arizona Cybersecurity Clinic which provides student experiential learning and cybersecurity support to government and community partners. Prior to working with the University of Arizona, Paul spent 20 years in the Army where he developed his knowledge in computer networking and designing robust network architectures to support global operations in support of national and joint operations. In addition to his Ph.D. in Cyber Defense from Dakota State University, Paul holds over twenty technical certifications. His primary research interests focus on cybersecurity education, training, and workforce develop

Dr. Robert Honomichl is an Assistant Professor of Cyber Operations at the University of Arizona. Dr. Honomichl is an advocate for computer science and cybersecurity education. He has hosted a variety of teacher professional development opportunities including serving as director of six GenCyber teacher camps, CTE CyberNet and Middle Grade Accelerator program site lead, and the Cybersecurity High School Innovation project. Dr. Honomichl’s research interests include cybersecurity education, human factors of cybersecurity, and social engineering.

Veronika Kyles is a graduate student at the University of Arizona pursuing a Master’s in Cyber and Information Operations. She graduated Magna Cum Laude with a Bachelor’s in Cyber Operations, concentrating in Cyber Engineering and minoring in Computer Science and Music. She was selected for the Department of Defense Cyber Service Academy and recently completed a summer internship with the Naval Information Warfare Center Pacific in San Diego. She previously worked at the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, where she spent two years researching policy-driven risk analysis for critical infrastructure. Her current research focuses on industrial control system cybersecurity within Arizona’s water and wastewater sector, with an emphasis on identifying sector‑specific vulnerabilities and key threat vectors. The goal of these findings is to develop a tailored cybersecurity strategy designed specifically to help under‑resourced utilities strengthen their security posture across the state. Veronika is integrating this research into the Cybersecurity Clinic‑in‑a‑Box Toolkit by creating sector‑specific guidance, assessment materials, and OT‑focused recommendations that address the needs of Arizona’s under‑resourced water utilities. Her goal is to strengthen the toolkit’s ability to deliver practical, locally relevant cybersecurity support in low‑capacity operational environments.

Sam Encinas is a graduate student at the University of Arizona pursuing a Master's in Cyber and Information Operations. She graduated summa cum laude with a Bachelor of Applied Science in Cyber Operations, emphasizing in Defense & Forensics. She is currently on her second internship with Salt River Project and has worked in different IT and compliance projects. Sam is passionate about cybersecurity and technology and interested in leveraging her skills to make a positive impact and help others in the industry.

Jonathan Robbins is a Senior Consultant with Archer Energy Solutions specializing in cybersecurity governance, NERC CIP compliance, and risk management for electric utilities and critical infrastructure organizations.

His background includes information security and compliance leadership roles supporting a generation and transmission cooperative, a renewable energy owner/operator, and a manufacturer of electric grid technologies. Through these experiences, he has helped organizations develop sustainable compliance programs, navigate audits, strengthen security controls, and improve operational resilience.

Jonathan holds an MBA and is a Certified CIP Compliance Professional (C3P). His experience includes supporting NERC CIP and ISO 27001 implementation, auditing, and security governance initiatives across the energy sector. He is passionate about helping organizations translate complex regulatory requirements into practical processes that improve both compliance and security outcomes.

Kat Santana is the Founder and Principal Consultant of The Katalyst Tapestry consulting firm - specializing in workforce innovation, cross-sector strategy, and the human side of AI. She has supported cybersecurity education for critical infrastructure in WA since 2020. With 20+ years bridging industry, government, education, labor, and nonprofit sectors, she brings a systems-thinking lens to the complex challenge of building a resilient, future-ready workforce. Kat is known for turning technically complex topics into conversations that actually move the needle.

Justin is an electrical engineer with deep expertise in electric reliability compliance, built over more than fifteen years in the industry. He began his career at the Federal Energy Regulatory Commission (FERC), where he spent a decade specializing in Geomagnetic Disturbances, Electromagnetic Pulses, CIP Reliability Standard development, CIP sanctions, and both regional and FERC-led CIP audits. Since joining SERC in 2019, Justin has served as a CIP auditor and CIP risk assessment specialist and has established himself as the organization's go-to expert on Internal Control Programs.