CISO · Cyber assurance · Author
I build security programs that can prove they work.
Former bank CISO and CIO, healthcare CISO, managed security vice president and U.S. Navy information assurance manager. Author of The Assurance Gap.
Profile
My work comes down to one question: can the organization prove that its controls work? I have answered it for bank examiners, auditors, insurers and boards.
At First Guaranty Bancshares I built the information security program under FDIC and FFIEC examination and was promoted from CISO to CIO within four months. At eQHealth Solutions I took the company to HITRUST CSF certification in 11 months. At Lockstep Technology Group I built two security operations centers and a $3.4M managed security practice. In the Navy I was the information assurance manager for more than 600 reserve centers.
Today I serve clients as a virtual CISO through Transformyx Technology Services and lead cybersecurity, network and infrastructure work at OneVision Consulting, including NIST-based risk frameworks for chemical manufacturing. My book, The Assurance Gap, defines the independent Cyber Assurance Officer.
Now
Career
Security and technology leadership across banking, healthcare, managed security services and the U.S. Navy.
Roles by organization, 2002 to 2026
Hover over or tab to a bar for the title and dates.
| Organization | Role | Dates |
|---|
Principal & Virtual CISOJan 2024 – Present
Managing Director of Cybersecurity, Network and InfrastructureMar 2024 – Present
Publicly traded bank holding company
SVP, Chief Information Security Officer and Chief Information OfficerMar 2022 – Nov 2023
Managed security services provider, formerly Transformyx
Vice President of CybersecurityOct 2017 – Mar 2022
Healthcare quality-improvement organization, now part of Acentra Health
Chief Information Security Officer, Executive DirectorApr 2015 – Oct 2017
Executive Director, Project Management OfficeSep 2013 – Apr 2015
Home health and hospice provider, now part of Optum
Director, Strategic IT Sourcing and ProcurementDec 2011 – Sep 2013
IT and managed services provider, now Lockstep Technology Group
Vice President of OperationsOct 2006 – Sep 2011
U.S. Navy
I enlisted in 1986 as an Electronic Warfare Technician and rose to EW1(SW) over ten years. In 1996 I was commissioned at Auburn University and served as an officer in the equivalent of today’s Information Warfare Officer role. Most of my career was at Naval Technical Training Center Corry Station in Pensacola, and I retired in 2006 as a commanding officer.
Enlisted
Guided-missile frigates and NTTC Corry Station
1986 – 1996
Commissioned
Auburn, Alabama
1996
Officer · most of my career
Naval Technical Training Center (NTTC) Corry Station, Pensacola, Florida
Information assurance
Commander, Navy Reserve Forces Command, New Orleans
Jun 2002 – May 2005
Command
Navy & Marine Corps Reserve Center (NMCRC) Baton Rouge
May 2005 – Oct 2006
Electronic warfare runs on the same disciplines a security program does. The medium moved from the radio spectrum to the network.
Electronic support
Detect, locate and classify every signal in the environment.
Security monitoring
Know what normal looks like on the network and catch what isn’t, with SIEM, EDR and a SOC.
Electronic attack
Disrupt or deceive an adversary’s sensors and systems.
Penetration testing
Attack your own controls before someone else does.
Electronic protection
Keep your own systems working while they are under attack.
Hardening and incident response
Configure, patch and rehearse so operations continue through an incident.
Information assurance
Protected the networks of 600+ Navy Reserve centers as their information assurance manager.
Cybersecurity program leadership
The same job under a new name: in 2014 the Defense Department adopted “cybersecurity” in place of “information assurance.”
Training
Master Training Specialist, with most of my career at the Navy’s technical schoolhouse.
Awareness and team building
Taught CISSP, CEH, CISM and CompTIA courses; ran a bank awareness program with 100% completion.
Command
Accountable for 300+ reservists, their readiness and the center’s budget.
Executive accountability
CISO and CIO reporting to executives, the board and regulators.
Education
Master of Science
Regis University
Denver, Colorado
Master of Science
Southeastern Louisiana University
Hammond, Louisiana
Bachelor of Science
Auburn University
Auburn, Alabama · commissioned a U.S. Navy officer here in 1996
Credentials
CISSPCertified Information Systems Security ProfessionalISC2 · since 2004
CRISCCertified in Risk and Information Systems ControlISACA
CGEITCertified in the Governance of Enterprise ITISACA
PMPProject Management ProfessionalProject Management Institute
CEHCertified Ethical HackerEC-Council
CCSFPCertified CSF PractitionerHITRUST
CMMC CCPCertified CMMC ProfessionalThe Cyber AB
CSMCertified ScrumMasterScrum AllianceBanking and financial services · Healthcare · Chemical manufacturing and critical infrastructure · Defense and government · Managed security services · Education · Automotive
Paperback · ISBN 979-8-234-24281-5
Kindle edition
The book
Why Cybersecurity Compliance Is Broken — and What It Takes to Fix It
Organizations pass their audits, hold their certifications and sign their insurance attestations, and they are breached anyway. The Assurance Gap argues that the costliest failure in cybersecurity is the absence of independent verification. Finance separates the people who keep the books from the people who audit them. Cybersecurity often lets the same providers operate the controls and vouch for them.
Drawing on enforcement actions, court cases, insurance disputes and the Pentagon’s own lessons, the book sets out the fix: six pillars of cyber assurance, continuous evidence in place of annual attestation, an independent Cyber Assurance Officer, and a program that begins with a 90-day assessment.
The expensive day is not the day of the breach. It is the day an examiner, an insurer, or a plaintiff’s lawyer compares what was attested with what was running.
The six pillars of cyber assurance
Controls in each pillar, 202 in all (Part IV of the book)
In development: The Assurance Gap Executive Workbook, with a worksheet for each chapter’s closing question, the six pillars as a self-assessment and a dated 90-day checklist.
Platform
The cyber-GRC platform I designed and built to put the book’s method to work: evidence comes in from the tools a company already runs, is tested against one control catalog, and goes out as a posture score and executive reports.
Evidence in
Endpoint, vulnerability and IT operations data from SentinelOne, Rapid7 and ManageEngine.
Tested in
One harmonized control catalog drawn from nine authoritative sources.
Mapped to
Reported as
Scored on a 200 to 850 scale, with risk assessments, vulnerability tracking and executive reports.
Speaking
Available for conference sessions, chapter meetings and board briefings.
Security and audit conferences
When one provider operates the controls, monitors them and vouches for them, findings come back clean without anyone lying. How the conflict works, why insurers deny claims over it, and how an independent assurance function fixes it without new tools.
ISACA, IIA and ISC2 chapters
An audit certifies what was true on one day, and controls drift afterward. How to test the gap between attested and operating controls with evidence dated when each control ran, verifiers independent of operators and an assurance calendar.
Boards and executive teams
The representations your organization has already made, three questions that test them, and a 90-day start: an owner, dated evidence for three controls and a board-level report.
Bio for programs and introductions
William F. Leach Jr. is a cybersecurity executive and practicing virtual CISO with more than 26 years in cybersecurity and information assurance. He has served as CISO and CIO of a publicly traded bank, CISO of a healthcare quality-improvement organization, VP of Cybersecurity at a national MSSP, and Information Assurance Manager for 600+ Navy Reserve centers. He founded Transformyx Technology Services and wrote The Assurance Gap (2026), which introduces the Cyber Assurance Officer.
Documents
The full record for proposals and panels: engagements, publications, teaching, frameworks and firm details.
Phone number available on request.
Contact
For leadership roles, board briefings, speaking or the book, email is the best way to reach me.
