Identity, cybersecurity, and business judgment
Good security connects the business, the technology, and the people who make it work. I help you find that connection—and turn it into decisions you can act on.
Shawn Hawryluk
Independent consultant
20+ years in IT and security · CISSP · MBA
The perspective
Identity connects people, applications, data, and decisions across an organization. A new tool can help—but it cannot decide who owns an entitlement, what access is justified, or which risks matter most.
I bring an infrastructure practitioner’s understanding of how systems fit together, and a business perspective on what is worth changing. The aim is proportionate security: clear responsibilities, workable controls, and a path your team can sustain.
Services
Focused engagements for organizations and consulting partners. Direct access to the person doing the work.
Connect identity architecture, access governance, and privileged access to the business problems they need to solve. Find the gaps between a platform rollout and a functioning program.
Typical work Current-state review, priorities, ownership model, and a practical roadmap.
Test a proposed design against your risks, operating constraints, and existing systems. Make the assumptions, dependencies, and trade-offs visible before committing to implementation.
Typical work Architecture review, identity trust relationships, control design, and options for decision.
Help a security or identity initiative regain clear direction. Separate delivery problems from missing decisions, clarify accountability, and reconnect the plan to achievable outcomes.
Typical work Program health review, governance, risk and dependency analysis, and a recovery plan.
A practical second perspective for a difficult decision. Translate technical findings into business implications, challenge a vendor proposal, or help a leadership team frame its next move.
Typical work Decision briefs, vendor and contract reviews, leadership discussions, and ongoing advice.
Scope and deliverables are agreed before work begins. Advisory and review engagements are not a promise of continuous operations support or platform administration.
The approach
Start with what is true—not with the framework, product, or project someone has already chosen.
Listen to the people doing the work. Review the architecture, decisions, and evidence you already have. Establish the actual objective and constraints.
Look for the assumptions behind the presenting problem. Compare useful options and their trade-offs, including what can stay as it is.
Deliver clear findings, a defensible recommendation, and actions that fit your team’s capacity. Leave you with something you can use.
The person behind the practice
Independent consultant
CISSP · MBA, Management of Technology
I came to security through the systems it needs to protect.
My career spans more than 20 years in IT operations, infrastructure architecture, cybersecurity, and identity governance. That path shapes how I think: controls need to work with the environment, and technical choices need to make sense as business decisions.
My focus is identity and access management—the relationships between people, systems, entitlements, and accountability. I bring architectural depth in Active Directory, Entra ID, and federated identity, alongside experience in security governance and identity program delivery.
An MBA in Management of Technology complements that technical background. I work at the connection between implementation reality, disciplined risk management, and leadership judgment.
Third Practice is a nod to Shu–Ha–Ri, a progression of mastery: first you learn the established forms, then you understand the principles behind them, and finally you know them well enough to exercise your own judgment. That third stage doesn’t abandon the foundations. It’s where they become useful in situations no template anticipated, which is where most real identity, architecture, and risk decisions live.
Start a conversation
A short description of the challenge, the timing, and the help you need is enough to start. I’ll tell you honestly whether I’m a good fit.
Burnaby, British Columbia · Remote engagements
Please don’t send passwords, confidential client records, or sensitive security details in an initial message.