Ed Goff

Senior Vice President - Head of Identity and Access Management

Led enterprise IAM strategy, architecture, engineering, governance, and 24x7 operations across workforce, privileged, customer, and non-human identity, reporting to the Chief Information Security Officer as a member of the Cyber Leadership Team.

• Developed the enterprise IAM strategy and multi-year transformation roadmap aligning cybersecurity investment with business growth, regulatory expectations, operational efficiency, and enterprise resilience.
• Led IAM enablement of Microsoft Copilot and emerging agentic AI initiatives, establishing identity governance, role-based access boundaries, data protection guardrails, data minimization controls, logging requirements, and human oversight standards.
• Built the enterprise framework and standards for non-human and agentic AI identity governance, scoping lifecycle management, access certification, and privileged access controls for AI agents as adoption scaled.
• Led privileged access management modernization and platform migration, re-architecting session and credential management with pre-production resilience testing, disaster recovery validation, and failover and rollback runbooks.
• Led customer identity and access management modernization and implemented a 24x7 IAM support model integrated with the Service Desk, Network Operations Center, and Security Operations Center, codifying L1, L2, and L3 responsibilities and major incident procedures specific to identity services.
• Established a formal post-incident review program with documented root cause analysis and tracked remediation, and built executive dashboards putting IAM service health and residual risk in front of the CISO, CIO, and line-of-business heads.

Senior Vice President - Cybersecurity Division Manager, Identity and Access Management

Led a 336-person global IAM organization through the merger of equals between BB&T and SunTrust, which formed Truist as the sixth-largest United States bank holding company. Directed enterprise identity architecture, engineering, operations, governance, and transformation across thousands of applications.

• Led all IAM architecture and technology integration supporting merger convergence across 1,987 enterprise applications, delivering cross-company access between multiple heritage data centers through numerous conversion and testing events with virtually no customer or teammate disruption.
• Delivered Active Directory Trust and Sync for the merger of equals at .99999 accuracy with no negative teammate impact across all conversion events, contributing to a successful Client Day 1.
• Led development of dozens of reusable IAM patterns for federation, single sign-on, virtual directory, cloud identity, privileged access, third-party access, and application onboarding.
• Created and led implementation of a new cloud IAM lifecycle and tenant management model integrating multiple hosted solutions and a multi-cloud strategy.
• Led a department-wide Agile transformation producing a documented 595 percent improvement in organizational delivery efficiency within four months.
• Served as CISO delegate during regulatory examinations, executive committee presentations, cyber incidents, Board communications, and enterprise business disruption events.

Senior Vice President - Information Security Architecture and Strategic Planning

Selected to establish and lead enterprise security architecture for one of the nation's largest financial institutions, building a new organization accountable for cybersecurity strategy, secure technology design, enterprise standards, architecture governance, and long-term cybersecurity investment planning.

• Built and led an organization of 36 enterprise security architects aligned to business and technology domains, establishing the architecture governance, review disciplines, and technology standards that became foundational to enterprise engineering.
• Led the security architecture and secure development lifecycle design review for the original implementation of Zelle, working with the development team through multiple rounds of code quality review, security testing, and authentication, authorization, and logging architecture ahead of a nationally scaled real-time payments launch.
• Architected highly secure SWIFT payment environments using isolation, segmentation, dedicated shared services, and layered controls, then led the transition to a full SWIFT compliance program.
• Conceived, justified, and implemented enterprise third-party cyber risk management, partnering with Procurement, Legal, Vendor Management, and business executives to build and scale a risk-prioritized program including onsite assessments and remediation plan management.
• Created the enterprise data protection strategy and carried it from ideation to sustained operation, implementing encryption of data at rest, certificate lifecycle management, cloud access security broker, and data loss prevention capabilities.
• Served as lead architect for customer identity and access management modernization, and partnered with the Digital organization to deliver a modern internally developed authentication capability with risk-based and adaptive authentication and device-health signals.
• Authored merger and acquisition due-diligence kits used across numerous acquisitions and divestitures, and led the ecosystem evaluation and recommendation for all cybersecurity capabilities supporting planned convergence.

Enterprise Architect Leader - Cybersecurity Architecture Leader

Joined in a security engineering role and advanced into architecture leadership in 2004, creating and leading the enterprise and solution architecture function for cybersecurity at one of the nation's largest electric utilities. Led a team of seven security architects across transmission, distribution, generation, corporate IT, and operational technology in a no-downtime, heavily regulated environment. Served as the senior-most cybersecurity architect at Progress Energy, led the function into the merger of equals with Duke Energy, and held the same position for the combined company.

• Created and led the cybersecurity and interoperability portions of the Progress Energy Smart Grid grant application, resulting in the maximum 200 million dollar federal Department of Energy award within a 526.6 million dollar total project budget. Authored the cybersecurity and interoperability Security Plan submitted to the Department of Energy, one of only four accepted nationwide without comment, then led its implementation.
• Developed cybersecurity architecture supporting industrial control systems, SCADA, operational technology, identity management, network segmentation, remote access, and critical infrastructure protection.
• Drove the design and implementation of enterprise cybersecurity governance, working directly with the Chief Risk Officer and Enterprise Risk Management to align cybersecurity risk with the enterprise risk framework.
• Led the enterprise response to Executive Order 13636, Improving Critical Infrastructure Cybersecurity, owning the work from ideation through the design of the people, process, and technology solution and leading the implementation that brought the enterprise into compliance.
• Designed and implemented the enterprise e-Discovery capability as a full people, process, and technology solution managed in house, spanning legal hold, collection, processing, keyword review, privilege screening, and production to opposing counsel, and established the governance model connecting IT, Legal, and outside counsel through live litigation matters.
• Invested significant time in substations and plants earning the trust of the engineers supporting operational technology and protection system engineering, developing practical security solutions that balanced reliability and protection.

CyberCodee Current
Advisor, product strategy for an agentic AI platform reimagining IAM and cybersecurity maturity assessments, applying enterprise IAM, identity governance, privileged access, Zero Trust, CIAM, and OT and ICS expertise to adaptive assessment and framework mapping across NIST CSF, ISO 27001, and IEC 62443.

Axilon
Advisor, product development, national lab testing coordination, and business development for an early-stage operational technology and critical infrastructure security venture.

Systems, network, and database administration supporting mission-critical command and control systems, enterprise infrastructure, and directory services. Requested as a subject matter expert on unclassified-to-secret interfaces to consult with Pentagon officials, and partnered with Lockheed Martin Mission Systems and the Air Force Systems Program Office on secure command and control capability. Delivered the DISA accreditation package that formally authorized the Wing Command and Control System and its multilevel security capability. B-52 Crew Chief. Operations Desert Shield and Desert Storm veteran.