About — vCISO / Fractional CISO, Denver, CO
Allen Allison
I help organizations build security programs that hold up under real pressure — a merger, a divestiture, a board review, an active incident. As a vCISO and fractional CISO based in Denver, my experience comes from being in the room for exactly those situations, not from a services catalog.
Track Record
Where this judgment was built
AWS
Strategic Security Advisor
At AWS, I worked directly with CISOs across a wide range of enterprise customers, advising on security architecture, governance, and risk decisions. That role gave me visibility into how security programs actually succeed and fail across dozens of organizations and industries — pattern recognition that a single-company security career doesn't provide.
Cognizant / TriZetto
M&A Due Diligence & Post-Acquisition Security Leadership
I led IT and cybersecurity due diligence for Cognizant's ~$2.7 billion acquisition of TriZetto, then stepped into the CISO role to manage remediation and integration. Due diligence uncovered significant HIPAA compliance gaps — and during the integration period itself, the company was targeted by a malicious third-party actor. I managed active incident response and long-term compliance remediation simultaneously, while two organizations merged systems and teams around us.
American Express Global Business Travel
CISO Through Divestiture
As CISO during American Express Global Business Travel's divestiture from American Express, I built the company's independent security operations from a standing start — while managing CapEx and OpEx in a way that kept the business attractive to investors and potential acquirers. That meant leaning on service providers rather than defaulting to direct hires wherever it made sense, keeping the business lean, flexible, and positioned for its next chapter.
Security Philosophy
My approach spans the full breadth of enterprise security, rather than deep specialization in any single tool or technology.
My approach spans the full breadth of enterprise security — identity and access management, SIEM and detection, cloud security architecture, and the emerging discipline of AI and agentic security governance — rather than deep specialization in any single tool or technology.
The organizations I've worked with need judgment about sequencing, risk, and tradeoffs under real pressure; that's what I bring to every engagement.
Let's discuss your organization's security posture.
A discovery call is the fastest way to find out if this is the right fit.