Derek Pizzagoni

I’m a Chief Information Security Officer who translates information security risk for clear business decisions, helping organizations protect critical assets while enabling growth, resilience, and innovation.With 20+ years in information security and technology leadership, I’ve led enterprise security programs across healthcare, financial services, legal, and SaaS environments, including Children’s Hospital Los Angeles and Sutter Health. My experience spans building and scaling security functions, maturing third-party risk programs, and standing up identity and access management capabilities from the ground up in complex, highly regulated environments.I’ve overseen information security programs supporting organizations with more than 10,000 users, managed budgets, and regularly advised executive leadership, boards, and audit committees on risk, compliance, and investment priorities.A consistent focus in my career has been securing systems where information security directly impacts real-world outcomes. At Children’s Hospital Los Angeles, I led efforts to assess, strengthen, and govern security across operational technology (OT) environments, including facilities systems, medical devices, and research platforms, improving visibility into risk and implementing practical, sustainable controls.I’ve also led distributed teams and global operations, including managing offshore security and IAM functions in India, balancing operational efficiency with strong oversight and accountability.Earlier in my career at WR Hambrecht + Co, I supported the platforms behind proprietary financial systems that raised over $1B, reinforcing my focus on protecting revenue-generating and mission-critical systems.My leadership style is pragmatic and hands-on when needed. I build strong teams, foster accountability, and work closely with business and technology leaders to ensure security is not just a control function, but a business enabler.I’m a U.S. Navy veteran with an MBA and hold certifications including CISSP, CISM, CCSP, C|CISO, and OSCP. I also serve on advisory boards for GIAC and Dominican University, supporting the development of future information security leaders.I’m most effective in organizations that view security as a strategic enabler, especially those navigating growth, transformation, or increasing operational and regulatory complexity.