Independent Security Leadership for Boards and Executive Teams
J. Paul Lynch, CISSP, ISSMP, CCSP, C|CISO
Founder & Principal Advisor — Executive Security Advisors
Leadership
Paul Lynch is a cybersecurity executive whose perspective was shaped by more than two decades of building technology before governing it — from architecting early e-commerce infrastructure to directing enterprise security programs at a $1.4 billion public REIT. That operating depth is what distinguishes ESA engagements: security leadership that understands both the boardroom and the infrastructure beneath it.
Paul has served in senior security leadership roles, serving as Chief Information Security Officer with accountability for enterprise risk strategy, board-level cyber risk reporting, and security program transformation. His experience spans publicly traded companies, regulated healthcare, managed security services, and complex enterprise manufacturing environments. He has governed programs under SOX, HIPAA, PCI-DSS, and emerging AI risk management requirements, consistently translating technical risk into language that boards and executive leadership can act upon.
In addition to his industry leadership, Paul serves as a subject matter expert contributor to (ISC)² and EC-Council, including contributions to the C|CISO Common Body of Knowledge. He maintains advisory relationships with Verizon, Rubrik, and eSentire, and is an active participant in executive security forums, including the Global CISO Summit and SecureWorld.
Career Experience
CubeSmart
Public REIT · $1.4B enterprise · 1,300+ locations · NYSE: CUBE
Built and governed an enterprise security program aligned to NIST CSF and CIS v8 for one of the largest self-storage REITs in the United States. Delivered annual Board of Directors cyber risk reporting, eliminated SOX audit findings, and reduced PCI findings by 30%. Led response to 25+ security incidents and modernized identity, cloud security, and detection capabilities across 20+ enterprise applications. Directed a $2M telecom consolidation and unified communications modernization initiative.
American Board of Internal Medicine
Regulated healthcare credentialing · Philadelphia, PA
Served as Chief Information Security Officer for a nationally recognized medical specialty board governing physician certification across internal medicine and 20 subspecialties. Implemented HIPAA-aligned controls, ISO/NIST governance frameworks, and quarterly executive risk reporting using expected loss versus control cost analysis. Secured academic medicine data exchanges supporting 50+ university-affiliated researchers. Presented on data security governance at the American Board of Medical Specialties annual conference.
Lenox Corporation
Consumer goods manufacturing & retail · SOX/PCI regulated
Led enterprise security, infrastructure, and risk management across a complex multi-channel manufacturer and retailer. Directed three teams of 13 professionals spanning server, database, and security operations. Established the corporate security incident response team, built the disaster recovery and business continuity program, and governed SOX-404 and PCI-DSS compliance — with Deloitte placing over 70% reliance on internal audit results. Reduced operating costs by 33%, server infrastructure by 60%, and network security monitoring costs by 90%. Negotiated a $500K financed hardware purchase during the company’s 2008 bankruptcy, saving $250K over three years.
Unisys
Managed security services · Global enterprise
Delivered customer-facing security leadership for California State University and the City of Minneapolis, aligning environments to NIST 800-53 and facilitating ISO 9000, ISO 20000, and ISO 27001 audits.
Credentials & Affiliations
Certifications
Certified Information Systems Security Professional (CISSP)
Information Systems Security Management Professional (ISSMP)
Certified Cloud Security Professional (CCSP)
Certified Chief Information Security Officer (C|CISO)
Building AI Strategy Certificate — (ISC)²
Education
M.S., Cybersecurity Management and Policy
University of Maryland Global Campus NSA Center of Academic Excellence · 4.0 GPA · In progress
B.S., Business Administration
Thomas Edison State University Concentration in Business Information Systems
Community & Advisory
(ISC)² and EC-Council Subject Matter Expert
Contributor to the C|CISO Common Body of Knowledge
Advisory: Verizon · Rubrik · eSentire · SecureWorld Philadelphia
IEEE Member, Computer Society
(ISC)² Philadelphia Chapter Secretary
Speaking & Industry Engagement
Paul regularly engages with executive and board-level audiences on cybersecurity governance, AI risk, and enterprise resilience.
Global CISO Summit · SecureWorld · American Board of Medical Specialties · Board & Executive Leadership Briefings
Work With Paul
Executive Security Advisors engagements are tailored, senior-led, and designed for organizations that require experienced security leadership without the overhead of a traditional consulting firm.