Skip to experience
Xavier Charles Motley
Resume

SECURITY LEADERSHIP

Xavier Charles Motley

Protecting the launch. Enabling the team.

Experience View resume Executive brief
01 / Protected work

Defense in depth. Protect the work at every layer.

A study in protection. No client material.
EXPERIENCEMedia Arts LabApple accountTBWA WorldwidePanasonic AvionicsRANDAlbert

A RARE COMBINATION

Protect the idea.
Understand the people.
Keep the work moving.

I help creative teams bring important ideas to the world without exposing them before their time. My experience combines Apple-account secrecy work, global security leadership, and hands-on investigations and engineering.

A partner to Marketing

Understand the launch, the workflows, and the people doing the work.

Practical protection

Turn secrecy requirements into clear, workable operating mechanisms.

Judgment under pressure

Investigate carefully, escalate clearly, and preserve trust.

The experience
behind the judgment.

Three perspectives. One discipline.

Career experience. Public summaries drawn from my resume; confidential methods, client material, and investigation details are omitted.

01 / Pre-launch secrecy

Inside the creative process.

Media Arts Lab

Apple account · 2013–2017
Global Director of Information Security

5 international hubs. 26 offices. Hundreds of creative partners.

The challenge
Confidential launch campaigns moved between creative teams, production partners, and offices around the world. Protection had to work within the pace of product marketing.
My decisions
I worked in lockstep with David Rice and Apple’s secrecy team, translating requirements into need-to-know access, compartmentalized projects, watermarking, DLP, and secure creative workflows. On the ground with partners, I built adoption through working relationships, not reporting-line authority.
The result
Embedded secrecy controls in campaign production for Apple Watch, iPad Pro, AirPods, MacBook Pro, and annual iPhone launches, with intake, training, and escalation built into the work.

Protect the idea without losing the people bringing it to life.

02 / Sensitive investigations

Evidence before assumptions.

RAND Corporation

Classified research · 2011–2012
Information Security Engineer

Incident-response time reduced from approximately 18 hours to 2 hours.

The challenge
Classified research required defense against nation-state espionage, unauthorized disclosure, and inappropriate cross-program access.
My decisions
I enforced compartmentalization and need-to-know boundaries, investigated anomalous access and data movement, and built malware-analysis, digital-forensics, and containment capabilities. Findings informed containment actions and leadership briefings.
The result
Reduced incident-response time from approximately 18 hours to 2 hours. Detection tuning increased SIEM true positives fourfold and reduced false positives by approximately 55%.

Discretion supported by hands-on investigative depth.

Prior projects required Top Secret access; this is not a claim of current clearance.

03 / Product security

Protection beyond the launch.

Panasonic Avionics

Global aviation technology · 2022–2023
Global Head of Cybersecurity · Interim

Product, software, and platform security. Design through delivery.

The challenge
Engineering, production, suppliers, and customer delivery each introduced different security decisions across the product lifecycle.
My decisions
I built global Product Security and Information Security, embedding threat modeling, Secure SDLC, CI/CD security gates, and PSIRT. I connected product and cloud risks with executive decisions and established handling requirements for pre-release builds.
The result
Brought design, production, delivery, and post-release response into a connected security program, stabilized operations through an executive transition, and handed the program to a successor.

Security ownership continues after the product ships.

“Protecting confidential pre-launch work was some of the most challenging and rewarding work of my career.”

Xavier Charles Motley

ILLUSTRATIVE SCENARIOS / MY APPROACH

Protect the campaign.
Keep the work moving.

How I would approach common launch-security decisions. These scenarios are illustrative, not accounts of an employer’s systems or incidents.

The work

Launch brief and product narrative

The exposure

A shared planning space can reveal unreleased details to people who do not need them.

The decision

Identify sensitive assets and owners early. Separate launch work from general collaboration and agree who needs access.

The evidence

Named asset owner, approved access groups, handling guidance, and an escalation contact.

Real-world scenarios

A new agency requests the entire campaign folder.

Confirm its deliverables first. Provide only the assets required for that work, with an accountable sponsor and a defined access end date.

SELECTED WORK

From principle
to practice.

Public GitHub
01 / Personal research lab

Creative Content Security Lab

How do you protect creative work across partner handoffs?

A small Python and FastAPI lab exploring recipient-specific packaging, vendor access, activity logging, and detection patterns for sensitive creative assets.

PythonFastAPIContent protection
Design decision & scope

Keep the recipient and package identity connected across the workflow so activity can be investigated in context.

Local proof of concept with ten automated access tests: recipient checks, revocation, expiry, and encrypted package delivery. Production identity, key distribution, concurrent policy changes, and independent validation remain outside scope.

Inspect the access tests
Explore repository
02 / Reference architecture

Secure Cloud Data Architecture

How do you make data useful without making it indiscriminately accessible?

An AWS architecture study with Terraform examples, STRIDE threat models, control mappings, and decision records for data zoning and access boundaries.

AWSTerraformThreat modeling
Design decision & scope

Separate sensitive data flows and document the usability, access and operational tradeoffs instead of treating security as an afterthought.

Architecture and example infrastructure, not a validated production deployment. The documented target design is broader than the current Terraform implementation.

Read the design decisions
Explore repository

SELECTED WRITING

The thinking
behind the work.

All writing on Substack
01

Creative work November 16, 2025

Protecting the Story

Security, trust, and the creative supply chain.

02

Leadership November 17, 2025

Trust With Clear Boundaries

Practical controls, clear accountability, and collaboration that preserves trust.

03

Creative workflows November 17, 2025

Securing Creative Pipelines

Practical handling rules, partner handoffs, intake, and escalation for sensitive creative work.

EXECUTIVE BRIEF

The essential context.

Leadership background, selected evidence, writing, and the full resume.

Read the brief Structured profile

HANDS-ON. BUSINESS-MINDED.

Fluent in the details.
Focused on the outcome.

Information protection

Reduce unintended exposure through DLP, need-to-know access, secure collaboration, information-flow assessment, and third-party risk management.

Investigations & response

Turn signals into defensible action through DFIR, malware analysis, threat intelligence, evidence handling, containment, and clear escalation.

Product & cloud

Embed protection in delivery through AWS and Azure security, Zero Trust, threat modeling, Secure SDLC, CI/CD gates, and PSIRT.

Leadership & governance

Make accountability workable through executive communication, intake, training, operating models, risk governance, and cross-functional coordination.

At Panasonic Avionics, I built security engineering across Product Security and Information Security, spanning product, software, and platform design through production and delivery. At Albert, I was the first security hire and built the program from zero.

A career built
on trust.

Download full resume
2023–Present

BCAWR

Chief Information Security Officer

Lead Cyber Advisor to the Los Angeles Mayor’s Office, connecting threat intelligence, critical-infrastructure risk, and incident readiness with executive decisions.

2022–2023

Panasonic Avionics

Global Head of Cybersecurity · Interim

Product, software, and platform security across design, production, and delivery.

2020–2021

Albert

Global Head of Information Security

First security hire at a cloud-native fintech; built the security program from the ground up.

2019–2020

Sigue / FIX-Forex

CISO & Data Protection Officer

Security, privacy, incident response, and board-level accountability in financial services.

2017–2018

TBWA Worldwide

Chief Information Security Officer

Global security leadership across 300+ offices in approximately 100 countries.

2013–2017

Media Arts Lab

Global Director of Information Security

Apple-account secrecy and information protection across international creative teams and partners.

2011–2012

RAND Corporation

Information Security Engineer

Cyber investigations and defense of classified research against sophisticated adversaries.

COMING OCTOBER 31, 2026

The Chief Information Security Officer
Operating System

A field guide for the modern security function.

By Xavier Charles Motley
Chief Information Security Officer Operating System. A field guide for the modern security function by Xavier Charles Motley. The ten layers: Mandate, Principles, Control Plane, Risk Model, Program Architecture, Telemetry, Proof Layer, Communications, Cadence, Update Cycle.

THE NEXT CHAPTER

Let’s protect
what comes next.

Senior security leadership.

Connect with Xavier