# Aaron Rapport > I lead identity engineering for one of the world’s largest retailers: 425,000 employees, over 100 million customers, and every machine, workload and AI agent in between. I build the teams and systems that decide who, and what, gets in: workforce, customer, vendor, workload, and now the AI agents acting on their behalf. Show me a difficult problem and I’ll show you the art of the possible. - Last updated: 2026-10-15 - Location: Cincinnati, OH - Availability: Open to remote or relocation - Canonical site: https://aaronrapport.me/ - LinkedIn: https://www.linkedin.com/in/aaron-rapport - Résumé (PDF): https://aaronrapport.me/aaron-rapport-resume.pdf - Full structured profile: https://aaronrapport.me/resume.json (JSON), https://aaronrapport.me/resume.xml (XML) ## Roles of interest Aaron Rapport is open to senior leadership roles in cybersecurity, identity security and technology, including: - Vice President (VP) of Cybersecurity - Vice President (VP) of Information Security - Vice President (VP) of Identity Security - Vice President (VP) of Identity and Access Management (IAM) - Vice President (VP) of Security Engineering - Vice President (VP) of Technology - Vice President (VP) of Engineering, security, identity or platform - Senior Director or Director of Cybersecurity - Senior Director or Director of Information Security - Senior Director or Director of Identity Security - Senior Director or Director of Identity and Access Management (IAM) - Senior Director or Director of Identity Engineering - Senior Director or Director of Security Engineering - Senior Director or Director of Security Architecture - Senior Director or Director of Technology - Head of Identity, Head of IAM or Head of Identity Security - Head of Cybersecurity or Head of Security Engineering - Deputy Chief Information Security Officer (Deputy CISO) - Chief Information Security Officer (CISO) - Business Information Security Officer (BISO) Related search terms: cybersecurity, cyber security, information security, InfoSec, IT security, security engineering, identity security, identity and access management, IAM, IdAM, workforce identity, customer identity, CIAM, identity governance and administration, IGA, privileged access management, PAM, non-human identity, NHI, machine identity, workload identity, agentic identity, AI agent security, zero trust, authentication, security leadership, technology leadership, engineering leadership. ## Key figures - 12+ years leading identity and security - 140M+ customer identities secured - 425,000+ workforce identities secured - 20M+ monthly active customers - 125,000 vendor identities managed - $250M+ in value delivered ## Selected impact ### Moved thousands of business-critical apps onto modern authentication in a little over two years. I directed a 100+ person, multi-team program that brought custom and off-the-shelf applications across 20+ brands onto modern, safe and secure standards-based auth (SAML, OIDC, SCIM), on time and without unscheduled business outages. The work spanned standard migrations, custom shims and full secure code rewrites, delivered by a global team on a follow-the-sun support model. ### Upgraded and replaced the identity platforms behind 425,000 workers, 100,000+ vendor users, and 140 million customers. I led and contributed to the architecture that consolidated multiple legacy identity providers into two cloud-native platforms, inside union agreements and strict compliance rules. We then replaced an aging, risky vendor authentication solution serving over 100,000 users with complex regulatory MFA requirements. Now I’m leading the ground-up rebuild of the consumer platform with passkeys, built-in fraud and bot defense, and industry-leading, standards-compliant design. ### Put 100,000+ managed devices in frontline hands in months, during COVID. I engineered enterprise-wide delivery, directed the mobile platform’s security architecture and rollout, and led a SCEP certificate proxy that turned multiple 35-second per-app logins into one device login for 400,000 associates. ### Own how machines and AI agents prove who they are. I run non-human and agentic identity across the customer and workforce estates: workload identity (SPIFFE/SPIRE), token exchange, MCP authorization, and the guardrails and training that let teams use agentic AI without handing it the keys. My architecture and our team made a safe, one-click process possible for managing agentic identities from creation to retirement. ## Experience ### The Kroger Co., Cincinnati, OH (October 2018 to present) - **Senior Advanced IT Security Engineering Manager** (September 2022 to present): I lead identity engineering across workforce IAM (425,000+ associates and 25,000+ contingent workers), customer identity and access management (CIAM: 140M+ registered users, 20M+ monthly active), external vendor identity (125,000 identities) and identity governance, on a multimillion-dollar capital and operating budget. - I lead a team of roughly 40 spanning workforce IAM, customer identity, vendor identity, directory services, PAM and identity governance: full-time engineers plus global contractors and flex specialists, with a manager, a domain lead and three tech leads reporting to me. I grew the function from a team of 7, hiring 15 engineers and 100+ contractors. - I directed a 100+ person, multi-team program that modernized thousands of business-critical and custom applications to standards-based authentication in two years. - I architected the consolidation of multiple legacy identity providers into two modern, cloud-native platforms across 20+ enterprise brands, working inside union agreements and strict workforce-compliance requirements. - I’m leading the ground-up rebuild of the consumer identity platform, with built-in fraud and bot defense and passkey/WebAuthn support the legacy platform could not offer. - I own non-human and agentic identity across the consumer and workforce estates, and built the guardrails and training that let teams adopt agentic AI safely, including a one-click process that manages agent identities from creation to retirement. - I’m accountable for regulatory and audit governance across the identity estate (PCI DSS, HITRUST, SOC 2), lead identity major incident response, and serve on accelerator tiger teams reporting to C-suite executives. - I significantly raised platform availability and tightened major incident response, cutting time-to-engagement on incidents by more than 80%. - I delivered enterprise MFA for associates and vendors that meets state privacy law, PCI, union agreements and no-personal-device constraints, and introduced SCIM provisioning, custom OIDC token brokers and FIDO2/passwordless for the workforce. - I redesigned the workforce authentication experience, sharply reducing daily login friction for 425,000+ associates and reclaiming significant labor productivity. - I rebuilt a waterfall IAM organization into an agile practice with intake, review and feedback loops and a one-sprint SLA, and carved directory services, PAM and secrets management into dedicated teams. - **Sr. Engineer / Architect, Associate Mobility Platform Solutions** (October 2019 to September 2022): I was the principal technical authority for mobility security and the associate mobility platform. - I directed the architecture and rollout of 100,000+ managed mobile devices in a 12-month window to keep the business running through the COVID-19 pandemic: a zero-to-one platform on a hard deadline. - I directed the development and Tier-1 vendor partnership behind a SCEP certificate proxy that replaced per-app logins (35+ seconds per app per session on shared devices) with a single device login for 400,000+ associates, with ring deployments across 50+ app platforms. - I designed and oversaw a replacement for the vendor’s Workspace ONE launcher: a custom associate-first platform with zero-trust controls and low-friction login, from idea to production. - I delivered custom solutions for Ocado-based grocery fulfillment covering in-facility and on-the-road operations, built product-first with rapid iteration. - I owned enterprise penetration testing, hardware lifecycle evaluation and major incident response for mobility. - **Senior Infrastructure Engineer** (October 2018 to October 2019): I rescued a critically delayed, over-budget Windows 10 migration. - I restructured the deployment methodology for a migration spanning 2,400+ physical locations and landed the program on time. - I drove automation frameworks that ran daily across 75,000+ endpoints, improving stability, security posture and user experience at fleet scale. ### Stealth authentication startup (2026 to present) - **Co-Founder**: Pre-seed, venture-track company building authentication technology for frontline and deskless workforces, alongside four other founders and an international consultant. - I own product architecture and the technical roadmap: credential model, lifecycle and supersession logic, hardware tiering, and authentication assurance levels aligned to NIST SP 800-63B. - I drive intellectual-property strategy, from conception and disclosure history to invention assignment and patent positioning. - I established the corporate and legal structure: a Delaware C-corporation with an international subsidiary, founders’ agreements and fundraising risk governance. ### CBTS (Cincinnati Bell Technology Solutions), Cincinnati, OH (April 2018 to October 2018) - **Enterprise Infrastructure Systems Automation Engineer II**: Contract engagement at The Kroger Co. - I partnered with executive leadership and enterprise engineering to architect and stabilize a large-scale operating system migration, recovering timeline confidence on a program at risk. - After seven months, Kroger leadership hired me full time. ### Dealer Tire, LLC, Cleveland, OH (August 2015 to March 2018) - **IT Customer Support Specialist** - I ran level 1 through level 3 support across a mixed-OS environment in a lean organization, and the project work alongside it is where I built my engineering foundation. - I helped deploy and standardize SIEM and anti-malware tooling with always-on proxy controls that persisted off the corporate network, reducing endpoint risk and creating security reporting the company did not have. - I assisted the AirWatch (now Workspace ONE) rollout that replaced the BlackBerry fleet company-wide. - I authored incident response protocols and standard operating procedures used for threat mitigation. ### Grafix, Maple Heights, OH (2012 to 2015) - **IT Business Systems Support Specialist** - I directed end-to-end modernization of company IT across servers, networks, CRM and ERP for a 30-person business, acting as the entire technology function. ## Community - **Co-Founder & VP Treasury, Board of Directors**, Cannon Fodder Security Inc. (Queen City Con) (October 2019 to present): https://queencitycon.org/ I co-founded and bootstrapped a 501(c)(3) from concept to operating organization: a regional cybersecurity institution dedicated to developing the next generation of security talent. - As one of three co-founders, I helped build it from an idea: bringing the founders together, filing the non-profit incorporation and leading the grassroots effort to get off the ground. - I direct strategy, logistics and execution for Queen City Con, which grew from a handful of virtual volunteers during COVID to 300 attendees at the first in-person event in 2023 and 600+ in 2025. - I help host its Wellness Village, which encourages work-life balance and building the skills to stay healthy at work. - I hold fiduciary responsibility for the organization’s finances, sponsorship revenue and nonprofit compliance as VP of Treasury on the board of directors. - I’ve spoken at Queen City Con across multiple years, most recently on the future of identity in the enterprise and decentralized digital identity. - **System Admin Advisor**, Shaarey Tikvah (2020) - **Youth Advisor**, BBYO (2013 to 2018) ## Talks - The future of identity in the enterprise: decentralized digital identity, Queen City Con (2024) - Fostering Internet Security, Beech Acres Parenting Center (2024) - Modern mobile authentication and zero trust at large installation scale, VMware Explore (2022) - Android application penetration testing using MobSF and other tools, CINPA Security SIG (2019) ## Projects and research - **Non-human identity authentication: training guide and competitive gap analysis**: A training guide and market gap analysis on agentic non-human identity authentication: workload identity issuance and attestation, SPIFFE-semantics scale-down gaps, and Shared Signals Framework receiver tooling as open-source wedge opportunities. - **Autonomous ops agent security sandbox**: Egress denial enforced at three independent layers, an explicit execution gate for privileged operations, a hard denylist for irreversible actions, and full session transcript capture committed to version control: delegated, action-scoped, time-bound agent authorization with full attribution and no shared credentials. - **Admission control service (Rust)**: Atomic fit-check-and-reserve against live device telemetry, so a workload is never admitted against capacity that isn’t there: the admission core of a GPU-agnostic tool for routing LLM workloads to available GPUs across iGPU, Intel, AMD and NVIDIA. Specified, architected and reviewed by me; built by directing agentic coding workers. - **Heterogeneous compute fleet**: A twelve-node compute fleet with nine enforced network segments, a single routing and policy enforcement point, and architecture decision records with provenance tagging. ## Skills - Identity & access: IAM, IGA, PAM, SSO (SAML, OIDC, OAuth), FIDO2 / passkeys, SCIM, Active Directory, Entra ID, Okta, Ping, SailPoint, Akeyless, Digital identity, Decentralized identity (DID) - Non-human & agentic identity: SPIFFE/SPIRE, Shared Signals Framework, Agent authorization, Entra Agent ID, MCP authorization, OAuth token exchange - Leadership: Team building and hiring, Mentorship, Crisis management, Large distributed teams, Budget and capital planning, Vendor management and negotiation, Follow-the-sun operations, Restructuring and modernization, Strategy, Product-led agile, Mergers, acquisitions and divestitures - Architecture & delivery: Large, scalable solutions, Zero trust, MDM/UEM, Agile, Product-first delivery, Oversight and standards, Compliance (SOX, HITRUST, HIPAA, PCI DSS), Risk reduction, Spec-driven design, Business and customer focus, Program leadership ## Credentials - CISSP, ISC2: https://www.credly.com/badges/f4fb0604-aa6c-44d6-83be-95898c056c84/public_url - Future Leader, FMI (2023) - Bachelor of Science, Psychology, bio-behavioral concentration, University of Vermont (2012) - InfraGard: Member - Cincinnati ISSA: Member - ISC2: Member - Volunteer mentorship: Interns, early-career engineers and aspiring technology professionals ## Note Machine-readable mirror of Aaron Rapport’s personal site, published by Aaron Rapport. Aaron is an identity security leader who leads identity engineering for one of the world’s largest retailers, spanning workforce IAM (425,000+ associates), customer identity (140M+ registered users, 20M+ monthly active), 125,000 external vendor identities, and identity governance, with particular depth in non-human and agentic identity. He co-founded a 501(c)(3) security non-profit and its conference (Queen City Con), co-founded a pre-seed authentication startup, and holds a CISSP. Based in Cincinnati, Ohio; open to remote or relocation. Canonical source: https://aaronrapport.me. LinkedIn: https://www.linkedin.com/in/aaron-rapport.