Harrell highlights that security leaders remain alert to initiatives coming out of the White House, or as conflict arises around the world.

“This can have significant impact to you, your supply chain, and your interdependencies,” he says. “Security is local but it’s also worldwide.”

Harrell’s career has spanned both the public and private sector over the last 25 years. He’s held roles at Duke Energy Corporation and served as the first Assistant Director for Infrastructure Security at the U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with being appointed as the Assistant Secretary for Infrastructure Protection at the U.S. Department of Homeland Security under President Donald J. Trump (DHS).

As the son of a police officer, Harrell says his early years centered on a more traditional antiterrorism portfolio, but quickly gravitated towards digital threats to people, programs and infrastructure.

“I have been fortunate to serve the American people multiple times, and that’s a real honor, but I am most proud of my time working to keep private-sector critical infrastructure secure,” he says. “Government plays a small role, but the men and women working to keep the power grid, drinking water, and key transportation systems secure go to battle every day to keep these systems reliable and secure.”

Reflecting on his professional achievements, Harrell says that much of his life and career has been shaped by his time in the U.S. Marine Corps.

Government plays a small role, but the men and women working to keep the power grid, drinking water, and key transportation systems secure go to battle every day to keep these systems reliable and secure.

“The deployments overseas, professionalism, and discipline helped build a foundation for my life,” he says. “In addition, serving the American people as the sixth Assistant Secretary for Infrastructure Protection at DHS was a true honor. Also, I love working in the energy sector. It’s truly the tip-of-the-spear when it comes to protecting vital services and the American way of life.”

In 2020 he took on the role as Chief Security Officer (CSO) at Avangrid Energy, a large utility operating across 25 states.

“It was a ‘build opportunity’, and we did exactly that,” Harrell recalls. “We immediately added insider risk, a robust exercise program, threat hunting, and data exfiltration tools, along with a comprehensive training and awareness program. Add third-party risk assessments and mitigations, and we quickly became a ‘harder’ target.”

Owning Security

Within his role as CSO, Harrell says he owns all of security for Avangrid.

“We are a shop that has embraced ‘convergence’, so I own cybersecurity (IT and OT), physical security, privacy, fire protection, and business continuity,” he says. “This allows us to fully understand the threat and remove institutional ‘silos’ that many legacy programs still battle.”

But, Harrell says, he couldn’t have developed the program alone.

“All the credit for building something world-class goes to the Corporate Security & Resilience Office staff,” he adds. “It’s easy to look good when you surround yourself with the best in the business.”

Supporting Security

Harrell often speaks on the importance of mentorship within the industry and developing skills for fellow security professionals. Throughout his career, he has turned to seasoned professionals to utilize their wisdom and insights.

“First, ask, ‘where do I want to be in 10 years’ or ‘what role do I want in 20 years?’ Then, along with some backwards planning, we identify key players in the field and engage,” he says. “You’re not looking to dominate their time or have them write you a career script, but you’re hoping to pick up on mannerisms and little nuggets of wisdom. Don’t have one mentor, have many you look up to and start building a playbook.”

For those looking to enter the industry, Harrell says there is no bad time to get into cybersecurity, or National Security for that matter.

“The field moves fast, the characters are always changing, and the Board is finally interested in highlighting cyber as a ‘business risk’,” he says. “So, don’t wait for the certification or complete the degree — dive in and start getting real hands-on-keyboard experience with threat hunting, incident response, intelligence, and defending industrial control systems (ICS) from nation-state adversaries.”

---