Machine-readable mirror of Aaron Rapport’s personal site, published by Aaron Rapport. Aaron is an identity security leader who leads identity engineering for one of the world’s largest retailers, spanning workforce IAM (425,000+ associates), customer identity (140M+ registered users, 20M+ monthly active), 125,000 external vendor identities, and identity governance, with particular depth in non-human and agentic identity. He co-founded a 501(c)(3) security non-profit and its conference (Queen City Con), co-founded a pre-seed authentication startup, and holds a CISSP. Based in Cincinnati, Ohio; open to remote or relocation. Canonical source: https://aaronrapport.me. LinkedIn: https://www.linkedin.com/in/aaron-rapport. Aaron Rapport identity & security engineering leader Identity and security engineering leader Aaron Rapport leads identity security for 425,000 workers, 100M+ customers and their AI agents. Queen City Con and startup co-founder. CISSP. I lead identity engineering for one of the world’s largest retailers: 425,000 employees, over 100 million customers, and every machine, workload and AI agent in between. I build the teams and systems that decide who, and what, gets in: workforce, customer, vendor, workload, and now the AI agents acting on their behalf. Show me a difficult problem and I’ll show you the art of the possible. I've spent 12+ years leading identity and security work and now run a team of roughly 40 with a multimillion-dollar capital and operating budget, spanning workforce IAM, CIAM, vendor identity and identity governance. I co-founded a pre-seed authentication startup and a security non-profit that runs a 600-attendee conference. My current focus is non-human and agentic identity: how workloads and AI agents prove who they are and what they are allowed to do. Cincinnati, OH Open to remote or relocation Vice President (VP) of Cybersecurity Vice President (VP) of Information Security Vice President (VP) of Identity Security Vice President (VP) of Identity and Access Management (IAM) Vice President (VP) of Security Engineering Vice President (VP) of Technology Vice President (VP) of Engineering, security, identity or platform Senior Director or Director of Cybersecurity Senior Director or Director of Information Security Senior Director or Director of Identity Security Senior Director or Director of Identity and Access Management (IAM) Senior Director or Director of Identity Engineering Senior Director or Director of Security Engineering Senior Director or Director of Security Architecture Senior Director or Director of Technology Head of Identity, Head of IAM or Head of Identity Security Head of Cybersecurity or Head of Security Engineering Deputy Chief Information Security Officer (Deputy CISO) Chief Information Security Officer (CISO) Business Information Security Officer (BISO) cybersecurity cyber security information security InfoSec IT security security engineering identity security identity and access management IAM IdAM workforce identity customer identity CIAM identity governance and administration IGA privileged access management PAM non-human identity NHI machine identity workload identity agentic identity AI agent security zero trust authentication security leadership technology leadership engineering leadership https://www.linkedin.com/in/aaron-rapport 12+ years leading identity and security 140M+ customer identities secured 425,000+ workforce identities secured 20M+ monthly active customers 125,000 vendor identities managed $250M+ in value delivered I directed a 100+ person, multi-team program that brought custom and off-the-shelf applications across 20+ brands onto modern, safe and secure standards-based auth (SAML, OIDC, SCIM), on time and without unscheduled business outages. The work spanned standard migrations, custom shims and full secure code rewrites, delivered by a global team on a follow-the-sun support model. SAML OIDC SCIM Program leadership I led and contributed to the architecture that consolidated multiple legacy identity providers into two cloud-native platforms, inside union agreements and strict compliance rules. We then replaced an aging, risky vendor authentication solution serving over 100,000 users with complex regulatory MFA requirements. Now I’m leading the ground-up rebuild of the consumer platform with passkeys, built-in fraud and bot defense, and industry-leading, standards-compliant design. Workforce IAM CIAM Passkeys Architecture I engineered enterprise-wide delivery, directed the mobile platform’s security architecture and rollout, and led a SCEP certificate proxy that turned multiple 35-second per-app logins into one device login for 400,000 associates. Mobility Zero trust SCEP Crisis delivery I run non-human and agentic identity across the customer and workforce estates: workload identity (SPIFFE/SPIRE), token exchange, MCP authorization, and the guardrails and training that let teams use agentic AI without handing it the keys. My architecture and our team made a safe, one-click process possible for managing agentic identities from creation to retirement. Non-human identity Agentic AI SPIFFE/SPIRE MCP I first met Aaron when I had just started as an intern. It’s been eight years now and my life has changed drastically: I graduated, I’m now a senior engineer on his former team, I got married, and I’m growing my career in ways I could not have imagined. I could not have done this without his guidance and support. He is always there for me, and offers this level of support to all of his teams. He brings a depth of knowledge, compassion and rigor to his job that would be an asset to any team. Keni Senior engineer, formerly an intern on Aaron’s team 2026 Aaron exemplifies what it means to be a leader at every level. He is always quick to lighten the mood, but when something needs to be done he’s in the trenches with his team, ensuring they have the support they need and never forgetting to put the customer first. Jeff Colleague 2023 There doesn’t seem to be a project too big or too complex which he can’t excel at. His growth as a technical expert and people leader is something worth watching. Senior technical colleague 2022 The Kroger Co. Cincinnati, OH 2018-10 true 2022-09

I lead identity engineering across workforce IAM (425,000+ associates and 25,000+ contingent workers), customer identity and access management (CIAM: 140M+ registered users, 20M+ monthly active), external vendor identity (125,000 identities) and identity governance, on a multimillion-dollar capital and operating budget.

I lead a team of roughly 40 spanning workforce IAM, customer identity, vendor identity, directory services, PAM and identity governance: full-time engineers plus global contractors and flex specialists, with a manager, a domain lead and three tech leads reporting to me. I grew the function from a team of 7, hiring 15 engineers and 100+ contractors. I directed a 100+ person, multi-team program that modernized thousands of business-critical and custom applications to standards-based authentication in two years. I architected the consolidation of multiple legacy identity providers into two modern, cloud-native platforms across 20+ enterprise brands, working inside union agreements and strict workforce-compliance requirements. I’m leading the ground-up rebuild of the consumer identity platform, with built-in fraud and bot defense and passkey/WebAuthn support the legacy platform could not offer. I own non-human and agentic identity across the consumer and workforce estates, and built the guardrails and training that let teams adopt agentic AI safely, including a one-click process that manages agent identities from creation to retirement. I’m accountable for regulatory and audit governance across the identity estate (PCI DSS, HITRUST, SOC 2), lead identity major incident response, and serve on accelerator tiger teams reporting to C-suite executives. I significantly raised platform availability and tightened major incident response, cutting time-to-engagement on incidents by more than 80%. I delivered enterprise MFA for associates and vendors that meets state privacy law, PCI, union agreements and no-personal-device constraints, and introduced SCIM provisioning, custom OIDC token brokers and FIDO2/passwordless for the workforce. I redesigned the workforce authentication experience, sharply reducing daily login friction for 425,000+ associates and reclaiming significant labor productivity. I rebuilt a waterfall IAM organization into an agile practice with intake, review and feedback loops and a one-sprint SLA, and carved directory services, PAM and secrets management into dedicated teams. 5 8 Leadership IAM IGA PAM SSO Entra ID Okta Ping Identity DaVinci orchestration SailPoint FIDO2 / passkeys SCIM SPIFFE/SPIRE Non-human & agentic identity 2019-10 2022-09

I was the principal technical authority for mobility security and the associate mobility platform.

I directed the architecture and rollout of 100,000+ managed mobile devices in a 12-month window to keep the business running through the COVID-19 pandemic: a zero-to-one platform on a hard deadline. I directed the development and Tier-1 vendor partnership behind a SCEP certificate proxy that replaced per-app logins (35+ seconds per app per session on shared devices) with a single device login for 400,000+ associates, with ring deployments across 50+ app platforms. I designed and oversaw a replacement for the vendor’s Workspace ONE launcher: a custom associate-first platform with zero-trust controls and low-friction login, from idea to production. I delivered custom solutions for Ocado-based grocery fulfillment covering in-facility and on-the-road operations, built product-first with rapid iteration. I owned enterprise penetration testing, hardware lifecycle evaluation and major incident response for mobility. 3 3 Android iOS MDM / UEM SCEP Cert Proxy Zero Trust Kotlin Java Workspace ONE Product leadership 2018-10 2019-10

I rescued a critically delayed, over-budget Windows 10 migration.

I restructured the deployment methodology for a migration spanning 2,400+ physical locations and landed the program on time. I drove automation frameworks that ran daily across 75,000+ endpoints, improving stability, security posture and user experience at fleet scale. 1 2 Windows PowerShell .NET Automation Large-scale rollout Security Stealth authentication startup 2026 true

Pre-seed, venture-track company building authentication technology for frontline and deskless workforces, alongside four other founders and an international consultant.

I own product architecture and the technical roadmap: credential model, lifecycle and supersession logic, hardware tiering, and authentication assurance levels aligned to NIST SP 800-63B. I drive intellectual-property strategy, from conception and disclosure history to invention assignment and patent positioning. I established the corporate and legal structure: a Delaware C-corporation with an international subsidiary, founders’ agreements and fundraising risk governance. 2 2 Founder Authentication NIST SP 800-63B Product architecture IP strategy CBTS (Cincinnati Bell Technology Solutions) Cincinnati, OH 2018-04 2018-10 true 2018-04 2018-10

Contract engagement at The Kroger Co.

I partnered with executive leadership and enterprise engineering to architect and stabilize a large-scale operating system migration, recovering timeline confidence on a program at risk. After seven months, Kroger leadership hired me full time. 1 2 Systems engineering Infrastructure Automation Windows Mac Dealer Tire, LLC Cleveland, OH 2015-08 2018-03 true 2015-08 2018-03

I ran level 1 through level 3 support across a mixed-OS environment in a lean organization, and the project work alongside it is where I built my engineering foundation. I helped deploy and standardize SIEM and anti-malware tooling with always-on proxy controls that persisted off the corporate network, reducing endpoint risk and creating security reporting the company did not have. I assisted the AirWatch (now Workspace ONE) rollout that replaced the BlackBerry fleet company-wide. I authored incident response protocols and standard operating procedures used for threat mitigation. 1 2 Endpoint security SIEM Anti-malware Incident response AirWatch Customer support Grafix Maple Heights, OH 2012 2015 true 2012 2015

I directed end-to-end modernization of company IT across servers, networks, CRM and ERP for a 30-person business, acting as the entire technology function. 1 1 Windows Server management Networking ERP CRM SMB Cannon Fodder Security Inc. (Queen City Con) Cincinnati, OH 2019-10 https://queencitycon.org/ true

I co-founded and bootstrapped a 501(c)(3) from concept to operating organization: a regional cybersecurity institution dedicated to developing the next generation of security talent.

As one of three co-founders, I helped build it from an idea: bringing the founders together, filing the non-profit incorporation and leading the grassroots effort to get off the ground. I direct strategy, logistics and execution for Queen City Con, which grew from a handful of virtual volunteers during COVID to 300 attendees at the first in-person event in 2023 and 600+ in 2025. I help host its Wellness Village, which encourages work-life balance and building the skills to stay healthy at work. I hold fiduciary responsibility for the organization’s finances, sponsorship revenue and nonprofit compliance as VP of Treasury on the board of directors. I’ve spoken at Queen City Con across multiple years, most recently on the future of identity in the enterprise and decentralized digital identity. 4 2 501(c)(3) Non-profit Board Treasury Conference Community Shaarey Tikvah 2020 2020 false

BBYO 2013 2018 false

A training guide and market gap analysis on agentic non-human identity authentication: workload identity issuance and attestation, SPIFFE-semantics scale-down gaps, and Shared Signals Framework receiver tooling as open-source wedge opportunities. NHI SPIFFE Shared Signals Framework Agentic identity true Egress denial enforced at three independent layers, an explicit execution gate for privileged operations, a hard denylist for irreversible actions, and full session transcript capture committed to version control: delegated, action-scoped, time-bound agent authorization with full attribution and no shared credentials. Agent authorization Egress control Auditability true Atomic fit-check-and-reserve against live device telemetry, so a workload is never admitted against capacity that isn’t there: the admission core of a GPU-agnostic tool for routing LLM workloads to available GPUs across iGPU, Intel, AMD and NVIDIA. Specified, architected and reviewed by me; built by directing agentic coding workers. Rust Admission control Agentic development false A twelve-node compute fleet with nine enforced network segments, a single routing and policy enforcement point, and architecture decision records with provenance tagging. Homelab Network segmentation ADRs false Identity & access IAM IGA PAM SSO (SAML, OIDC, OAuth) FIDO2 / passkeys SCIM Active Directory Entra ID Okta Ping SailPoint Akeyless Digital identity Decentralized identity (DID) Non-human & agentic identity SPIFFE/SPIRE Shared Signals Framework Agent authorization Entra Agent ID MCP authorization OAuth token exchange Leadership Team building and hiring Mentorship Crisis management Large distributed teams Budget and capital planning Vendor management and negotiation Follow-the-sun operations Restructuring and modernization Strategy Product-led agile Mergers, acquisitions and divestitures Architecture & delivery Large, scalable solutions Zero trust MDM/UEM Agile Product-first delivery Oversight and standards Compliance (SOX, HITRUST, HIPAA, PCI DSS) Risk reduction Spec-driven design Business and customer focus Program leadership Identity & Access Management IAM CIAM IGA PAM Multi-factor authentication (MFA) SSO (SAML, OpenID Connect / OIDC, OAuth 2.0) SCIM FIDO2 / passkeys / WebAuthn Active Directory Identity governance Decentralized identity (DID) Non-Human & Agentic Identity Workload identity SPIFFE/SPIRE Shared Signals Framework Agent authorization Entra Agent ID MCP authorization OAuth token exchange Platforms Entra ID Okta Ping Identity DaVinci orchestration SailPoint Akeyless Workspace ONE (AirWatch) Endpoint management (MDM/UEM) SCEP Android iOS Windows Security & Compliance Zero Trust PCI DSS HITRUST SOC 2 SOX HIPAA NIST SP 800-63B SIEM Incident response and major incident management Penetration testing Endpoint security Regulatory and audit governance Risk management Policies and standard operating procedures Engineering & Delivery PowerShell .NET Kotlin Java Automation Large-scale rollout Product architecture Spec-driven design Agile Leadership Team building and hiring Large distributed teams Program leadership Budget and capital planning Vendor management and negotiation Crisis management Restructuring and modernization Mergers, acquisitions and divestitures (M&A) Mentorship Board service CISSP ISC2 624539 https://www.credly.com/badges/f4fb0604-aa6c-44d6-83be-95898c056c84/public_url Future Leader FMI 2023 Bachelor of Science, Psychology, bio-behavioral concentration University of Vermont 2012 InfraGard Member Cincinnati ISSA Member ISC2 Member Volunteer mentorship Interns, early-career engineers and aspiring technology professionals Queen City Con 2024 Speaker across multiple years; most recently on the future of identity in the enterprise. Beech Acres Parenting Center 2024 How foster parents can secure their family’s digital life, with a focus on caring for foster children. Co-presented with my wife, Judith Rapport, MSSA, LISW. Scheduled again for spring 2027. VMware Explore 2022 CINPA Security SIG 2019 false Father Husband Homelab Mentor International travel Foodie Photography Hardware hacking Cooking