Fractional CISO · Fractional CTO · Identity Security
Executive-level security and technology leadership for organizations that need senior judgment, not another full-time hire. Fractional CISO and CTO engagements, focused assessments, and hands-on identity security, led by Filip Pantovich: 28+ years in IT and security, including nearly 21 in the U.S. Air Force.
Most organizations don't need a full-time CISO or CTO. They do need someone senior who can own the problem, set priorities, and make sure the work actually gets done.
There's no clear owner, no roadmap, and no straight answer when leadership asks "how exposed are we?"
Security questionnaires, cyber-insurance renewals, and PCI DSS or CMMC (the Defense Department's cybersecurity requirement for contractors) all need credible answers and evidence.
Accounts pile up, privileged access sprawls, and MFA is inconsistent. Stolen credentials remain one of the most common ways attackers get in.
Technical debt, undocumented systems, and knowledge that lives in one person's head.
Teams are already using AI tools. The question is whether that's safe, governed, and actually productive.
Overlapping licenses and platforms that cost more than the value they deliver.
Each engagement pairs leadership-level judgment with the technical ability to carry the work forward, alongside your existing team, IT staff, or managed service provider (MSP).
Ongoing ownership of your security program, so leadership knows what matters, what it costs, and what's being done about it.
PROOF · U.S. AIR FORCEAuthored Air Force-wide security policy that informed updates to the DISA STIGs, the Defense Department's system-hardening standards.
Clear technical direction for modernization, architecture, and spending decisions, tied to business priorities rather than vendor pitches.
PROOF · U.S. AIR FORCEAs global functional lead, directed the Air Force's storage and virtualization enterprise: 300+ staff supporting a 900,000-user network.
Harden the systems that decide who gets in and what they can touch. That's where many breaches begin.
PROOF · CURRENT ROLESecures 40,000+ corporate and customer identities across four Active Directory domains. Drove Active Directory consolidation from nine domains to four, with CIS, SOX, and PCI DSS requirements as the minimum security baseline.
Get ready for the frameworks your customers, insurers, and contracts require, grounded in what assessors actually check.
Readiness and advisory support, not formal certification.
PROOF · DEFENSE & CURRENT ROLEMore than two decades of hands-on hardening and continuous compliance oversight in Defense Department environments, and PCI DSS-aligned identity security today.
Move fragile, manual systems toward automated, documented, version-controlled platforms that survive a team change.
PROOF · U.S. AIR FORCEDelivered an $8.5M infrastructure modernization across 500+ virtual servers while holding 99.9% uptime.
Put AI to work on real engineering and operational workflows, with guardrails, human review, and processes your team can maintain.
PROOF · PRO BONOReplaced a 28-hour manual process (about 85% accurate on first pass) with an AI agent that delivers in about 30 minutes at 99%+ first-pass accuracy.
Every engagement, including ongoing retainers, begins with a written scope, measurable deliverables, and an agreed working rhythm.
An independent review of a defined area, with a plan you can act on.
Best for: a specific concern, an upcoming audit, or "where do we even start?"
Discuss an assessment →A recurring CISO or CTO role with defined responsibilities and accountability.
Best for: organizations that need a senior owner, part-time.
Discuss fractional leadership →Hands-on design, implementation support, or training with clear milestones.
Best for: an MFA rollout, identity cleanup, modernization, or AI adoption.
Discuss a project →Fees, schedule, access requirements, and confidentiality terms are agreed in writing before any work begins.
Selected outcomes from Filip's Air Force service, current enterprise role, and pro bono work. This is the experience every engagement draws on.
For a global life-sciences organization, Filip helped design and build an AI agent, with a purpose-built working persona, to handle data analysis, extraction, and entry for a recurring deliverable.
An $8.5M infrastructure retrofit across 500+ virtual servers, adding a petabyte of storage.
U.S. Air Force · globalConsolidated Active Directory from nine domains to four and standardized security across all of them, with CIS, SOX, and PCI DSS requirements as the minimum baseline.
Current enterprise roleAuthored security policy adopted Air Force-wide and used to inform updates to DISA STIG standards.
U.S. Air Force · enterpriseCyber personnel covered by the storage and virtualization training curriculum he was hand-selected to build, aligned across 11 career fields.
U.S. Air Force · career fieldStaff hours saved per year by automating system-access account creation while deployed.
Operation Enduring FreedomIn contracts managed as a resource advisor, with funds redirected to critical requirements.
U.S. Air Force · squadron/groupWith nearly 21 years inside Defense Department and joint environments, including systems supporting the Joint Staff, Filip understands both the requirements and how they play out on real networks.
Faithful Oversight provides readiness and advisory support. It is not a CMMC Third-Party Assessment Organization (C3PAO) or a PCI Qualified Security Assessor (QSA), but it can help you prepare to work with one.
Organizations trusted with critical systems deserve leadership that has actually built, secured, and operated them.
Filip's career started in 1998 as a federal civilian IT hire while he was still in school. It continued through nearly 21 years in the U.S. Air Force, including joint assignments and serving as the Air Force's global functional lead for Storage & Virtualization.
Today he architects enterprise identity and access management for a global live-entertainment company, securing more than 40,000 corporate and customer identities across four Active Directory domains. That keeps his technical depth current, not historical.
Across every role, the same habits carry through: automate the repetitive, document what matters, favor open-source and maintainable tooling over expensive licensing where it fits, and invest in the people around him. You get clear decisions, practical results, and knowledge that stays with your organization.
Oversight is a trust. The name reflects a simple standard: treat a client's systems, data, and budget as if they were his own.
A no-cost call to understand what's happening, what you want to improve, and any constraints. It's also a chance to make sure we're a good fit.
Priorities, deliverables, responsibilities, fees, and schedule agreed in writing, including how the work fits with your team and providers.
Progress against milestones, documented decisions, and knowledge transfer, so the results keep working after the engagement ends.
Not necessarily. Many clients start with a focused assessment or a single project and decide from there. The scope should match the problem.
Yes, and that's often the best setup. Filip provides senior direction, architecture, and hands-on depth, while your team or provider keeps day-to-day operations. Responsibilities are defined up front.
Yes, with readiness: gap analysis against NIST SP 800-171, remediation planning, and preparing evidence. Faithful Oversight is not a CMMC Third-Party Assessment Organization (C3PAO) and does not perform formal certification assessments.
Filip leads and delivers every engagement personally. You work directly with him, not with a hand-off team.
An NDA is standard. Access follows least privilege and is granted only for agreed work. Please never send passwords, keys, or sensitive system details through this website or by email.
Primarily remote, nationwide. Filip is based in the St. Louis metro area, and on-site work can be arranged when the engagement calls for it.
Filip takes on a limited number of part-time and project-based engagements at a time, so each one gets real attention. Meeting cadence, response times, and availability windows are agreed in writing in the scope.
Share the challenge, the outcome you want, and your timing. Every inquiry gets a personal reply from Filip.