Joseph Lowe

I have spent twenty years in information security, the last twelve directing concurrent security, audit, and compliance programs for a regulated, client-facing SaaS platform serving financial services institutions. I am a security leader who sets the standard, translates it into what engineering builds, and holds the outcome. I stay close enough to the work to own it myself.

The work I owned directly spans the program. I co-authored the System Description for both SOC reports in partnership with system and program owners. I conducted quarterly user access reviews and directed and managed our annual PCI DSS self-assessment (SAQ D for Service Providers). I built and maintained our security risk register and provided a weekly report to senior management on accepted risks and open compliance issues. I owned oversight of the business continuity plan and the business impact assessment process, with disaster recovery handled by a separate manager, and I owned client due diligence for more than 50 clients a year, deciding what evidence to share while protecting confidential information.

I did that work from inside the delivery organization. I was the information security subject-matter expert embedded in Service Delivery; I joined architecture discussions with Engineering and IT to ensure solution designs met compliance requirements, and I triaged vulnerability issues hands-on in working sessions with Engineering and IT. I was the person brought in on urgent security issues to help coordinate the response.

As AI adoption accelerated, my priority was ensuring leadership and the wider organization understood the risks and that proper treatments were introduced. I also put AI to work myself. I built and operated a retrieval-augmented generation (RAG) tool, with human-in-the-loop review, that cut client due diligence turnaround from multiple weeks to days, and I moved the filtering, grouping, and first-draft reporting of our vulnerability management output from spreadsheets onto an approved enterprise GenAI assistant. This site showcases the proof-of-concept tools I build with Claude, starting with an AI risk register.

Outside of work, I have practiced Kung Fu for more than twenty years and hold a 6th Degree Black Belt in a Shaolin tradition. In the early 1990s, I played guitar and bass in several bands in the New Orleans post-punk movement, living the life of an urban poet; today I play bluegrass guitar and clawhammer banjo, and I have a poetry collection, Joetry, published in paperback on Amazon. Home is my wonderful wife and our several fur-babies.