Corporate Finalists

Steve Cobb is the CISO at SecurityScorecard, where he owns all cybersecurity and corporate IT for the company. He chairs SSC's AI Governance Committee and runs the FedRAMP and GovRAMP continuous monitoring programs. With 30-plus years across IT and security leadership, Steve is a hands-on operator known for direct communication, lean teams, and shifting third-party risk management from a compliance checkbox to an active security discipline. He's a frequent voice on LinkedIn and X.

In 18 months, my team of under ten achieved FedRAMP Ready and GovRAMP Ready for SecurityScorecard, then secured re-authorization for another two years on the first attempt. We did it without the big-firm consulting spend that's typical for this work, and on a budget under $5M covering all of cybersecurity and corporate IT for a global SaaS company. The work opened the federal market for SSC, protected revenue already under contract, and proved that a small, accountable team of strong operators can deliver outcomes most organizations spend years and millions trying to reach.

Joe Evangelisto is the CISO at NetSPI, where he leads Security, GRC, and Corporate IT. With over 25 years in IT leadership the last eight focused on security and compliance he has built and transformed programs across non-profits, life sciences, and technology companies. Joe is a two-time CISO ORBIE Award finalist, co-founder of the RDU IT Professionals community, and a BSides Raleigh volunteer. He holds a CISSP, BS and MBA in IT Management from WGU.

This year, my team of 13 secured a 600-person cybersecurity company on a flat budget. We built an AI governance program from scratch, giving the business a framework to adopt AI responsibly while ensuring customers and prospects trusted our approach. We designed an interview integrity process that identified and stopped fraudulent candidates attempting to infiltrate our workforce. We hardened identity controls across the enterprise and still brought on an intern to invest in the next generation. No new budget. No new hires. Just a focused team that chose to lead through constraints instead of waiting for conditions to improve.

Chris Morris is a cybersecurity and infrastructure leader with more than 20 years of experience across government, education, and manufacturing. A CISSP‑certified practitioner, Chris worked in and now leads the Town of Chapel Hill’s security and infrastructure programs, guiding long‑term strategy, daily operations, and organization‑wide cyber risk management. Beginning as a network engineer and evolving through progressively broader security roles, Chris focuses on empowering teams, strengthening identity‑first security, and resilient, modern infrastructure for the community.

One of our most meaningful achievements has been building a holistic, CIS‑aligned security program through a fully collaborative team effort. I helped lead the initiative, but every member of our Technology Solutions team contributed to strengthening our defenses. Together, we expanded our layered security approach with a Managed SOC, active and passive network scanning, CIS benchmark deployment, privileged and vendor access management, enhanced security awareness training, and progress toward a Zero Trust model. This unified effort significantly improved our security posture and created a culture where cybersecurity is truly shared.

Crystal Pitts is the Chief Information Security Officer for the North Carolina Division of Employment Security. Since joining the agency in 2017, she has built a cybersecurity program that supports secure digital transformation, protects critical public services, and strengthens organizational resilience. A passionate advocate for workforce development, Crystal mentors emerging cybersecurity professionals and champions veteran apprenticeship and talent development programs across North Carolina.

As Chief Information Security Officer for the North Carolina Division of Employment Security, I have transformed cybersecurity from a compliance-focused function into a strategic business enabler. Since joining the agency as its first security professional, I've built a mature cybersecurity program that has securely supported the agency’s evolution to more than 80% cloud-based operations. My leadership has helped safeguard critical unemployment services and ensure operational resilience amid an increasingly complex and persistent threat landscape. I'm also passionate about developing future cybersecurity leaders through veteran apprenticeships, mentoring, and workforce development programs.

Sterling Yancy serving as Information Security Officer at First Bank. Highly effective in IT operations management and cybersecurity, he delivers groundbreaking advancements for enterprise organizations while supporting service requests and information security. Over 30 years, he has built a resilient IT organization focused on operational excellence and risk mitigation. Known for his people-first leadership and talent development, Sterling drives security excellence and sustainable business growth.

As Information Security Officer at First Bank, my team’s greatest accomplishments include maintaining zero infrastructure breaches in 13 years and nine years without any active virus or malware infection. This reflects our robust, multi-layered cybersecurity program and proactive risk management.Additionally, during Hurricane Helene in 2024, we rapidly deployed Starlink terminals across devastated areas including Asheville, Black Mountain, and Western North Carolina. This restored critical connectivity for bank operations and community support when traditional infrastructure was destroyed.These achievements have protected customer data, ensured operational resilience, and reinforced the bank’s role as a trusted community partner.

Eric Zach is Chief Information Security Officer at North Carolina A&T State University, where he leads enterprise cybersecurity, risk management, and compliance programs aligned with institutional goals. He has transformed the university’s security program into a structured, risk-driven organization and established a student cybersecurity workforce pipeline. Previously, he served in senior cybersecurity roles with the State of North Carolina, supporting enterprise IT and security initiatives.

I transformed a decentralized security function into a structured, risk-driven program aligned with institutional priorities. By modernizing policies to NIST 800‑171, advancing security operations, and embedding security into enterprise initiatives such as network redesign, we strengthened the university’s ability to support growing research activity. I also developed a student cybersecurity workforce pipeline that provides hands-on experience and career pathways, strengthening both our program and the broader talent ecosystem.