Wells Larsen

Chief Information Security Officer

TRUST | SERVICE | PROTECTION

My why: To earn and honor trust with integrity and authenticity, serving generously and protecting people — by bringing clarity and shaping conversations so innovation moves quickly and safely.My passion is driven by three pillars: Trust, Service, and Protection. Cybersecurity, to me, is not just protection. It is enabling progress. I build security as a durable business capability through clear decision rights, simple operating rhythms, and practical guardrails that make the secure path the easy path.

© Wells Larsen. All rights reserved.

Resume / CV

Cybersecurity Executive | CISO | Risk & Transformation Leader

PROFESSIONAL SUMMARY

I am a cybersecurity executive and enterprise fixer who thrives on transforming chaos into clarity and risk into resilience. My career has been defined by leading organizations through critical inflection points such as post-breach recovery, rapid innovation, and large-scale modernization to rebuild trust, enable growth, and embed sustainable governance. Recognized as DC100, Top 100 Deputy CISO (2025), I translate complex technical risk into clear business and financial language that drives executive confidence and informed decision-making. I design self-sustaining programs that protect enterprise value, scale capability, and accelerate progress without friction, aligning with NIST, ISO 27001, HITRUST, HIPAA, PCI DSS, SOC 2, and GDPR frameworks to ensure resilience, regulatory alignment, and operational excellence. I lead with calm, structure, and direction in pressure situations, turning complexity into clarity and change into measurable, lasting performance.

STRATEGIC DIFFERENTIATORS

  • Risk-First Business Enablement: I build security programs that deliver frictionless enterprise growth while embedding risk, compliance, and resilience.

  • Translation Mastery: I convert complex technical risk into compelling business narratives that drive C-suite action and board confidence.

  • Cultural Architecture: I design and embed self-sustaining cultures of security awareness and shared accountability, turning compliance into a source of organizational pride.

  • Servant-Strategic Leadership: I multiply talent and scale enterprise resilience by insourcing key roles, hiring expert leaders, and empowering teams to own outcomes.

PROFESSIONAL EXPERIENCE

INTEGRIS Health — 04/2024 - Present
Chief Information Security Architect (Deputy CISO scope)
I was recruited as a Chief Information Security Architect, post-breach, with Deputy CISO responsibilities to rebuild and modernize the security program for Oklahoma’s largest healthcare system ($3.3B revenue, 15K caregivers, 20 hospitals, 184 clinics). My mandate was to restore trust, embed governance, and transform security into an enabler of patient care and enterprise confidence. I led a 20-month transformation across GRC, IAM, TVM, Security Operations, Engineering, and Awareness — restoring executive and board confidence, embedding governance, and driving measurable maturity gains.

  • Executive Alignment: When presenting to ELT, I translate technical risk into business and financial terms that drive informed, risk-aligned decisions.

  • Post-Breach Recovery: I partnered with counsel on OCR response and litigation preparation, closed breach-related gaps, implemented bi-annual audits, and established CMMI-based maturity assessments to rebuild executive and regulatory trust.

  • Organizational Redesign & Delivery Gains: I restructured the program into Security Engineering, SOC, and Service Delivery, insourced 38 roles and hired senior leaders, increasing project delivery 132% and reducing MTTR 67%.

  • Executive Governance & Operating Model: I formalized an executive charter defining shared accountability between the CISO Office and ELT, unified HIPAA, NIST, and ISO 27001 under one operating model, and launched councils for technology, security, and emerging tech governance.

  • Program Architecture & Elevation: I transformed four core security domains into structured sub-programs with appointed leaders, defined maturity roadmaps, and embedded continuous improvement cycles that sustain progress long after initial transformation.

  • TVM: The program cleared a backlog of 100K+ CVEs in seven months, expanded coverage to OT and medical devices, and implemented a maturity roadmap to sustain reduced exposure.

  • IAM: I rescued a failed SailPoint deployment, reduced onboarding incidents 78%, eliminated social engineering, and modernized password management with Azure SSPR.

  • Security Awareness: I hired a program lead and launched the “Security is Everyone’s Responsibility” campaign, embedding shared accountability and measurable culture KPIs.

  • Cyber Fusion Center: I recruited a former FBI incident response leader and evolved the SOC into a Cyber Fusion Center integrating threat hunting, intelligence, and response, with defined capability-maturity metrics.

  • Risk Transparency for Decisions: I centralized the enterprise risk register, standardized scoring, and instituted ELT-level financial impact reporting to align security investments with measurable risk reduction.

  • Zero Trust Architecture Modernization: I’m leading the organization’s shift from a legacy castle-and-moat model to a modern Zero Trust architecture that enables the business to adopt cloud services with confidence. I developed a three-year roadmap and sequenced foundational initiatives — CMDB overhaul, RBAC redesign with least privilege, and network segmentation — establishing the core framework for scalable, identity-driven Zero Trust adoption.

  • AI Governance & Data Protection Framework: I established an enterprise AI governance framework that enabled the business to adopt AI rapidly and responsibly. I embedded AI into the enterprise risk model and aligned it with NIST, ISO 27001, and GDPR to create a repeatable standard for evaluating AI use cases. I formed an AI Governance Board that brought business and clinical leaders into shared decision-making and standardized how each initiative is reviewed for risk, ethics, and compliance. I also secured M365 and Azure data sources so AI models train only on governed, trusted information, allowing the business to move forward with rapid AI adoption while maintaining trust and accountability.

  • Executive Clarity: I built a fully automated Power BI dashboard as a single source of truth for KPIs, risk and incident flow, project status, intake, and high-risk approvals — translating complexity into board-level clarity.

  • Resilience & Continuity: I achieved 100% BCP plan currency across business units and led quarterly DR tabletops to validate RTO and RPO and update recovery runbooks.

  • Recognition: Program & CISO named to Becker’s Hospital Review “53 CISOs & CPOs to Know (2025)” and personally recognized as DC100 Top 100 Deputy CISO (2025).

Optum Connect — 01/2015 – 04/2024
Chief Architect & Director of IT, Security, & Cloud
Founding leader; co-founded Optum’s Managed Service Provider (MSP) line of business, delivering end-to-end information technology (IT) and cybersecurity services for payer and provider clients. Helped scale the organization from a 5-person startup into a multi-billion-dollar line of business supporting seven healthcare systems by building shared-service architectures, standardized operating models, and scalable security capabilities.Clients Transformed: Triple-S of Puerto Rico, John Muir Health, Bassett Health, Northern Light Health, Owensboro Health, and Allina Health.

  • Managed Service Provider (MSP) Business Builder: Co-founded and scaled Optum’s Managed Service Provider (MSP) from a 5-person startup into a multi-billion-dollar line of business that helped small and mid-sized providers stay profitable and independent by reducing information technology (IT) spend, improving service quality, and accelerating modernization across seven healthcare systems.

  • Systems-Thinking Operating Model (Shared Services + Local Leadership): Applied systems thinking to design a hybrid operating model combining centralized shared services (standards, policies, procedures, reusable platforms), including Security Operations Center as a Service (SOC-as-a-Service) and Fully Managed Cloud-as-a-Service, with embedded local leaders aligned to regional priorities — strengthening trust, improving execution consistency, and scaling outcomes across healthcare systems.

  • Policy-Driven Cloud Guardrail System (Policy-as-Code + Everything-as-Code): Conceived and led the policy-driven cloud guardrail system powering Fully Managed Cloud-as-a-Service, enabling rapid builds in Microsoft Azure (Azure) and Amazon Web Services (AWS) while maintaining security and compliance by default. Delivered self-service provisioning that triggered Continuous Integration/Continuous Delivery (CI/CD) automation to apply policy baselines, enforce controls, and run Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), reducing provisioning and compliance cycles from months to days.

  • Executive Partnership (vCISO and vCIO): Served as virtual Chief Information Security Officer (vCISO) and virtual Chief Information Officer (vCIO) across six healthcare systems, advising executives on sequencing security investments, aligning roadmaps to business priorities and regulatory expectations, and improving service reliability with measurable risk reduction.

  • Strong Ground Leadership: (Psychological Safety + Thought-Leadership Pipeline): Built “Strong Ground” conditions across teams by prioritizing psychological safety, clear decision rights, and coaching with high accountability. Developed leaders who surfaced risk early, learned out loud, and carried standards forward — growing resilient thought leaders and durable ownership that sustained outcomes through change.

Target — 09/2012 – 01/2015
Security Architecture & Engineering Lead
Led engineering and operations for 22 enterprise-scale security platforms supporting retail and corporate environments. Oversaw technology strategy, platform stability, and continuous improvement for capabilities such as Proxy, PAM, MFA, SIEM, SSO, WAF, PKI, NAC, IDS/IPS, and vulnerability scanning.

  • Expanded a security operations engineering team from 8 to 25 members within a year, overseeing the management of 22 enterprise security platforms.

  • Collaborated with cross-functional teams to enhance security and stability across Target.com and retail stores, achieving greater organizational resilience and efficiency in a post-breach environment.

  • Led the comprehensive overhaul of Target's Root Cause Analysis (RCA) and problem management program, resulting in over $500,000 in savings in 2015 compared to the previous year.

  • Developed and deployed automation services to streamline workloads, achieving $200,000 in savings in 2013.

  • Identified and resolved a critical flaw in the SSL renewal process, designing automation to prevent downtime on Target.com, which avoided millions of dollars in potential lost revenue and eliminated the need for a costly third-party solution.

Boston Scientific — 05/2007 – 09/2012
Lead Network Security Engineer
Led Tier 2 (T2) production support software development for LATITUDE (medical device-classified web service), delivering troubleshooting, root cause analysis, and durable software mitigations. Later added responsibility for network security engineering and infrastructure strategy to improve platform resilience and availability. Ensured secure, scalable, and compliant design aligned with Health Insurance Portability and Accountability Act (HIPAA) and privacy requirements, while operating under Food and Drug Administration (FDA) validation and release governance.

  • Led Tier 2 (T2) troubleshooting, diagnosing defects, data issues, and integration failures impacting patient monitoring workflows.

  • Built Linux and Bash automation for log analysis and triage, reducing time to resolution and improving repeatability of root cause analysis.

  • Developed interim middleware fixes and software workarounds designed to remain stable for 12+ months, enabling safe operation while remediations progressed through Food and Drug Administration (FDA) review cycles.

  • Partnered with engineering, quality, and clinical stakeholders to ensure mitigations met safety, privacy, and regulatory expectations.

  • Added network security engineering and infrastructure hardening responsibilities (firewalls, load balancers, platform stability), improving resilience and availability for a global patient-care platform.

  • Directed engineers and vendors to deliver capacity and reliability upgrades, including Business Continuity and Disaster Recovery (BCDR) procedures and major storage expansion.

AWARDS

EDUCATION

Technological Leadership Institute, University of Minnesota - Twin Cities
Master of Science, Security Technologies
The Master of Science in Security Technologies (MSST) shapes tomorrow’s analytical and risk management policymakers and innovators through a multi-disciplinary graduate program developed in response to growing demand in many levels of industry and government. The program draws on the fields of systems risk analysis, engineering (hardware and software), emerging technologies, economics, human factors, law, food and bio safety, and public policy to teach and investigate security technologies and address pertinent issues.University of Wisconsin - Superior
Bachelor of Science, Computer Science + Mathematics Concentration

About

MY STORY

From builder to security leaderI began my career in software development, and network security became my bridge into cybersecurity. From there, I went deep into security engineering — building and hardening tooling and platforms across the full security program, including identity and access, cloud and platform security, application security, data protection, vulnerability management, and governance and risk.After years of building and operating those systems, I moved into architecture — applying systems theory thinking to design repeatable patterns, guardrails, and operating models that scale across teams and environments.As my scope continued to grow, that architectural focus expanded from systems to programs. I began defining strategy, operating models, decision rights, and measurable outcomes so security becomes a durable business capability, not just well-designed technology.That combination of builder depth and program architecture is what ultimately shaped my leadership path: clarity, practicality, and measurable progress.Deep technical foundation, then product and business leadershipI’ve spent my career building and scaling security capabilities - first as an engineer, then as an architect, and now as a leader focused on strategy and execution.I eventually designed a solution that launched a managed service provider line of business at a Fortune 5 organization, which grew into a multi-billion-dollar line of business. In that role, my work split into two tracks:

  • Executive alignment (vCIO and vCISO): Drove IT and InfoSec strategy alignment with exec leadership (roadmaps, investment decisions), with dotted-line influence across ~600 employees.

  • Product Delivery: Delivered an everything-as-code secure guardrails cloud platform and launched SOCaaS, leading a 25-person DevOps/DevSecOps team.

In my vCIO and vCISO work, I helped rebuild and mature IT and InfoSec programs across six organizations: Triple-S of Puerto Rico, John Muir Health, Bassett Health, Northern Light Health, Owensboro Health, and Allina Health. Repeating that work across different environments helped me refine a practical, repeatable approach: stabilize what’s urgent, align leaders on priorities and decision rights, and implement durable guardrails that improve security without slowing delivery.Rebuilding after a breachIn 2024, I was recruited to INTEGRIS Health after a breach by a CISO I had previously supported through Optum Connect. She asked me to help rebuild and mature the program. Over the next 20 months, I led stabilization and maturity improvements that contributed to external recognition, including a Deputy Chief Information Security Officer award (2025) and Becker’s recognition for my Chief Information Security Officer.Across every role, my focus is the same: earn trust quickly, bring clarity to decision-making, and build security capabilities that protect people while enabling the business to move faster and safer.

VALUES & PASSION

TRUST | SERVICE | PROTECTION
My WHY: To earn and honor trust with integrity and authenticity, serving generously and protecting people — by bringing clarity and shaping conversations so innovation moves quickly and safely.My WHY Statement is held up by three pillars: Trust, Service, and Protection. These principles are core to who I am and what drives me. They have shaped everything I have built, and everyone I have led, mentored, and coached. My motivation has never been the technology itself, but the meaning that comes from helping people in need. I live for the moment when people feel safe again, when chaos gives way to direction, and when teams rediscover confidence after disruption.

LEADERSHIP DNA

My work begins with people. I believe trust is earned through small, genuine, non-transactional interactions. Enough of those moments, and we build community. Because cybersecurity and technology are complicated and can elicit fear, I focus on clarity and shaping the conversation so decisions can be made in the absence of fear.Cybersecurity, to me, is not just about protection. It is about enabling progress. The best security gives people confidence to move faster and safer. I take a systems-theory-informed approach, building security as a durable business capability through clear decision rights, simple operating rhythms, and practical guardrails that make the secure path the easy path. When the foundation is right, teams own their craft, trust grows, and security becomes part of the business flow.Success in this field is not about firewalls or frameworks. It is about translation and alignment. I help leaders see risk in their own language, turn complexity into clear choices, and shape priorities that teams can execute with confidence. I strive to be an expert storyteller, using clear, relatable narratives that executives can understand and act on. My focus is resilience that compounds: strong fundamentals, healthy culture, and leaders who carry the mission forward through change.My leadership has been shaped by influences like Simon Sinek, Brené Brown, and Garry Ridge. My style blends servant and strategic principles. I build capability by teaching, not directing, enabling people to grow into experts who can sustain the mission long after I have stepped away.I am a believer in “Strong Ground,” where teams feel psychological safety and are empowered to grow into thought leaders. I believe trust-culture is the ultimate control, and forming a trust-based culture within security is essential to stay nimble enough to pivot when our adversaries pivot.I see security as a force for progress. I create teams and environments where people can innovate boldly because the guardrails are strong, the direction is clear, and the culture supports them. I design systems that work, but more importantly, I build cultures that last.

MEMBERSHIPS & VOLUNTEERING

  • Board Member - CyberRisk Collaborative - Twin Cities Chapter: The Twin Cities Leadership Board is a group of local leaders committed to the idea that national security and critical infrastructure resiliency is strengthened through peer-to-peer knowledge sharing, diversity, and leadership development.

  • Advisory Board Member - Halcyon's Healthcare Advisory Board: The Halcyon Healthcare Advisory Board brings together experienced healthcare and technology leaders to help shape Halcyon’s approach to innovation in complex, high-trust healthcare environments. The board provides strategic guidance on responsible adoption, risk, trust, and governance, ensuring that healthcare-focused initiatives and founders are supported with the right guardrails to scale safely and effectively.

  • Mentor - Irvine Technology Corporation (ITC) - Women in Technology Leadership Program: This program is designed to empower women pursuing technology leadership roles by providing them with a rigorous 13-week curriculum tailored to advance their careers toward CIO, CISO, and executive positions.

  • Member - Private Directors Association: Member of the Private Directors Association (PDA), a national organization dedicated to helping private companies build high-performing boards. PDA focuses on the unique governance needs of private, family-owned, employee-owned, and private equity-backed companies and connects executive leaders who are current and aspiring board members. Currently seeking private board certification.

  • Member - Gartner C-Level Communities: Gartner C-Level Communities fosters leadership development and collaborative exchange among North America's top executives. We bring together thousands of c-suite executives each year to create unmatched opportunities for leaders of the best companies to network, share, and learn.

  • Member - SANS CISO Network: An exclusive networking group for CISOs and senior security professionals. The SANS CISO Network provides its members with a platform to influence our digital future and make the world a safer place.

  • Member - InfraGard: InfraGard is a partnership between the FBI and members of the private sector. The InfraGard program provides a vehicle for seamless public-private collaboration with government that expedites the timely exchange of information and promotes mutual learning opportunities relevant to the protection of Critical Infrastructure. With thousands of vetted members nationally, InfraGard's membership includes business executives, entrepreneurs, military and government officials, computer professionals, academia and state and local law enforcement; each dedicated to contributing industry specific insight and advancing national security.

  • Member - Team8 CISO Village: The Team8 CISO Village is a global community of cyber security senior executives, CISOs and thought leaders from leading enterprises. The Village is an avenue for exchanging ideas, collaborating as an industry, and promoting innovation in cyber security.

  • Member - The CISO Society: The CISO Society is a private community of CISOs collaborating on everything from security strategy, industry challenges, project roadmaps, technology partners, talent acquisition, leadership and investments. They promotes trusted, peer-reviewed decision-making and strategic collaboration, facilitate vendor due diligence backed by actual CISO feedback, supports leadership development—transforming technical roles into strategic business enablers and help members stay ahead on hot topics like AI risk governance, third-party resilience, and team well-being.

  • Advocate - KDIGO (Kidney Disease: Improving Global Outcomes): An independent, global nonprofit organization that develops and publishes evidence-based clinical practice guidelines for kidney disease. KDIGO's mission is to improve the care and outcomes of people with kidney disease worldwide by promoting coordination, collaboration, and consensus in the development and implementation of high-quality, evidence-based clinical guidelines across the full spectrum of kidney health.

Insights

BLOG ENTRIES

ADVOCACY

  • Psychological Safety in the Workplace: I believe teams do their best work when it is safe to ask questions, surface risk early, and disagree respectfully. Psychological safety creates the conditions for accountability, learning, and speed without blame.

  • Responsible & Ethical AI Adoption: I support narrow-focus Artificial Intelligence that advances innovation in practical, measurable ways. At the same time, I am cautious about Artificial General Intelligence (AGI), where capability may outpace governance and control could be lost. I advocate for transparent, well-governed use of Artificial Intelligence with clear guardrails, accountable stewardship, and a bias toward preventing harm.

  • Transplant Awareness: Organ donation and transplant programs save lives and restore families. I support efforts that increase awareness, access, and empathy for the long path patients and caregivers walk before and after transplant.

  • Innovative Healthcare: Healthcare should be both high-trust and high-velocity. I support innovation that improves care delivery, reduces clinician burden, and strengthens patient safety without adding unnecessary complexity.

  • Animal Protection: I have a deep love for dogs, and that love extends into a broader commitment to humane treatment and reducing animal suffering. I support responsible stewardship, rescue and adoption efforts, and practical policies that protect vulnerable animals.

  • Environmental Protection: Healthy environments are foundational to human health and long-term stability. I support practical, responsible action that preserves natural spaces and reduces harm for future generations.

  • Neurodiversity & ADHD Inclusion: Human cognition is not one-size-fits-all. I support environments that recognize and value neurodivergent ways of thinking, including Attention-Deficit/Hyperactivity Disorder (ADHD). When organizations design work around clarity, flexibility, and trust—rather than rigid norms—they unlock creativity, pattern recognition, deep focus, and innovation that might otherwise be lost. I advocate for practical accommodations, reduced stigma, and leadership approaches that see neurodivergence not as a deficit to be managed, but as a capability to be understood and supported.

RECENT READINGS

  • People Skills for a Virtual World Collection By: Harvard Business Review

  • Harvard Business Review Emotional Intelligence Collection By: Harvard Business Review

  • Being Your Best Collection By: Harvard Business Review

  • Captivate By: Vanessa Van Edwards

  • Cues By: Vanessa Van Edwards

  • Things My Son Needs to Know about the World By: Fredrik Backman

  • A Man Called Ove By: Fredrik Backman

  • Any Dumb-Ass Can Do It By: Garry Ridge

  • The Grand Philosophy Collection By: Marcus Aurelius

  • Late Bloomers By: Rich Karlgaard

  • Falling Upward By: Richard Rohr

  • Trust and Inspire By: Stephen M.R. Covey

  • Daring Greatly By: Brené Brown

  • Read Your Mind By: Oz Pearlman

  • Atlas of the Heart By: Brené Brown

  • Rising Strong By: Brené Brown

  • Strong Ground By: Brené Brown

  • The Next Conversation By: Jefferson Fisher

  • Alchemy By: Rory Sutherland

Contact

Please reach out if you want to contact me.

Thank you

Thank you for reaching out.
I received your message and will get back to you shortly.