Malcom Harkins

Chief Security & Trust Officer at HiddenLayer Board Member, Advisor, Mentor/Coach



Malcolm Harkins is the Chief Security and Trust Officer at HiddenLayer. He has over two decades of experience in information security leadership roles at top technology companies, including Intel, Cylance, and others. He’s written multiple books on risk management, information security, and IT and earned awards from the RSAC, ISC2, Computerworld, and in May of 2026 was inducted in the CSO Hall of Fame. Harkins has testified before the Federal Trade Commission and the U.S. Senate Committee on Commerce, Science, and Transportation. Harkins is a Fellow with the Institute for Critical Infrastructure Technology, a non-partisan think tank providing cybersecurity expertise to the House of Representatives, Senate, and various federal agencies. He holds a bachelor’s degree in economics from the University of California at Irvine and an MBA in finance and accounting from the University of California at Davis. Harkins also taught at UCLA’s Anderson School of Management and Susquehanna University.

Keynote Day 1 - I Believe, I Belong, I Matter

Malcolm Harkins shares his journey and learnings from more than three decades of managing high-performing people, leading successful teams, and finding fulfillment in an ideal state. Malcolm will explore his 'I Believe, I Belong, I Matter℠' framework, which is based on his own life lessons, and he'll share how to inspire a sense of purpose, passion, and persistence to avoid burnout. In this talk he will share how channeling personal and team emotions you can make more empathetic and intelligent decisions. He will share strategies for effectively managing conflict and resolving challenges with determination and resilience. You will learn techniques to enhance individual and team performance.

Ken Kerrick

Chief Information Security Officer & Privacy Officer at Tri Counties Bank

Session - Resilience Under Fire: Leadership Lessons from Cyber Incidents, Wildfires, and Operational Disruption

As cyber threats continue to evolve and AI accelerates both innovation and risk, organizations must move beyond a prevention-only mindset and focus on resilience. This session explores how executive leaders, cybersecurity professionals, and risk practitioners can strengthen their ability to anticipate, withstand, recover from, and adapt to disruptive cyber events. Attendees will learn practical approaches to cyber recovery planning, business continuity, ransomware preparedness, crisis leadership, operational resilience, and recovery metrics. The discussion will also examine how AI-driven environments introduce new recovery challenges and opportunities, including automated response capabilities, data integrity validation, and resilient-by-design architectures. Participants will leave with actionable strategies for improving organizational resilience before, during, and after a cyber incident.

Thea Man Chavez

Chief Information Security Officer, ODI

A Forward-Thinking CISO and Security Strategist with a passion for building enterprise wide security programs that prioritize cyber resiliency, robust risk strategy, and strong governance. She believes that cybersecurity should fuel innovation, not slow it down. She shapes and executes strategies that align security with mission-critical business objectives, ensuring we stay ahead of emerging threats, vulnerabilities, and regulatory demands.

Her work is more than firewalls and audits — it’s about shaping strategy, anticipating threats, mitigating risks, adapting to change, and empowering progress. She is deeply passionate about AI ethics, mentorship, and innovation.

Outside of her day job, She is a speaker, podcast host, and mentor — committed to growing the next generation of cybersecurity leaders. Security isn't just defense. It's strategy. It's impact and it's pushing the boundaries of what’s possible tomorrow. 

Jennifer Elliot

Agency Information Security Officer, CalEPA

Jennifer Elliott is an accomplished information security and privacy leader with extensive experience leading complex, enterprise-wide initiatives that strengthen data protection, information security, and organizational resilience. In her role as the Agency Information Security Officer at the California Environmental Protection Agency, she provides strategic oversight of information security governance, aligning security priorities with business objectives and regulatory requirements. With respected certifications, including the CIPT, CISM, and PMP, Jennifer is recognized for her ability to bridge technical, operational, and leadership disciplines to address today’s evolving risk landscape.

Nithya Krishna

Agency Information Security Officer, CA Labor & Workforce Development

Nithya Krishna is the Agency Information Security Officer for the Labor and Workforce Development Agency, where she leads enterprise cybersecurity strategy, risk management, and incident response across a diverse portfolio of departments. In her role, she partners closely with agency executives and state leadership to strengthen security governance, ensure compliance with state and federal standards, and guide secure digital transformation efforts.



A certified PMP, CISM, and CISSP with a degree in Computer Science, Nithya brings a strong project and program management foundation to her security leadership. With experience in both the public and private sectors, she is known for bridging technical and business needs, delivering complex initiatives efficiently and collaboratively, and aligning security priorities with operational mission. Her leadership focuses on empowering teams, fostering a culture of shared responsibility for security, and enabling secure innovation.

Marcie Kahbody

California State Transportation Agency Information Officer and Deputy Secretary

Caltrans Chief Information Officer

Marcie Kahbody is the Deputy Secretary of Technology, Agency Information Officer for the California State Transportation Agency (CalSTA) as well as the Chief Information Officer for Caltrans. She is responsible for setting policies and coordinating information technology (IT) activities for Caltrans and agencywide. Marcie has held Information Technology positions within the State of California for over 32 years including the role of Agency Information Officer (AIO) at CalSTA since 2015. In this capacity, Marcie oversees IT for all of CalSTA’s Boards, Offices, Commissions, and Departments (including DMV, Caltrans, CHP, High-Speed Rail, and others).

Marcie possesses a record of proven outcomes as a collaborative leader, directing highly technical teams and successfully implementing enterprise-wide transformational initiatives and programs. Marcie focuses on fostering collaboration, building effective teams, encouraging two-way communication, and providing coaching and mentorship. She believes in the strength of diversity, building relationships, and utilizing innovative approaches to difficult problems. 

She is passionate about diversity, equity, and cultivating up and coming leaders. Marcie believes that success begins with a People First foundation and has championed it throughout her career. 

Marcie earned a bachelor’s degree in computer science from California State University Sacramento in 1990 and was a participant in the state’s Information Technology Leadership Academy in 2012. She is a Certified Microsoft Engineer and is part of Sac State’s Leadership for the Government Executive program. In 2023, Marcie received the esteemed ‘Women Who Mean Business Award’ from the Sacramento Business Journal.

In 2024, Marcie was featured in Comstock's Magazine's Women in Leadership issue. In 2025, Marcie was awarded the prestigious CIO of the Year by Government Technology.

Yesenia Ortiz

Cybersecurity Manager at Ernst & Young

Yesenia is a Cybersecurity Consultant Manager at Ernst & Young US LLP. She began her career at EY as an IT auditor, leading complex, multi-disciplinary teams across global markets to ensure the integrity and compliance of financial and quarterly filings for high-profile clients. Building on this foundation, she has spent the past 7 years

helping government clients in California strengthen their cybersecurity posture to better serve Californians.

She leads cross-functional teams to strengthen clients’ cyber resilience through penetration testing, policy development, compliance with key frameworks, and facilitating tabletop exercises. Separately, she develops and delivers impactful cyber awareness programs and speaker sessions that cultivate a culture of security

accountability across all levels of the workforce.

Beyond her client work, Yesenia leads EY’s Ripples Program in the Sacramento region, mobilizing EY professionals to create positive social impact through skills-based volunteering. She also serves as the OneInTech Director for ISACA Sacramento, dedicated to supporting women pursuing careers in technology and cybersecurity.

Corinna Martinez (Moderator)

ISACA Sacramento Conferences and Seminars Director

Tony Martin-Vegue

Founder, 95 Risk Advisory

Tony Martin-Vegue is the founder of 95 Risk Advisory, a cybersecurity risk quantification consultancy, and the author of From Heatmaps to Histograms: A Practical Guide to Cyber Risk Quantification (Apress, 2026), a book focused on helping practitioners bring quantitative rigor to cyber risk management with accessible methods and sound data. Drawing on more than 25 years in information security and deep roots in decision science and measurement theory, he has built quantitative risk programs for Fortune 500 companies and advises executives and boards on making better security decisions under uncertainty. He is an Executive Fellow at the Cyentia Institute, Co-Chair of the San Francisco FAIR Institute Chapter, and a FAIR Ambassador Award recipient.

Session - Beyond Red, Yellow, Green: What Defensible Cyber Risk Looks Like

We've all defended a rating we couldn't justify. Cyber risk has spent decades treating itself as the exception, too chaotic and too novel and too data-poor to measure, while other high-stakes fields learned to quantify uncertainty centuries ago. This keynote walks through the four objections that keep security stuck on the heatmap. We can't measure it. It's too chaotic to quantify. We don't have the data. The C-suite won't understand numbers. Each one already fell, decades or centuries ago, to someone working with less than we have now: Fermi, Lorenz, Graunt, Nightingale. The methods they used are more accessible than our profession pretends. You'll leave understanding why defensible risk analysis isn't a fight against the unknowable, and with three questions to ask the next time someone hands you a colored grid.



FAIR Concepts and a basic FAIR exercise will be covered part of the session.

Geeta Pyne

Former SMD, Chief Architect

Geeta is a highly experienced Chief Architect and Engineering Leader with over 30 years of industry experience. Proven record of accomplishments of transforming companies with next-generation architecture strategies, visions, execution roadmaps, driving step function changes and accelerating business outcomes. Most recently as the Chief Architect at TIAA, she has spearheaded AI first technology strategy and Agentic Enterprise to refine and reimagine the business in the age of AI. As an Architecture leader, she has built global high-performance teams, leading to significant improvements in efficiency, cost savings, and new revenue generation. 

She started her career as a research scientist developing algorithms for Satellite Image Processing and takes pride in holding IP in India’s first parallel computer PARAM and Image Processing system ISROVISION. 

·        Trusted advisor to CIOs/CTOs, transformation leader, and change agent with an entrepreneurial mindset.

·        Strong in Enterprise & Products Architecture, AI, Data, and Enterprise IT.

·        Advisor to multiple startups and passionate about growing and coaching the next generation of talents.

She holds a BS in Computer Engineering as a Valedictorian from Indian Institute of Engineering, Science & Technology. She is grateful to have studied with scholarships from the Government of India.

She is also involved with various professional organizations.

Co-President SIM SF Bay Are, Board Member/Advisor for Chief Architect Network & Women in Architecture, GTM Capital Advisory Board and several startups and VCs.

She loves to mentor, grow next generation talent, and make a difference especially to young graduates entering the workforce.

Fireside Chat - Data & AI as Strategic Business Assets: Managing the Lifecycle from Architecture to Value

Organizations are increasingly recognizing that data and AI are not merely technology capabilities—they are strategic business assets that require the same governance, lifecycle management, investment oversight, and performance measurement as any other critical enterprise asset. Yet many organizations continue to struggle with fragmented data ecosystems, inconsistent governance, poor data quality, and disconnected AI initiatives that fail to deliver sustainable business value.

This session explores how executive leaders can establish a comprehensive Data and AI Asset Management framework that spans the entire lifecycle—from creation and acquisition to governance, protection, utilization, monetization, and retirement. Attendees will gain insights into the architectural, operational, privacy, security, and business considerations necessary to transform data and AI into trusted, measurable, and scalable organizational assets.

Tolgay Kizilelma, PhD

ISACA Sacramento President

Tolgay Kizilelma, PhD is a business-driven IT, cybersecurity, governance, risk, and compliance (GRC) executive with more than 30 years of leadership experience spanning state government, healthcare, higher education, research, and private-sector organizations. Throughout his career, he has served in executive, leadership roles, helping organizations align technology, cybersecurity, governance, and business strategy to achieve measurable outcomes.

In addition to his industry leadership experience, Dr. Kizilelma is actively involved in academia, teaching cybersecurity governance, risk, and compliance (GRC), business, and data analytics courses at the graduate level, helping develop the next generation of technology and business leaders.



Currently serving as President of the ISACA Sacramento Chapter, Dr. Kizilelma previously served on the chapter’s Board of Directors as Academic Relations Director and Government & Regulatory Relations Director. He also served as President of the FBI Sacramento Citizens Academy Alumni Association and actively contributes to numerous advisory boards and nonprofit organizations focused on education, workforce development, cybersecurity awareness, professional training, and community outreach.

His previous leadership roles include serving as Chief Information Security Officer for multiple University of California campuses and Information Security Officer for leading Sutter Health hospitals in Northern California. Dr. Kizilelma holds more than 50 industry certifications and is an accredited ISACA instructor for its major certification programs. His academic credentials include a B.S. in Computer Engineering, an MBA, and a Ph.D. focused on information security, patient safety, and quality management systems.

His contributions to the cybersecurity profession and broader community were recognized with the prestigious 2022 C100 Award – Top 100 CISOs by CISOs Connect.

Ravi Gunturi

Information Security Officer, Capital One

Ravi Gunturi is a senior cybersecurity executive with over 25 years of experience leading enterprise security strategy, risk management, and large-scale transformation programs across healthcare and financial services.

He specializes in securing Generative AI and Agentic AI systems at enterprise scale, helping organizations navigate the governance, risk, and architectural challenges that come with deploying AI in regulated environments. His work focuses on aligning AI innovation with enterprise risk frameworks, regulatory expectations, and practical security controls — applied across the full AI lifecycle from model selection through inference and third-party risk.

Ravi has led security architecture, AI risk programs, and enterprise-wide security initiatives aligned to NIST AI RMF, ISO/IEC 42001, NIST 800-53, HITRUST, and OWASP. He is known for translating deeply technical security challenges into clear, actionable guidance for engineering teams, executive leadership, and boards. He holds CCISO, CHISL, GSLC, CISSP, CCSP, CEH, and AWS Security Specialty certifications, among others.

Beyond his executive leadership roles, Ravi serves on the advisory boards of Riscosity and SecurityScorecard, contributes to industry initiatives through EC-Council's CCISO Beta Testing Committee, and founded SecuritySignalHQ, a cybersecurity intelligence platform, and MyPictor, an AI-powered consumer application.  

He speaks on AI security and governance, Agentic AI risk, enterprise security architecture, and communicating cyber risk at the executive and board level.

Session - Trusting AI: Managing Third-Party Risk Beyond the Model

Matthew Rosenquist

Founder/CISO Advisor/Cybersecurity Strategist

Cybersecurity Insights

Matthew Rosenquist is a Chief Information Security Officer (CISO), cybersecurity strategist, and founder of Cybersecurity Insights, a trusted industry advisor to global businesses, academia, and governments. He specializes in emerging risks, disruptive digital technologies, and industry best practices in pursuit of optimal cybersecurity capabilities that align with strategic organizational goals.

With 30+ years of leadership, strategic insight, and operational experience, Matthew is recognized as an outspoken advocate and respected authority in cybersecurity. He keynotes international events, publishes annual cybersecurity predictions, and provides independent executive advisory services. Previously, he served as the Cybersecurity Strategist for Intel Corp., leading numerous foundational initiatives.

Beyond his CISO roles, Matthew serves on multiple technical and academic advisory boards, collaborating with top cybersecurity minds worldwide. His thought leadership has earned numerous industry recognitions, and he is ranked among the Top 10 cybersecurity experts on LinkedIn, with over 199,000 followers. He also hosts the Cybersecurity Insights podcast on YouTube, where he shares expert perspectives on evolving threats and defense strategies.

Keynote Day 2 - Managing the Evolving Risks of Agentic AI

As organizations rapidly adopt Agentic AI to automate decisions, orchestrate workflows, and act on behalf of humans, they are simultaneously introducing a new generation of cybersecurity and business risks that traditional security models were never designed to address. In this keynote, Matthew Rosenquist explores how attackers are leveraging AI to accelerate reconnaissance, automate exploitation, manipulate autonomous workflows, and weaponize trust relationships across increasingly interconnected environments.

Pegah Parsi

Chief Privacy Officer, UC San Diego

Pegah is the inaugural chief privacy officer for the UC San Diego campus where she spearheads the privacy and data protection efforts for the research, educational, and service enterprise. She is passionate about data ethics and privacy as human rights and civil liberties issues and is an advocate for the idea that privacy requires much more than legal compliance. She provides thought leadership on privacy values, ethical frameworks, governance, and AI.

Pegah manages a portfolio of privacy initiatives related to employees, students, applicants, alumni, and research and provides guidance on AI and privacy laws and regulations, such as the GDPR, FERPA, HIPAA, PIPL, California privacy laws, and research privacy/Common Rule. Her day may involve anything from a consult on license plate readers to research involving smart devices to using AI and predictive analytics in support of student success.

Prior to San Diego, Pegah was a privacy manager at Stanford University, focusing on medical studies and international collaborations. She is an attorney and holds an MBA. She serves as Of Counsel for XL Law & Consulting in the privacy practice and as a consultant for Secure Justice. In her spare time, she volunteers for the #AfghanEvac coalition as the Chief Privacy Officer and has served as the Vice Chair of the City of San Diego’s Privacy Advisory Board. She is a Veteran, who, among other things, was the Honor Grad of Army Truck Driver school!

Session - Privacy-Driven Innovation in the Digital Enterprise: Building Trust, Managing Risk, and Enabling Innovation

Privacy has rapidly evolved from a compliance obligation into a critical component of sustainable innovation, organizational trust, and resilience. Today's Chief Privacy Officers are expected to navigate complex expectations from data subjects, executive leadership, regulators, and stakeholders, all while managing rapid shifts in legal requirements, technology, data science, and geopolitical landscapes. 

This session examines how privacy leaders can balance innovation, customer expectations, regulatory obligations, and emerging technologies while positioning privacy as a strategic enabler rather than a business constraint.

Vitaliy Panych

CISO, State of California

Vitaliy Panych joined the Office of Information Security as the Deputy Chief Information Security Officer (CISO), effective beginning of 2019, and then taking over as the State CISO in the acting capacity shortly thereafter. In this role he has been focused on enabling the continuous maturity of Statewide Risk Governance, Security Operations, and Incident Response within the Executive branch in California.

Panych has more than 20 years of public and private sector experience, including security leadership roles within three of the largest California Agencies, including the largest Correctional organization in the world. Under the leadership of Panych, he has established highly functional information security teams to build cyber security defenses and operational capabilities from the ground up. This includes building new security operations practices for multiple agencies and supporting all facets of risk management for large scale multi-billion business operations in support of missions covering Law Enforcement, Public Safety, Medical, Educational, Financial benefit/collection, and Industrial complex. Panych’s education includes a bachelor’s degree from California State University, Sacramento, and possession of multitude of industry security professional certifications.

Raj Singh

North American CISO & Global Sr. Director, InfoSec & AI Protection Sagility Health

Raj Singh is a board-trusted cybersecurity and AI risk executive with 20 years of experience translating complex security and AI risk into strategy that organizations can fund, govern, and scale. As North America CISO at Sagility Health, he leads enterprise security strategy, AI governance, and compliance across global healthcare operations — positioning security as a business enabler and competitive differentiator. A keynote speaker and recognized thought leader, Raj is a selected member of the Gartner CISO C-Level Community and speaks at national forums on AI governance, digital trust, and the future of enterprise security leadership. He holds CISSP and CISM certifications and an M.S. in Computer Science.

Before joining CalHHS, Adam served as CISO at the California State Controller’s Office, safeguarding the financial systems of the world’s fifth-largest economy and ensuring compliance, fiscal transparency, and operational integrity at the highest levels of state government.

Vidhu Shekhar

Chief Data and Artificial Intelligence Officer, Caltrans

Vidhu Shekhar serves as Chief Data and Artificial Intelligence Officer (CDAO) at Caltrans, where he leads the department’s enterprise data governance and artificial intelligence strategy. In this role, he provides executive leadership for how Caltrans manages, governs, and applies data and AI technologies to support safer and more efficient transportation systems for Californians.

Prior to joining Caltrans, he served at Microsoft as the Americas Lead for Global Partnerships within Industry Solutions Delivery and previously as Government Strategy Lead for U.S. State and Local Government. His career also includes leadership roles at Workday and KPMG, as well as earlier public-sector experience spanning transportation, criminal justice, and municipal finance.

He is the author of Generative Artificial Intelligence Use Cases in State & Local Government and participates in the University of Washington Mobility Innovation Center, the PacTrans-USDOT Region 10 University Transportation Center, and the National Academy of Sciences, supporting the responsible adoption of emerging technologies in the public sector. In 2025, he was named to GovTech's Center for Public Sector AI 50 and nominated for the ITS America Hall of Fame Lifetime Achievement Award.



He holds a Master of Public Administration from the University of Southern California and is a Senior Executive Fellow at Harvard Kennedy School of Government.

Khalid Turk

Chief Health Information Officer, County of Santa Clara Health System

Khalid Turk, MBA, FCHIME, CHCIO, PMP, is Chief Health Information Officer at the County of Santa Clara Health System, a $4.5B integrated system with four hospitals, more than 30 clinics, and 11,000+ staff. He co-chairs the Clinical AI Review Committee and leads a $180M IT portfolio. He also serves as Head of Standards Operationalization at the Trustworthy Technology and Innovation Consortium (TTIC), where he works on translating IEEE UL 2933 and the TIPPSS framework into operational practice for regulated industries. Khalid is an independent voice on AI ownership, accountability, and scale. He is the founder of The HIT Academy and ExecPresenceOnline, and the author of the upcoming book, titled The Intelligent Transformation. He is a frequent speaker at national healthcare and technology forums. He publishes The HIT Academy newsletter (Healthcare Leadership and Technology in the Age of AI) and the satirical In the Loop with Khalid Turk cartoon series. Healthcare CIO. Strategist. Independent voice. 

Session - The Audit Trail Nobody Audits: Governing AI Before Regulators Force the Issue

AI systems are entering audit scope faster than governance frameworks can evolve. Most organizations cannot answer the basic questions auditors will ask within the next two years. Who approved this model? What data trained it? How is drift monitored? What triggers a rollback? This session looks at the operational gap between AI policy and AI practice, drawing on lessons from healthcare deployments where the stakes are highest. I will share what we have learned co-chairing a Clinical AI Review Committee at a $4.5B health system, and from my work at TTIC operationalizing IEEE UL 2933 and the TIPPSS framework into audit-ready controls. Attendees leave with a practical checklist for auditing AI systems already in production. Key takeaways: 1. Five questions every AI vendor should answer before procurement signs the contract 2. Why IEEE UL 2933 and NIST AI RMF are converging, and what that means for your audit program 3. How to build an AI control framework that survives regulator review 4. A field-tested rollback and incident response model for AI systems. 

Jonathan Snow

Deputy Director of the Homeland Security Division at the CA Governor's Office of Emergency Services

Deputy Director Jonathan Snow was appointed by Governor Newsom and joined the California Governor’s Office of Emergency Services (Cal OES) in August 2024. Deputy Director Snow provides direction and oversight to the Cal OES Homeland Security Division. Anchored at Cal OES, Deputy Director Snow is responsible for the State Threat Assessment Center (STAC), the California Cyber Security Integration Center (Cal-CSIC), and the Homeland Security Policy team. Prior to joining Cal OES, Deputy Director Snow spent 21 years with the Federal Bureau of Investigation (FBI) as a Special Agent, specializing in national security threat issues. Assigned to the Sacramento Field Office, his final assignment at the FBI was an executive management role as the Assistant Special Agent in Charge (ASAC) overseeing the National Security and Crisis management programs, where his responsibilities included International and Domestic Terrorism, Counterintelligence, Cyber, Critical Incident Response, SWAT, Training, National Academy, and Division Compliance/Chief Security Officer. Deputy Director Snow also spent over three years in Washington, D.C. as a Supervisory Special Agent with the FBI’s Counterintelligence Division.

Session: