CISO Large Enterprise Finalists

Tracey Brand-Sanders is VP & CISO for UGI Corporation, leading a cybersecurity program protecting the confidentiality, integrity, and availability of systems across seven European countries and the U.S. for a company serving 2.5 million customers. She brings an extensive background building risk-driven security programs in highly regulated industries and has been named Cyber Defense Magazine's Top 100 CISOs, among other honors. She holds an M.S. in Cyber Security and MBA from Saint Leo University.

Since UGI's Global Information Security Group was centralized in 2022, my team has built a security program from the ground up protecting the company across five business units and seven countries, turning fragmented, business-unit-level security into one unified enterprise capability. Against that foundation, we've navigated a demanding regulatory landscape spanning industry standards and state, federal, and international regulatory requirements. We've also stood up a 24/7 managed SOC, board-level risk reporting, and workforce security awareness programming that together strengthen resilience for the communities UGI serves.

Charles Crabtree holds an MBA in Management Information Systems and has built a career leading information technology and security programs in various industries. As Vice President and CISO at Independence Blue Cross, he has driven an enterprise-wide security transformation, including an AI-augmented vulnerability assessment program that strengthened enterprise resilience, and championed security as a business enabler that protects members, providers, and partners. He serves on several industry boards to advance the cybersecurity community.

As CISO, I've led a broad transformation of our cybersecurity program, treating security as a partner to the business, fostering innovation while keeping our members, providers, and partners protected. Key drivers include a NIST-aligned framework, stronger threat detection through SIEM and threat intelligence, and a shift to risk-based vulnerability management. We've matured identity and access governance, modernized privileged access management, and email, DLP, and cloud protections. We've also put AI to work defensively, accelerating vulnerability assessments and sharpening threat detection. These efforts, paired with stronger application and third-party risk management, have driven measurable maturity gains and an enhanced security posture.

Healthcare cybersecurity executive with deep expertise in governance, risk, and compliance (GRC), patient data protection, and regulatory adherence in hospitals, healthcare systems, and medical enterprises. Proven ability to advise Boards and executive leadership, translating cybersecurity threats into actionable risk management strategies. Expertise in HIPAA, HITRUST, HITECH, and FDA cybersecurity requirements, ensuring the integrity of protected health information (PHI) and electronic health records (EHR). Adept at leading cybersecurity transformation, cloud security initiatives, medical device security (IoMT), and third-party risk management to safeguard patient trust and organizational resilience. Expert in leading the strategic development and execution of advanced penetration testing, threat intelligence, incident response, and digital forensics initiatives.

We have transformed the organization from a place with security/risk as afterthoughts to having a major place at the table.

Zack Gable is Chief Information Security Officer and Associate CIO at Geisinger. A people-first leader, he is passionate about building high-performing teams, developing future leaders, and fostering a culture of trust, collaboration, and continuous learning. With more than 16 years of leadership experience across cybersecurity, risk, and technology, Zack focuses on empowering teams, strengthening partnerships, and helping organizations achieve meaningful outcomes through engaged people, shared purpose, and resilient leadership.

My greatest success is the team we have built together. By focusing on employee engagement, trust, and leadership development, we created an environment where people feel empowered to contribute, grow, and lead. Through strong partnerships across cybersecurity, IT, clinical, and business teams, we improved collaboration, strengthened resilience, and aligned around shared outcomes. The result has been a more connected organization, a stronger leadership pipeline, and a culture that embraces accountability and continuous improvement. Any success we have achieved is a reflection of the team's commitment to the mission and one another.

David Lingenfelter is the Chief Information Security Officer at Penn Entertainment, leading enterprise cybersecurity, risk management, compliance, and resilience programs across retail and digital gaming operations. With 30 years of experience, he previously led security for IBM's MaaS360 platform and Fiberlink Communications, helping drive security initiatives by aligning security with business objectives, enabling innovation, strengthening operational resilience, and developing high-performing teams. He is recognized for building high-performing security organizations and aligning cybersecurity with business strategy.

My greatest accomplishment has been building Penn Entertainment’s cybersecurity program from the ground up as the company evolved from a decentralized holding company into an enterprise-scale organization. We established a centralized security infrastructure, deployed security controls across more than 50 locations, and built a security operations capability to monitor and respond to threats enterprise-wide. Through collaboration, security awareness, and employee engagement, we created a culture where cybersecurity is viewed as a shared responsibility and where team members across the company actively contribute to strengthening our security posture of the company

Monique St. John is Vice President and Chief Information Security Officer at Children’s Hospital of Philadelphia. With more than 25 years in technology, cybersecurity, and service delivery, she is a trusted advisor who partners across the organization to manage risk, protect patients and the enterprise, and enable innovation. Her collaborative leadership advances practical solutions that support CHOP’s mission. She gives back through board service, mentoring, and support of organizations that strengthen the community.

One of my most meaningful accomplishments at CHOP has been helping others see cybersecurity as part of patient safety. We worked closely with clinical, operational, and business leaders to move security from a compliance obligation to a shared responsibility. The message is clear: cyber risk is a patient safety risk. From 2022 to 2026, susceptibility improved by 84% and resiliency improved by 169%. The deeper impact is cultural: leaders across CHOP now make that connection in team meetings and town halls, showing security culture is being embraced across the organization.