Eduardo “Eddie” Bonilla Jr.

Role descriptions focus on my responsibilities and results. They are not a description of any employer's security environment.

1. Senior Manager, Security Operations & Engineering

   June 2019 – Present · North Carolina (Remote)

   CBIZ, Inc.Publicly traded professional services and CPA firm

   Lead security operations, engineering, and governance for a large, publicly traded professional services firm of 12,000+ users across 150+ offices at director-level scope, reporting directly to the CISO as a key strategic partner, consulted on major security decisions before they're made, and partnering with executive leadership, Legal, and HR. Working closely with the CISO, delivered on the company's security objectives: a larger, better-resourced team, stronger core security pillars (AI and data classification, IAM, and GRC), and a sustainable security program, all on budget and held to a high standard.

   Over my time here, I've built a new security team and matured it into a multi-team security organization: hiring for potential, putting in place the processes, playbooks, and metrics it runs on, and developing people into leaders who own their areas. I manage the full people side of the job, from hiring, promotions, performance reviews, and compensation to career counseling built around where each person wants to go.

   I've helped the company scale securely through significant growth and a steady stream of acquisitions, integrating 50+ firms and now supporting Grant Thornton's pending acquisition of CBIZ. Along the way I've led incident response as incident commander, cut detection and response times roughly in half, and taken the program international.

   Show full scope of role

   Team leadership and talent development

   • Lead a large, multi-disciplinary security organization with full people responsibility: hiring, promotions, annual performance evaluations, bonus decisions, and career counseling for every team member.
   • Built the team into a multi-team organization, hiring for potential and developing people from within instead of relying on outside hires for every opening.
   • Led the security program's international expansion, including three offices in India: hired and manage security team members outside the U.S., and brought global security assets under the same monitoring, controls, and governance as the U.S. environment.
   • Provide one-on-one counseling and career guidance, building development plans around each team member's goals, backed by stretch assignments and new responsibilities as they are ready for them.
   • Set training and certification standards for each role, with clear certification paths that grow skills and support promotion.
   • Drive knowledge transfer through documentation, runbooks, cross-training, and shadowing, so no critical capability depends on a single person.
   • Build a connected team culture through team-building activities and team events, keeping a multi-team, international organization working as one.
   • Built the teams to run independently, with clear ownership and room to make decisions, so the organization keeps growing without every decision going through the top.
   • Leading a restructure into six functions, each with its own lead, giving emerging security leaders a clear path into management.

   Program leadership, metrics, and reporting

   • Define and track the program's metrics, KPIs, and key risk indicators, including MTTD/MTTR, incident trends, vulnerability remediation, audit findings, vendor risk scores, and phishing simulation results.
   • Build the dashboards and reports that give leadership a clear view of security operations, exposure, risk, and program maturity, using MITRE ATT&CK, MITRE ATLAS, and OWASP to connect threats to business impact.
   • Partner with the CISO to prepare and finalize Board briefings that helped secure a 45% increase in security funding and approval to expand the security team.
   • Lead Security Engineering alongside Operations, so the controls the team deploys are also monitored, tuned, and validated by the same program.
   • Own the security tooling budget and vendor relationships: run proofs of concept and proofs of value to validate products before purchase, and lead evaluations, renewals, and negotiations.
   • Give Legal a first-pass review and redlines on NDAs, purchase agreements, master service agreements, technical service agreements, and other contracts, making sure service level commitments match what the team can actually deliver before Legal finalizes them.

   Security operations, incident response, and automation

   • Built the security operations function from scratch and lead it today: monitoring, analytics, detection engineering, incident response, threat hunting, and threat intelligence.
   • Set the operation's priorities, metrics, and service objectives based on business risk, and wrote the playbooks behind them, cutting MTTD by 52% and MTTR by 47%. Response now happens within minutes of an alert.
   • Serve as incident commander for significant security events, coordinating Legal, HR, IT, and executive leadership through containment and recovery.
   • Lead investigations through complete analysis, root-cause determination, and positive attribution, with layered controls, monitoring, and fast containment keeping events limited in scope.
   • Write formal IR reports for executives, Legal, and regulators, and run post-incident reviews that turn lessons learned into new detections and control changes.
   • Provide legal guidance to investigation teams and work alongside Legal on cyber investigations, covering discovery, limits on investigation scope, legal and regulatory requirements, legal holds, and evidence chain of custody.
   • Hunt for threats across the XDR, SIEM, and network detection stack, guided by threat intelligence and MITRE ATT&CK.
   • Built low-code security automation for DLP alerting, SOC intake, on-call paging, and alert enrichment, cutting manual triage work roughly in half.
   • Own operational resilience, including disaster recovery and business continuity plans and annual DR/BC testing.

   Exposure management, identity, and cloud security

   • Lead vulnerability management across cloud, infrastructure, endpoints, and applications, prioritizing remediation by exploitability and business impact.
   • Oversee application security and DevSecOps, including secure code review, code and repository scanning, CI/CD pipeline security, web application testing, container security, and web application firewall protection.
   • Stay hands-on in the security stack: personally deploy, configure, tune, and troubleshoot SIEM, XDR, NDR, WAF, identity, and DLP platforms alongside the engineers who run them.
   • Manage penetration testing and adversary emulation engagements and use the findings to validate detections and controls.
   • Own identity security, including MFA, conditional access, and privileged access governance.
   • Own cloud and data security across a hybrid multi-cloud environment, including cloud security posture management (CSPM) and a tiered data classification scheme enforced through DLP that reduced unmanaged sensitive data exposure by about 55%.

   AI governance, security, and testing

   • Built CBIZ's AI governance program, including the acceptable use policy, an AI system inventory, and a risk review every AI tool must pass. It's aligned to NIST AI RMF and ISO/IEC 42001.
   • Audit AI systems and vendors for data handling, access controls, logging, model provenance, and contract terms on training use of company data.
   • Test AI applications and integrations for prompt injection, jailbreaks, sensitive data leakage, insecure output handling, and excessive agency using the OWASP Top 10 for LLM Applications and MITRE ATLAS.
   • Monitor prompts and agentic AI activity, including AI applications, autonomous agents, and their tool calls, for prompt injection, data leakage, policy violations, and misuse.
   • Monitor non-human identities used by AI (service principals, OAuth apps, API credentials) for excessive permissions and anomalous activity.
   • Reviewed 50+ AI tools and vendors through the AI risk review process as AI capabilities spread across the vendor ecosystem.
   • Bringing AI-assisted capabilities into detection, investigation, vulnerability analysis, and threat hunting, with human review built into each workflow.
   • Extended data governance to AI so sensitivity labels and DLP policies apply to data generative AI tools can reach.

   Governance, risk & compliance

   • Write and maintain the enterprise security policy library, mapped to NIST and ISO 27001.
   • Own SOC 1 and SOC 2 audits end to end, including control design, evidence collection, gap analysis, and the auditor relationship, and support HITRUST and ISO 27001 readiness.
   • Run enterprise risk assessments and gap analyses against NIST and ISO controls, prioritizing remediation by business impact.
   • Created the Vendor & Supply Chain Risk Management Program, producing a risk score for every vendor and business partner from SOC reports, vulnerability scans, security scorecard ratings, and a custom questionnaire, and matured it into a critical business function run by a dedicated team and manager.
   • Run the security awareness program, including annual training and phishing simulations.
   • Lead security due diligence and integration for 50+ acquired firms, and wrote the M&A security playbook that cut time-to-compliance by about 40%.
   • Led security integration for the most complex mergers, including Marcum LLP (the largest), RAFFA, Friedman, and Skoda Minioti: environments of 500 to 5,000 users each, together spanning dozens of major datacenters and thousands of servers and websites, brought under central monitoring and controls.
   • Currently working on security for Grant Thornton's pending acquisition of CBIZ, the largest transaction of its kind in the accounting space in more than 25 years.

2. Security Operations Manager

   Nov 2017 – June 2019 · Great Neck, NY

   First QualityLarge-scale manufacturer

   Led the enterprise Security Operations Center for a large, multi-site manufacturer, overseeing monitoring, incident response, analyst operations, and security engineering.

   • Reduced incident triage time by about 35% through tooling integration, process standardization, and workflow automation.
   • Hired, trained, mentored, and managed a team of security analysts.
   • Developed security standards, governance documentation, and incident response procedures that strengthened compliance and audit readiness.
   • Tracked SOC metrics and KPIs and reported operational status and risk to IT and business leadership.

3. Senior Online Security Operations Engineer

   Jan 2015 – Nov 2017 · New York, NY

   Take-Two InteractiveGlobal video game publisher

   Founding member of the security operations team for a global publisher whose online services supported millions of players.

   • Led the defense against large-scale DDoS attacks during the 2016 botnet wave, keeping online services running under intense public attention.
   • Became the company's go-to expert for DDoS mitigation.
   • Established the SOC's core processes, escalation paths, and operating standards.
   • Evaluated new security technologies through proofs of concept, deployed the ones that proved out, and supported the move to the cloud with security architecture and monitoring controls.
   • Built SOC metrics and executive reporting on incident volume, response times, and attack trends.

4. Security Firewall Engineer & Security Operations

   June 2012 – Jan 2015 · New York, NY

   NYC Department of Information Technology & Telecommunications (DoITT)

   Secured the city agency providing technology services to more than 45 city agencies and a central datacenter.

   • Led the migration from legacy firewalls to next-generation firewalls.
   • Managed IPS, email security, VPN, DNS, and web filtering across the multi-agency environment.
   • Supported the citywide rollout of network security and vulnerability management platforms, first as a consultant and then on the city's IT security team.

5. Senior Security & IT Engineer

   Dec 2009 – May 2012 · New York, NY

   Zinbarg, Myrill & LockamyLaw firm

   Sole security and IT engineer, protecting sensitive client data and confidential legal records.

   • Led a full network redesign and virtualized the firm's servers for reliability and recoverability.
   • Hardened systems and access controls to protect privileged client information and case records.

6. Project Manager / Technical Lead (Internship)

   Sept 2011 – Dec 2011

   InfraGardFBI and private sector partnership

   Led an evaluation of new VoIP systems following the 2011 LulzSec breach, from assessment through a working proof of concept of a closed, isolated phone network.

7. IT Administrator

   Dec 2001 – Apr 2005 · New York, NY

   David Horowitz, PCLaw firm

   Managed the full IT environment as the firm's only technical resource: network, Windows domain, email, patching, and protection of confidential client information.