Wells Larsen

Chief Information Security Officer

TRUST | SERVICE | PROTECTION

My why: To earn and honor trust with integrity and authenticity, serving generously and protecting people — by bringing clarity and shaping conversations so innovation moves quickly and safely.My passion is driven by three pillars: Trust, Service, and Protection. Cybersecurity, to me, is not just protection. It is enabling progress. I build security as a durable business capability through clear decision rights, simple operating rhythms, and practical guardrails that make the secure path the easy path.

© Wells Larsen. All rights reserved.

Resume / CV

Cybersecurity Executive | CISO | Risk & Transformation Leader

PROFESSIONAL SUMMARY

I am a cybersecurity executive and enterprise fixer who thrives on transforming chaos into clarity and risk into resilience. My career has been defined by leading organizations through critical inflection points such as post-breach recovery, rapid innovation, and large-scale modernization to rebuild trust, enable growth, and embed sustainable governance. Recognized as DC100, Top 100 Deputy CISO (2025), I translate complex technical risk into clear business and financial language that drives executive confidence and informed decision-making. I design self-sustaining programs that protect enterprise value, scale capability, and accelerate progress without friction, aligning with NIST, ISO 27001, HITRUST, HIPAA, PCI DSS, SOC 2, and GDPR frameworks to ensure resilience, regulatory alignment, and operational excellence. I lead with calm, structure, and direction in pressure situations, turning complexity into clarity and change into measurable, lasting performance.

STRATEGIC DIFFERENTIATORS

  • Risk-First Business Enablement: I build security programs that deliver frictionless enterprise growth while embedding risk, compliance, and resilience.

  • Translation Mastery: I convert complex technical risk into compelling business narratives that drive C-suite action and board confidence.

  • Cultural Architecture: I design and embed self-sustaining cultures of security awareness and shared accountability, turning compliance into a source of organizational pride.

  • Servant-Strategic Leadership: I multiply talent and scale enterprise resilience by insourcing key roles, hiring expert leaders, and empowering teams to own outcomes.

PROFESSIONAL EXPERIENCE

INTEGRIS Health — 04/2024 - Present
Security Executive | Operating at Deputy CISO scope
I was recruited as a Cybersecurity Executive, post-breach, with Deputy CISO responsibilities to rebuild and modernize the security program for Oklahoma’s largest healthcare system ($3.3B revenue, 15K caregivers, 20 hospitals, 184 clinics). My mandate was to restore trust, embed governance, and transform security into an enabler of patient care and enterprise confidence. I led a 20-month transformation across GRC, IAM, TVM, Security Operations, Engineering, and Awareness — restoring executive and board confidence, embedding governance, and driving measurable maturity gains.

  • Executive Alignment: I present regularly to ELT, translating technical risk into business and financial terms that drive informed, risk-aligned decisions.

  • Post-Breach Recovery: I partnered with counsel on OCR response and litigation preparation, closed breach-related gaps, implemented bi-annual audits, and established CMMI-based maturity assessments to rebuild executive and regulatory trust.

  • Organizational Redesign & Delivery Gains: I restructured the program into Security Engineering, SOC, and Service Delivery, insourced 38 roles and hired senior leaders, increasing project delivery 132% and reducing MTTR 67%.

  • Executive Governance & Operating Model: I formalized an executive charter defining shared accountability between the CISO Office and ELT, unified HIPAA, NIST, and ISO 27001 under one operating model, and launched councils for technology, security, and emerging tech governance.

  • Program Architecture & Elevation: I transformed four core security domains into structured sub-programs with appointed leaders, defined maturity roadmaps, and embedded continuous improvement cycles that sustain progress long after initial transformation.

  • TVM: The program cleared a backlog of 100K+ CVEs in seven months, expanded coverage to OT and medical devices, and implemented a maturity roadmap to sustain reduced exposure.

  • IAM: I rescued a failed SailPoint deployment, reduced onboarding incidents 78%, eliminated social engineering, and modernized password management with Azure SSPR.

  • Security Awareness: I hired a program lead and launched the “Security is Everyone’s Responsibility” campaign, embedding shared accountability and measurable culture KPIs.

  • Cyber Fusion Center: I recruited a former FBI incident response leader and evolved the SOC into a Cyber Fusion Center integrating threat hunting, intelligence, and response, with defined capability-maturity metrics.

  • Risk Transparency for Decisions: I centralized the enterprise risk register, standardized scoring, and instituted ELT-level financial impact reporting to align security investments with measurable risk reduction.

  • Zero Trust Architecture Modernization: I initiated and am leading the organization's shift from a legacy castle-and-moat model to a modern Zero Trust architecture that enables the business to adopt cloud services with confidence. I developed a three-year roadmap and sequenced foundational initiatives — CMDB overhaul, RBAC redesign with least privilege, and network segmentation — establishing the core framework for scalable, identity-driven Zero Trust adoption.

  • AI Governance & Enablement: I established an enterprise AI Governance Council and built the organization's first AI governance framework — incorporating AI-specific controls from NIST, ISO 27001, and GDPR, securing M365 and Azure data foundations, and extending the TPRM vendor questionnaire to address emerging AI risk before most organizations had a framework for it.

  • GRC Program Transformation: I rebuilt a limited GRC function into a mature, enterprise-wide governance program — overhauling TPRM, consolidating change governance, launching an executive Information Security Council, and hiring a dedicated GRC Lead to own it long-term.

  • Executive Clarity: I built a fully automated Power BI dashboard as a single source of truth for KPIs, risk and incident flow, project status, intake, and high-risk approvals — translating complexity into board-level clarity.

  • Resilience & Continuity: After years of dormancy, I drove enterprise-wide BCP renewal — coordinating business units across 20 hospitals and 184 clinics to rebuild plans from the ground up and establishing a structured quarterly presentation cadence to achieve full coverage within a single year.

  • Recognition: Personally recognized as DC100 Top 100 Deputy CISO (2025). The INTEGRIS security program was named to Becker's Hospital Review ‘53 CISOs & CPOs to Know’ (2025) — one year after a significant breach — reflecting the measurable transformation in program maturity and enterprise resilience.

Optum Connect — 01/2015 – 04/2024
Chief Architect & Director of IT, Security, & Cloud
Optum wanted to launch a managed services business for small and mid-sized healthcare systems but had no upfront capital to build the infrastructure. Traditional hosted services meant hardware, data centers, and absorbing all the risk before a single dollar arrived. I saw a different path. By architecting on Azure and becoming a Microsoft Cloud Service Provider, Optum could resell and manage client cloud environments without owning them — no upfront investment, no new balance sheet exposure, and no new attack surface introduced into Optum's core infrastructure. The model funded itself from the first contract. That architecture became the foundation of Optum Connect, which I helped scale from a five-person founding team into a multi-billion dollar managed services operation serving seven healthcare systems simultaneously — serving as virtual CISO and virtual CIO across all of them.Clients Transformed: Triple-S of Puerto Rico, John Muir Health, Bassett Health, Northern Light Health, Owensboro Health, and Allina Health.

  • MSP Security Architecture: I designed the shared security operating model — including SOC-as-a-Service and policy-driven cloud guardrails — that enabled seven healthcare systems to achieve and sustain compliance across HIPAA, NIST, and regulatory frameworks at scale.

  • Policy-Driven Cloud Guardrail System: I conceived and led the policy-as-code guardrail system powering Fully Managed Cloud-as-a-Service on Azure and AWS, enforcing security and compliance by default through CI/CD automation, policy baselines, and integrated SAST/DAST testing — reducing provisioning and compliance cycles from months to days.

  • Epic-on-Azure Security Architecture: I served as the cross-vendor security bridge between Epic and Microsoft Azure, refining early cloud design patterns for one of healthcare's most sensitive clinical platforms — contributing to architectural approaches later reflected in Microsoft's formalized guidance for enterprise healthcare deployments.

  • Executive Security Partnership (vCISO & vCIO): I served as virtual CISO/CIO across seven healthcare systems, advising executives on sequencing security investments, aligning roadmaps to regulatory expectations, and translating risk into business and financial terms.

  • Strong Ground Leadership: I built high-performing security teams by prioritizing psychological safety, clear decision rights, and a coaching culture — developing leaders who carried security standards and ownership forward through change.

  • Platform Innovation Legacy: The cloud guardrail platform I built became the catalyst for Optum's broader enterprise cloud transformation, driving adoption of automation-first, as-code architectures across the organization.

Target — 09/2012 – 01/2015
Security Architecture & Engineering Lead
I led engineering and operations for 22 enterprise security platforms supporting retail and corporate environments for one of the world's largest retailers. I scaled the team from 8 to 25 engineers in under a year, drove automation initiatives that delivered $700K+ in documented savings, and resolved a critical SSL flaw that prevented millions in potential lost revenue on Target.com — all within a post-breach environment demanding the highest standard of platform stability and operational resilience.

  • Expanded a security operations engineering team from 8 to 25 members within a year, overseeing the management of 22 enterprise security platforms.

  • Collaborated with cross-functional teams to enhance security and stability across Target.com and retail stores, achieving greater organizational resilience and efficiency in a post-breach environment.

  • Led the comprehensive overhaul of Target's Root Cause Analysis (RCA) and problem management program, resulting in over $500,000 in savings in 2015 compared to the previous year.

  • Developed and deployed automation services to streamline workloads, achieving $200,000 in savings in 2013.

  • Identified and resolved a critical flaw in the SSL renewal process, designing automation to prevent downtime on Target.com, which avoided millions of dollars in potential lost revenue and eliminated the need for a costly third-party solution.

Boston Scientific — 05/2007 – 09/2012
Lead Network Security Engineer
I served as a production and platform engineer for LATITUDE, a medical device-classified global patient monitoring system with data centers in the United States and Ireland. I architected the first-generation LATITUDE NXT platform, owned BCDR, engineered durable software mitigations to sustain compliant patient-care operations through FDA validation cycles, and hardened the platform against network-layer threats under HIPAA and FDA governance.

  • Led Tier 2 (T2) troubleshooting, diagnosing defects, data issues, and integration failures impacting patient monitoring workflows.

  • Built Linux and Bash automation for log analysis and triage, reducing time to resolution and improving repeatability of root cause analysis.

  • Developed interim middleware fixes and software workarounds designed to remain stable for 12+ months, enabling safe operation while remediations progressed through Food and Drug Administration (FDA) review cycles.

  • Partnered with engineering, quality, and clinical stakeholders to ensure mitigations met safety, privacy, and regulatory expectations.

  • Added network security engineering and infrastructure hardening responsibilities (firewalls, load balancers, platform stability), improving resilience and availability for a global patient-care platform.

  • Directed engineers and vendors to deliver capacity and reliability upgrades, including Business Continuity and Disaster Recovery (BCDR) procedures and major storage expansion.

AWARDS

EDUCATION

Technological Leadership Institute, University of Minnesota - Twin Cities
Master of Science, Security Technologies
The Master of Science in Security Technologies (MSST) shapes tomorrow’s analytical and risk management policymakers and innovators through a multi-disciplinary graduate program developed in response to growing demand in many levels of industry and government. The program draws on the fields of systems risk analysis, engineering (hardware and software), emerging technologies, economics, human factors, law, food and bio safety, and public policy to teach and investigate security technologies and address pertinent issues.University of Wisconsin - Superior
Bachelor of Science, Computer Science + Mathematics Concentration

About

MY STORY

I started as a software engineer. Network security became my bridge into cybersecurity, and from there I went deep — building and hardening identity systems, cloud platforms, application security tooling, vulnerability management programs, and governance frameworks across complex enterprise environments. I didn't just use these systems. I built them from the ground up, which means I understand how they break, why they drift, and what it actually takes to make them sustainable.After years of building and operating at that level, I moved into architecture — applying systems thinking to design repeatable patterns, guardrails, and operating models that scale across teams and environments. Then architecture expanded into program leadership: defining strategy, decision rights, operating rhythms, and measurable outcomes so security becomes a durable business capability, not just well-designed technology.That progression — engineer to architect to program leader — is not a resume arc. It is how I think. I see security the way an architect sees a system: inputs, dependencies, failure modes, and second-order effects. That wiring is what lets me move between a boardroom and a technical design session without losing fidelity to either side.The problem nobody had solvedEarly in my time at Optum, a senior leader came to me with a specific constraint: the organization wanted to launch a managed services business for small and mid-sized healthcare systems, but there was no upfront capital to build the infrastructure to do it. Traditional hosted services meant hardware, data centers, and absorbing all the risk before a single dollar of revenue arrived.
I saw a different path. By architecting on Azure and becoming a Microsoft Cloud Service Provider, Optum could resell and manage client cloud environments without owning them — no upfront investment, no new balance sheet exposure, and no new attack surface introduced into Optum's core infrastructure. The model funded itself from the first contract.That architecture became the foundation of Optum Connect, which grew from a five-person founding team into a multi-billion dollar managed services operation serving six healthcare systems. I served as virtual CISO and virtual CIO across all of them simultaneously — helping rebuild and mature IT and security programs at organizations including Triple-S of Puerto Rico, John Muir Health, Bassett Health, Northern Light Health, Owensboro Health, and Allina Health. Repeating that work across different environments, cultures, and leadership teams gave me something a single organization rarely can: a repeatable, practical playbook for stabilizing what's urgent, aligning leaders on priorities, and building guardrails that improve security without slowing delivery.Rebuilding after a breachIn 2024, I was recruited to INTEGRIS Health — Oklahoma's largest healthcare system — in the aftermath of a significant breach. The mandate was to rebuild trust, restore governance, and transform security from a liability into an enabler of patient care and enterprise confidence.Over twenty months, I led a ground-up transformation across every major security domain: GRC, identity, vulnerability management, security operations, engineering, and awareness. The program was recognized externally within a single year — I was named a DC100 Top 100 Deputy CISO, and the INTEGRIS security program was named to Becker's Hospital Review's "53 CISOs & CPOs to Know." That recognition mattered not because of the awards, but because of what it reflected: a program that had genuinely turned around, in a compressed timeline, under real pressure.What makes me most effective is not a preference for complexity — it is adaptability. I read what an organization actually needs and orient to that, whether it is post-breach stabilization, program maturity, cultural transformation, or executive alignment. That elasticity — the ability to shift shape without losing the underlying principles — is harder to find than any single specialized skill.

VALUES & PASSION

TRUST | SERVICE | PROTECTION
My WHY: To earn and honor trust with integrity and authenticity, serving generously and protecting people — by bringing clarity and shaping conversations so innovation moves quickly and safely.Trust, Service, and Protection are not values I selected from a list. They are patterns I recognized in myself after years of watching what I protect most fiercely, what I return to when things get hard, and what I cannot compromise even when it would be easier to look away.I live for the moment when people feel safe again — when chaos gives way to direction, when teams rediscover confidence after disruption, when a leader who was drowning in complexity finally sees a clear path forward. That moment is why I do this work. The technology is the vehicle. The people are the point.Cybersecurity, done right, is not about restriction. It is about enabling progress. The best security gives people the confidence to move faster and safer. When the foundation is right — clear decision rights, simple operating rhythms, practical guardrails — teams own their craft, trust grows, and security becomes part of the business flow rather than a barrier to it.

LEADERSHIP DNA

My work begins with people. I believe trust is earned through small, genuine, non-transactional interactions — consistency over time, follow-through without being asked, and the willingness to tell the truth even when it is uncomfortable. Enough of those moments, and you build something that no governance framework can manufacture: a culture where people feel safe enough to speak up, take ownership, and grow.I lead with calm, structure, and clarity — especially when the situation is anything but. Under pressure, my thinking sharpens rather than narrows. I have learned that a room in crisis needs someone who can hold the full picture while others are reacting to fragments, and translate that picture into a direction people can move toward. That is where I am most useful.My approach to security leadership is systems-informed: I think in interdependencies, incentives, failure modes, and second-order effects. I am drawn to building things that scale — not solutions that work once, but operating models that become how an organization works. I design governance that enables rather than constrains, and I measure success by whether the program continues to improve after I step back.I have been shaped by leaders and thinkers who believe that the best leadership is invisible in the best moments — Simon Sinek on purpose, Brené Brown on the courage that trust requires, and Garry Ridge on what it means to build a culture of learning rather than judgment. My style blends servant and strategic principles: I build capability by teaching rather than directing, and I invest in people's growth because that is where leverage compounds.I call this Strong Ground — an environment where psychological safety is not a policy but a practice, where people feel genuinely empowered to grow into thought leaders, and where trust is the ultimate control. When the culture is right, security does not slow the business down. It becomes the reason the business can move fast.

OPERATING STYLE & STRENGTHS

  • Turning complexity into clarity: My signature contribution is translating complexity — technical, organizational, or strategic — into clear narratives that help leaders decide and teams act. I use storytelling and analogy as tools, not decoration. The goal is never to transfer information. It is to change how someone sees the problem.

  • Building systems that outlast me: I design operating models, governance structures, and decision frameworks with one question in mind: will this still work when I am no longer in the middle of it? Succession is not an afterthought. It is the measure of whether the work was real.

  • Trust-building as a leadership practice: I build trust slowly and authentically — through consistency, follow-through, and genuine curiosity about the people I work with. I am not performing interest. When people sense that, they open up quickly, and the foundation forms early.

  • Elasticity under pressure: I read what an organization needs and orient to it — post-breach stabilization, program maturity, cultural transformation, or executive alignment. I shift shape to fit the moment without losing the underlying principles. That adaptability is rarer than any single specialized skill, and it is what has made me effective across environments that looked nothing like each other.

  • Developing leaders, not dependencies: I invest in people's growth intentionally — coaching through real decisions, not just giving answers. The measure of success is not what someone can do with me in the room. It is what they can do when I am not.

  • Frictionless visibility by design: I design metrics, dashboards, and documentation that provide continuous, decision-ready insight without manual overhead. Visibility should be automatic, not a tax on the team.

  • Influencing without authority: Some of my most consequential work has happened across organizational lines where I had no direct authority — aligning competing stakeholders, building shared direction, and earning trust in environments where my only leverage was credibility and clarity.

MEMBERSHIPS & VOLUNTEERING

  • Board Member - CyberRisk Collaborative - Twin Cities Chapter: The Twin Cities Leadership Board is a group of local leaders committed to the idea that national security and critical infrastructure resiliency is strengthened through peer-to-peer knowledge sharing, diversity, and leadership development.

  • Advisory Board Member - Halcyon's Healthcare Advisory Board: The Halcyon Healthcare Advisory Board brings together experienced healthcare and technology leaders to help shape Halcyon’s approach to innovation in complex, high-trust healthcare environments. The board provides strategic guidance on responsible adoption, risk, trust, and governance, ensuring that healthcare-focused initiatives and founders are supported with the right guardrails to scale safely and effectively.

  • Mentor - Irvine Technology Corporation (ITC) - Women in Technology Leadership Program: This program is designed to empower women pursuing technology leadership roles by providing them with a rigorous 13-week curriculum tailored to advance their careers toward CIO, CISO, and executive positions.

  • Member - Private Directors Association: Member of the Private Directors Association (PDA), a national organization dedicated to helping private companies build high-performing boards. PDA focuses on the unique governance needs of private, family-owned, employee-owned, and private equity-backed companies and connects executive leaders who are current and aspiring board members. Currently seeking private board certification.

  • Member - Gartner C-Level Communities: Gartner C-Level Communities fosters leadership development and collaborative exchange among North America's top executives. We bring together thousands of c-suite executives each year to create unmatched opportunities for leaders of the best companies to network, share, and learn.

  • Member - SANS CISO Network: An exclusive networking group for CISOs and senior security professionals. The SANS CISO Network provides its members with a platform to influence our digital future and make the world a safer place.

  • Member - InfraGard: InfraGard is a partnership between the FBI and members of the private sector. The InfraGard program provides a vehicle for seamless public-private collaboration with government that expedites the timely exchange of information and promotes mutual learning opportunities relevant to the protection of Critical Infrastructure. With thousands of vetted members nationally, InfraGard's membership includes business executives, entrepreneurs, military and government officials, computer professionals, academia and state and local law enforcement; each dedicated to contributing industry specific insight and advancing national security.

  • Member - Team8 CISO Village: The Team8 CISO Village is a global community of cyber security senior executives, CISOs and thought leaders from leading enterprises. The Village is an avenue for exchanging ideas, collaborating as an industry, and promoting innovation in cyber security.

  • Member - The CISO Society: The CISO Society is a private community of CISOs collaborating on everything from security strategy, industry challenges, project roadmaps, technology partners, talent acquisition, leadership and investments. They promotes trusted, peer-reviewed decision-making and strategic collaboration, facilitate vendor due diligence backed by actual CISO feedback, supports leadership development—transforming technical roles into strategic business enablers and help members stay ahead on hot topics like AI risk governance, third-party resilience, and team well-being.

  • Advocate - KDIGO (Kidney Disease: Improving Global Outcomes): An independent, global nonprofit organization that develops and publishes evidence-based clinical practice guidelines for kidney disease. KDIGO's mission is to improve the care and outcomes of people with kidney disease worldwide by promoting coordination, collaboration, and consensus in the development and implementation of high-quality, evidence-based clinical guidelines across the full spectrum of kidney health.

Insights

BLOG ENTRIES

ADVOCACY

  • Psychological Safety in the Workplace: I believe teams do their best work when it is safe to ask questions, surface risk early, and disagree respectfully. Psychological safety creates the conditions for accountability, learning, and speed without blame.

  • Responsible & Ethical AI Adoption: I support narrow-focus Artificial Intelligence that advances innovation in practical, measurable ways. At the same time, I am cautious about Artificial General Intelligence (AGI), where capability may outpace governance and control could be lost. I advocate for transparent, well-governed use of Artificial Intelligence with clear guardrails, accountable stewardship, and a bias toward preventing harm.

  • Transplant Awareness: Organ donation and transplant programs save lives and restore families. I support efforts that increase awareness, access, and empathy for the long path patients and caregivers walk before and after transplant.

  • Innovative Healthcare: Healthcare should be both high-trust and high-velocity. I support innovation that improves care delivery, reduces clinician burden, and strengthens patient safety without adding unnecessary complexity.

  • Animal Protection: I have a deep love for dogs, and that love extends into a broader commitment to humane treatment and reducing animal suffering. I support responsible stewardship, rescue and adoption efforts, and practical policies that protect vulnerable animals.

  • Environmental Protection: Healthy environments are foundational to human health and long-term stability. I support practical, responsible action that preserves natural spaces and reduces harm for future generations.

  • Neurodiversity & ADHD Inclusion: Human cognition is not one-size-fits-all. I support environments that recognize and value neurodivergent ways of thinking, including Attention-Deficit/Hyperactivity Disorder (ADHD). When organizations design work around clarity, flexibility, and trust—rather than rigid norms—they unlock creativity, pattern recognition, deep focus, and innovation that might otherwise be lost. I advocate for practical accommodations, reduced stigma, and leadership approaches that see neurodivergence not as a deficit to be managed, but as a capability to be understood and supported. Ground Breaking Research: When all you’ve got is a tree-climb test, every fish looks like a failure.”

Book Shelf

RECENT READINGS

  • People Skills for a Virtual World Collection By: Harvard Business Review

  • Harvard Business Review Emotional Intelligence Collection By: Harvard Business Review

  • Being Your Best Collection By: Harvard Business Review

  • Captivate By: Vanessa Van Edwards

  • Cues By: Vanessa Van Edwards

  • Things My Son Needs to Know about the World By: Fredrik Backman

  • A Man Called Ove By: Fredrik Backman

  • Any Dumb-Ass Can Do It By: Garry Ridge

  • The Grand Philosophy Collection By: Marcus Aurelius

  • Late Bloomers By: Rich Karlgaard

  • Falling Upward By: Richard Rohr

  • Trust and Inspire By: Stephen M.R. Covey

  • Daring Greatly By: Brené Brown

  • Read Your Mind By: Oz Pearlman

  • Atlas of the Heart By: Brené Brown

  • Rising Strong By: Brené Brown

  • Strong Ground By: Brené Brown

  • The Next Conversation By: Jefferson Fisher

  • Alchemy By: Rory Sutherland

FAVORITE PODCAST EPISODES

Contact

Please reach out if you want to contact me.

Thank you

Thank you for reaching out.
I received your message and will get back to you shortly.