Skip to content
Open to board advisory and board seats — 2H 2026, then CY 2027–2028.
See details →
About

Michael York

VP, Information Security & DevOps

About

I lead information security and DevOps at SavvyMoney, a fintech platform serving 1,500+ financial institutions as they deliver credit and financial-wellness products to the people they serve. My work sits at the intersection of three things that don't always get along: moving fast, staying secure, and proving it to auditors, regulators, and demanding partners.

Education

-

Master of Information and Cybersecurity (MICS)

UC Berkeley, School of Information

Credentials

Certifications

  • CISSP — Certified Information Systems Security Professional
    ISC2 ·
  • CISA — Certified Information Systems Auditor
    ISACA ·
  • CISM — Certified Information Security Manager
    ISACA ·
  • CRISC — Certified in Risk and Information Systems Control
    ISACA ·
  • AWS Certified Solutions Architect – Professional
    Amazon Web Services ·
  • AWS Certified Solutions Architect – Associate
    Amazon Web Services ·
  • AWS Certified Security – Specialty
    Amazon Web Services ·
  • AWS Certified Advanced Networking – Specialty
    Amazon Web Services ·
  • AWS Certified Big Data – Specialty
    Amazon Web Services ·
  • AWS Certified SysOps Administrator – Associate
    Amazon Web Services ·
  • AWS Certified Cloud Practitioner
    Amazon Web Services ·
  • Microsoft Certified: Azure Solutions Architect Expert
    Microsoft ·
  • Microsoft 365 Certified: Enterprise Administrator Expert
    Microsoft ·
  • Microsoft Certified: Azure Administrator Associate
    Microsoft ·
  • Microsoft Certified Systems Engineer: Security (MCSE)
    Microsoft ·
  • Microsoft Certified Trainer (MCT)
    Microsoft ·
  • CompTIA Network+
    CompTIA ·
  • CompTIA Linux+
    CompTIA ·
  • CompTIA A+
    CompTIA ·
  • CompTIA CTT+ (Certified Technical Trainer)
    CompTIA ·
  • Apple Certified Macintosh Technician (ACMT)
    Apple ·
  • SAP Certified Application Associate – SAP S/4HANA Cloud (Finance)
    SAP ·
  • Sage Business Cloud Accounting Certification
    Sage ·
  • QuickBooks Certification
    Intuit ·

Professional affiliations

  • Cloud Security Alliance
    Working Group Member — CxO Trust · since 2021
  • (ISC)²
    Member · since 2010
  • ISACA Silicon Valley Chapter
    Member · since 2010
  • InfraGard
    Member · since 2018

Skills

Information Security · DevOps · Cloud Security Architecture · Governance Risk & Compliance (GRC) · Security Operations & Automation · Threat Intelligence & Threat Modeling · Incident Response · AI Governance · Vendor & Third-Party Risk · SOC 2 Type II · CSA STAR Level II · NIST CSF · HITRUST r2 · FedRAMP Moderate · DoD SRG · CMMC · CJIS · ITAR · PCI DSS 4.0 · SOX · ISO 27001 · HIPAA · CCPA · GDPR · Multi-Region AWS · Terraform · Board- & Investor-Level Risk Reporting

Privacy

This is a personal site. The short version: I collect the minimum needed to reply to you or send what you asked for, analytics only run if you opt in, nothing follows you across other sites, and I don't sell your data.

Contact form
Your name, email, and message are sent to me by email (via Resend) so I can reply. They aren't stored in a database beyond what's needed to deliver the message and prevent abuse. Cloudflare Turnstile screens for bots — it doesn't set tracking cookies.
Newsletter
If you subscribe, your email is stored on Cloudflare (D1) and used only to send Field Notes. Sign-up is double opt-in (you confirm first), and every issue has a one-click unsubscribe. Sending is handled by Resend.
Ask Michael (AI)
Questions you type are sent to Cloudflare Workers AI to generate an answer grounded in this site's public content. Conversations aren't stored or used to train models. The chat is rate-limited and bot-protected.
Cookies & local storage
First-party storage: your theme choice, your cookie-consent decision, and (if you allow it) anonymized thumbs-up/down on AI answers. No advertising and no cross-site tracking. Global Privacy Control (GPC) is honored.
Analytics
Google Analytics runs only if you turn Analytics on in the cookie banner — it is off by default, and all it records is which pages get viewed. Google's advertising features (Google Signals, ad personalization) are disabled, and IP addresses are anonymized. It never loads if your browser sends a Global Privacy Control or Do Not Track signal, even with consent stored. Turn it off in the banner and collection stops and its cookies are deleted from your browser.
Your data, your rights
Your information is never sold or shared, and is used only for the purpose you provided it. To access, correct, or delete anything, email michael@ypro.dev and I'll handle it promptly.