Employee Spotlight: Meet Brian Brunelle, Our Security Risk Management Expert

My name is Brian Brunelle, I am the Director of Risk Management & Audit within the Information Security practice at GraVoc. I grew up in GraVoc’s favorite city – Peabody, Massachusetts!

At GraVoc, I lead the Information Security practice along with my co-director, Michael Kannan. I oversee the work we do for IT audits, social engineering testing, and risk management. This involves everything from writing policies and procedures, conducting audits, and performing readiness assessments for ISO 27001 to assisting with security compliance. We also work with a lot of financial institutions, which again involves audits, managing information security programs, and sitting on tech and security steering committees.

My personal favorite is the social engineering work, where we send phishing emails to get people to click. Basically, anything you would get a mass email communication from, we’ve tried to spoof at some point. We also do these exercises in person or over the phone, trying to get people to let us remote in or give us their passwords, or give us access to server rooms and non-public areas.

I find these social engineering exercises very engaging and interesting. It all creates a learning opportunity and good conversation about security awareness and education, which is very important.

I like that every day is different. We’re always busy, no two days are the same. In fact, throughout the day, I rotate between tasks, so things never get stale. It’s always something different, which is an interesting challenge, but it keeps you fresh, aware, and disciplined.

Cybersecurity is an extremely wide and deep field; the constant changing of exposure is how you stay current with the latest and greatest.

Outside of work, I’m a father of three young boys, so that eats up most of my time and it’s wonderful but also draining. Sometimes my wife and I joke that coming to work, especially a place like GraVoc, is the relaxing part of my day. Also, I enjoy being outdoors in nature with my older kids!

One of the best thing businesses or individuals can do is avoid being the low-hanging fruit – don’t reuse passwords, don’t use short, guessable passwords, and don’t have your password be the same as your username. The average bad actor is not targeting you as an individual or company, they’re looking for the easiest target to exploit. If you spend a little time and money to do the minimum, that’s usually enough so the bad actor will be unsuccessful in their initial hacking attempts and move on to next target. Do the basics well and you’ll be better off than a lot of your industry peers.