I build and secure systems that actually have to run in the real world.

I've spent the last 19+ years across cloud, security, compliance, risk, infrastructure, and IT operations, usually sitting in the middle of engineering, leadership, and governance teams translating between all three. Lately, most of my focus has been on agentic AI orchestration, automation safety, and the operational guardrails needed to make AI usable in regulated environments.

Based in Nashville, TN. Founder and principal consultant at Tectori, an IT consulting practice covering Cloud, Security, Compliance, Risk, IT Operations, and Agentic AI platforms.

Helping organizations adopt AI without creating chaos in the process.

That includes:

• Agent orchestration and workflow design
• Human-in-the-loop approval patterns
• Output validation and verification pipelines
• Security and compliance controls for AI systems
• Operationalizing AI safely in production environments

Most of the work sits at the intersection of DevSecOps, governance, automation, and platform engineering.

• 19+ years in technology, from desktop technician to CIO/CISO
• Fractional CISO/CIO work through Tectori since 2024
• Security architecture and AI policy automation at HCA Healthcare: a governed redline pipeline that revived an 18-month-stalled policy effort, and an enterprise security-tooling inventory reconciled from seven sources across a 300,000-employee organization
• CIO/CISO at Ncontracts and CISO at Ingo Money; built and led security, IT, compliance, cloud operations, and DevSecOps teams from scratch
• Helped scale Ncontracts from $10M to $100M ARR through organic growth and four acquisitions
• Built and sustained programs aligned to SOC 2, HITRUST, ISO 27001, NIST 800-53, PCI DSS, HIPAA, and CSA STAR
• Project and platform delivery across small businesses through enterprise environments
• Former instructor for Security+ and CISSP, teaching at Vanderbilt, Columbia, NYU, UPenn, and Georgia Tech boot camps, plus Nashville Software School

• CISSP
• SABSA Chartered Security Architect, Foundation Certificate (SCF)
• PCI Professional (PCIP)
• PCI Internal Security Assessor (ISA)
• MBA, Management of Technology, Georgia Institute of Technology
• BBA, Business Management, Kennesaw State University

Consulting, advisory, fractional leadership, and architecture work involving:

• DevSecOps
• Cloud Security
• Risk and Compliance
• AI Platform Engineering
• Agentic AI Governance
• Security Operations Automation
• Infrastructure and Operational Modernization

Python utilities for streaming, scanning, and labeling large mbox and IMAP archives for incident response, investigations, legal hold review, and security operations workflows.

PowerShell automation and operational tooling for Active Directory, Azure, IIS, Microsoft 365, Windows hardening, and day-to-day infrastructure operations.

Personal lab notes and security research covering scanning, controlled testing environments, post-exploitation concepts, operational tradecraft, and OSCP preparation work.

LLM-friendly tooling and structured workflows for analyzing medical bills, identifying duplicates and inconsistencies, and managing long-running healthcare billing disputes.

Working templates for the documents a security program needs to actually run: opinionated risk register, quarterly board update, blameless incident postmortem, and control-framework mapping pattern. Markdown only.

Portfolio skeleton of a three-stage Gemini pipeline that turns a folder of mixed-format design artifacts into an indexed corpus, a security and operational gap analysis, and an internet-enabled chat advisor for review-board rehearsal. The stage orchestration and production persona prompts are intentionally withheld; the architecture, document-ingestion layer, and SDK wrapper are open for review.

Architecture case study for MailSweep, a production AI-assisted email triage platform that ships in both a local Windows and an Azure-hosted SaaS variant from a single codebase. Writeup only; the production source is proprietary. Walks through the multi-provider abstraction, the local-vs-cloud split, the keyword-fallback design for AI unavailability, and the operational decisions that turned out to matter.

The rest of the platform work, including Fortivra, Compliance Compass, FileIQ, and Lumenwatch, stays in private repositories. Overviews are at https://www.tectori.com/.

Work board: C:\Code_data\k3rt4s\WORK_BOARD.md.

• Email: jon.bowker@tectori.com
• Website: https://www.tectori.com/
• LinkedIn: https://www.linkedin.com/in/jonathanbowker/