Jason Schaller | Cybersecurity, Risk and Technology

Selected impact

Evidence, not adjectives.

$1.23M

Unnecessary capital spend avoided

An aging firewall tier was headed for a $1.23 million replacement even though the firewalls remained vendor-supported and the environment they protected was scheduled to be retired within a year. The firewalls were not running the latest codebase, but the installed version was still supported. I challenged whether replacing supported infrastructure for an environment nearing retirement was justified. After reviewing the requirements, support status, risk, and retirement timeline, we kept the existing firewalls through the remaining life of the environment and avoided approximately $1.23 million in unnecessary capital spending.

$1M+

Annual SQL Server licensing savings

The database team identified an opportunity to reduce SQL Server licensing costs by more than $1 million annually by moving workloads to hosted infrastructure. The challenge was that the organization did not use cloud services and had effectively prohibited cloud adoption. I assessed the security and operational risks, developed the case for the exception, and worked with management to get the approach approved. The resulting move reduced SQL Server licensing costs by more than $1 million annually.

FDIC

First cybersecurity examination with no findings

I inherited a fragmented security program in a regulated banking environment where processes, tools, reporting, and responsibilities had developed piecemeal. As regulators introduced a new maturity-based cybersecurity assessment, I rebuilt the day-to-day security program, including vulnerability management, security monitoring, reporting, team responsibilities, and the tools supporting the work. The program subsequently received its first FDIC cybersecurity examination with no findings.

The work has always been about systems.

I want to understand how things work, how the pieces interact, where they can fail, and what can be improved.

A system can be technology, a process, a team, an organization, or a decision. I look at how those parts depend on one another, what evidence they give, and whether a change fixed the actual problem or delivered the desired outcome.

Professional focus

Understand the problem before trying to fix it.

Security & enterprise risk

Understand what is actually at risk, what controls are in place, and whether the evidence shows those controls are working.

Technology leadership

Understand the dependencies before making a decision. A change in one part of the environment can affect something that looks completely unrelated.

Resilience & response

Things fail. The important part is knowing what happens next, who is responsible, how you recover, and whether the plan actually works.

Infrastructure & operations

Security depends on infrastructure and operations that people understand, maintain, and monitor.

Governance, audit & compliance

A requirement is not proof. Look at how the control works in the real system and what the evidence actually supports.

AI, automation & workflow

I build workflows that give people, automation, and AI defined jobs, then validate the output and keep people involved where judgment matters.

Teams & mentorship

People make better decisions when they understand why the work matters, what is expected, and have room to develop their own judgment.

I build things, too.

Outside of my professional work, I build things. That includes independent media properties, publishing systems, educational methods, AI workflows, automation, and testing processes.

The subject changes. The method does not. I still start the same way: understand how it works, figure out what can be improved or repeated, and verify the result.

Building frameworks

When I find myself solving the same kind of problem repeatedly, I look for the parts that can be made consistent. In my firearms education work, that has led me to build structured methods for inspection, diagnosis, maintenance, risk assessment, and verification. The framework provides a repeatable process while leaving room for judgment when the evidence requires it.

Publishing & education systems

I build systems for turning technical knowledge into usable instruction. Research, testing, documentation, production, technical review, and publishing become parts of a repeatable process rather than isolated tasks.

AI & workflow design

I build controlled AI workflows with defined responsibilities for production, review, verification, and release. Required evidence, validation checks, re-review, and release gates determine whether work moves forward, with human judgment retained where automation cannot reliably establish the answer.

Independent properties

Independent work.

Independent firearms education and media property

The Rogue Banshee

Firearms education built around understanding how things work, inspecting and maintaining them correctly, and teaching the process in a way people can actually use.

Framework Development

Structured methods for inspection, diagnosis, maintenance, risk assessment, and verification.

Technical Education

Complex mechanical and technical subjects turned into repeatable instruction people can actually follow.

Publishing Systems

Research, testing, documentation, technical review, production, and publishing managed as a repeatable process.

Independent creative and media project

Jason’s Fuse

An independent creative project about the systems and assumptions that become so familiar we stop noticing them. Through commentary, stories, humor, and the deadpan observations of /null, Jason’s Fuse gives people a reason to stop and think about the things they normally accept without question.

Notice what we’ve stopped noticing.

Visit Jason’s Fuse

Experience & credentials

From infrastructure to leadership.

I started in infrastructure and IT operations before my career expanded into cybersecurity, enterprise risk, and technology leadership. That background matters. I have spent much of my career working across the lines that separate security, infrastructure, operations, audit, and the business, because problems rarely stay inside one of them.

My full professional history is on LinkedIn.

Current certifications

CISSP

Certified Information Systems Security Professional

CISA

Certified Information Systems Auditor

CRISC

Certified in Risk and Information Systems Control

Contact

Get in touch.

For professional, consulting, or media inquiries, you can reach me on LinkedIn.