Fractional / vCISO
Own the program end to end, from strategy and budget to incident response, or build it for a full-time hire.
Fractional CISO · Security innovation · Founder advisory
Wall Street-grade security, without the Wall Street overhead.
Over twenty years running security inside financial services. Now available as your CISO, your guide to the security technology worth adopting, and your practitioner sounding board on the way to market.
Book a call
No pitch deck. You’ll leave with your top priorities either way.
$30B
in AUM protected over seven years as former CISO of MIO Partners, McKinsey’s investment office
0 → 1
built the security function at Eton Park Capital Management, a $9B multi-strategy hedge fund
20+ yrs
in financial services security, from Morgan Stanley, TD Securities, Nomura and Goldman Sachs to CISO
6
security and AI startups advised, from ideation to design partner to go‑to‑market
Credentials
M.S. Information Security, Carnegie MellonCISSPCISMPMPAWS Certified Security – SpecialtyAWS Certified Solutions Architect – Associate
For firms
A seasoned CISO, sized to where you are.
For hedge funds, asset managers, fintechs and growth-stage companies that need senior security judgment — and a regulator-ready program — without a full-time executive hire.
Firms usually call me when…
- Your IT provider is your security program.
- An LP’s due diligence flagged security.
- Reg S-P now requires an incident response plan.
- Cyber insurance asked questions you couldn’t answer.
- A wire almost went to the wrong account.
- The board wants a cyber update.
- Your CISO left, and the program went too.
- Your analysts adopted AI before your policy did.
Ransomware & compliance
Tested backups, tabletops, a rehearsed recovery plan, and SEC, FINRA and NYDFS controls that hold up in an exam.
Security innovation
Vetted next-generation security tools matched to your real problems and piloted with discipline.
AI governance
Guardrails for AI tools and agents: data exposure, vendor risk, acceptable use and what regulators ask.
Third-party risk
A vendor risk program sized to your firm: tiering, due diligence, contract terms and monitoring.
Board & executive reporting
Reporting directors actually read: risk metrics against agreed thresholds and NIST CSF maturity.
How engagements work
01 — Assess
A clear-eyed baseline
A fixed-scope review of your risks, controls and regulatory posture, ending in a prioritized roadmap you can take to leadership.
02 — Lead
Ongoing CISO coverage
A monthly retainer with defined hours, a standing cadence with leadership, and on-call support when something goes wrong.
03 — Transition
Hand off with confidence
When it's time for a full-time leader, help define the role, interview candidates and transfer the program cleanly.
Not sure where to start?
Book a call
For cybersecurity founders
Build for the buyer by working with one.
I've been the first design partner, the first enterprise customer and a go‑to‑market advisor. I know what makes a CISO take the meeting, run the pilot and sign the PO — and what makes them stop answering.
Advisor to early-stage companies building the next generation of security and AI.
Companies I advise
Native Security
Daylight Security
Building for security buyers?
Book a call
Testimonials
In their words.
It’s rare to find a security leader who is deeply technical and equally effective in the boardroom. Israel is both. He translates complex risk into clear business decisions, and executives trust his judgment. I served as his Deputy CISO for three years as we protected $30B in assets under management. He builds programs that hold up to regulators and investors alike. He absorbs the pressure of the role so his people can do their best work, without ever losing his optimism or passion for the field. Bring Israel in and you get a stronger program and a stronger team.
Anthony PasquarielloFormer Deputy CISO, MIO Partners
Field notes
Lessons from the CISO seat.
Short notes and conversations on security leadership in financial services.
Ask a CISO for their top 5 risks and you get an answer. Ask for the top 5 exposed business processes and most of us stall.
Acid-test question 3: walking money movement, trading and onboarding with the people who run them, and finding where security and reliability break together.
Read on LinkedIn (opens in a new tab)Cut $250K from the security budget. Where does it hurt least?
Acid-test question 2: what each dollar buys, which controls carry the load, and what you can't cut because a regulator, client or insurer was promised it.
Read on LinkedIn (opens in a new tab)An extra $250K of security budget. Where does it buy the most risk reduction?
Answering the first of Phil Venables’ ten acid-test questions: five data sources, a lightweight FAIR model, and why the winner usually isn’t a new tool.
Read on LinkedIn (opens in a new tab)A full-time CISO can spend the first month listening. A fractional CISO can’t afford to.
What the first 30 days look like week by week, and why managing down matters as much as managing up.
Read on LinkedIn (opens in a new tab)Your fund administrator is part of your attack surface.
How MIO tiered vendors by criticality and data, what we asked the top tier, and why the administrator was in our callback tests.
Read on LinkedIn (opens in a new tab)My board read every breach headline. What shocked them was the business behind them.
Ransomware kits, double extortion and attackers with bosses and budgets, and why that changed the board's budget conversation.
Read on LinkedIn (opens in a new tab)The worst incident is the one you only rehearsed on paper.
Three ransomware tabletops at MIO, for the board, department heads and IT, and the gap all three exposed: who decides.
Read on LinkedIn (opens in a new tab)Hedge funds were talking security at a tech roundtable. We thought it deserved its own room.
Why Josh Stabiner and I co-founded the FS-ISAC Alternative Investors Council in 2016, and why funds need their own threat-sharing room.
Read on LinkedIn (opens in a new tab)A $5M security budget and a team of five. Most of the planning was deciding what not to do.
How OKRs, peer CISOs, the board and year-end tool cuts decided what a small team at MIO took on, and what it skipped.
Read on LinkedIn (opens in a new tab)My board shut down its InfoSec Committee after a year. I took it as a compliment.
How cyber moved under the Risk Committee, and why risk appetite statements with clear thresholds made 30 minutes a quarter enough.
Read on LinkedIn (opens in a new tab)Every six weeks, my board’s InfoSec Committee came back to one question: “Are we secure?”
Instead of vulnerability counts, the report tracked days to patch on critical business systems, repeat issues, and the classes of vulnerabilities we’d closed for good.
Read on LinkedIn (opens in a new tab)Day 8 of building a hedge fund’s security program, $40,000 left on a spoofed email.
No product on my list would have stopped it. What failed was people and process, so the first controls we put in weren’t tools.
Read on LinkedIn (opens in a new tab)The Security Debrief, Ep. 9: frontier AI regulation, auto-remediation and agentic defense
With Hagai Shapira, co-founder & CEO of Daylight Security, on AI governance, autonomous remediation, and why recent breaches still came down to basic patching.
Watch on YouTube (opens in a new tab)Let's talk.
Whether you need a CISO next month or a practitioner's read on your product, start with a conversation.
Book a call
Start with 30 minutes: no pitch deck, and you’ll leave with your top two or three priorities. Pick 60 minutes when you want to work through a specific problem.
Google Meet, weekdays 9am–5pm ET. Or send a note with the form; I reply within one business day.
About
Israel Bryski
A security executive with over twenty years inside financial services — from engineering and regulatory remediation at bulge-bracket banks to building and leading security programs at investment firms.
Why Bitahon? בִּטָּחוֹן is the modern Hebrew word for security. Its older, deeper meaning is trust — the confidence that what you rely on will hold. That's the standard this practice is built to.
- Chief Information Security OfficerMIO Partners (McKinsey's investment office)
- Director of Information Security — built the functionEton Park Capital Management
- Earlier security rolesMorgan Stanley · TD Securities · Nomura · Goldman Sachs
