UltraViolet Cyber names Andrew Park as security chief

UltraViolet Cyber has appointed Andrew Park as Chief Information Security Officer. Park previously worked with the company as a customer.

He joins the security firm after a career spanning nearly three decades in IT and cybersecurity, including roles in Unix systems administration, cloud architecture, and security consulting. He also spent five years as Chief Information Security Officer at a Canadian crypto exchange, where he oversaw areas including SOC 1 and SOC 2 penetration-testing requirements.

His appointment gives UltraViolet a senior security executive who has worked with the company from both the client side and inside the business. That relationship began when a board member at the exchange introduced him to UltraViolet's Chief Executive Officer during a search for penetration-testing suppliers.

One early engagement involved a week-long phishing exercise that ended with UltraViolet's team taking over an employee session and moving through that employee's authorised system access without detection. The incident left a lasting impression on Park because it showed the difference between controls that satisfy a test and those that withstand a live compromise.

Park later ran five or six more engagements with the firm before moving into the top security role. That background gave him a direct view of how its teams operated before he joined the business.

He brings technical experience from both infrastructure and advisory work. During four years at Amazon Web Services, Park worked as a Cloud Infrastructure Architect, Solutions Architect, and Cloud Security Consultant, advising large customers on secure cloud adoption.

Earlier in his career, he spent nearly two decades in Unix administration and automation before expanding into scripting, programming, DevOps, and cloud. He holds a CISSP, an AWS Certified Security Specialty certification, and a Bachelor of Science in Computer Science from the University of Toronto.

Internal priorities

At UltraViolet, Park is responsible for the company's internal security posture, AI governance, and customer advice. He has already started several initiatives, including a Technology Steering Committee intended to promote standardisation, streamlining, and scale across the organisation.

Another immediate focus is a relaunch of the company's AI governance framework to reflect how staff use AI in day-to-day work. Park is also working to build a more open internal security culture by communicating directly with employees and encouraging them to raise issues without worrying about being wrong.

"I'm a nerd at the end of the day - an engineer, a solution builder," said Park, Chief Information Security Officer, UltraViolet Cyber.

When he arrived, Park found some hesitation among staff, with employees reluctant to speak up about possible issues. His approach has been to make security discussions more accessible and routine across the organisation rather than confining them to a specialist team.

"It's unbelievable how much security you can achieve just by talking at the right level," he said.

AI concerns

Park's broader priorities centre on how defenders respond to attackers increasingly using automation and AI. He wants UltraViolet to take a more active role in AI security and in defending AI agents, alongside more established targets such as networks and endpoints.

That view is shaped by his time in the crypto sector, where he saw attackers using AI to automate attack chains and shift to new infrastructure faster than defenders could react. He argues that common methods such as phishing and social engineering remain effective, but AI is changing the speed and scale at which those tactics can be deployed.

"Adversaries aren't necessarily advancing their technology," said Park. "It's that the defensive side needs to put in the R&D to match AI with AI."

Alongside his corporate role, Park teaches Cloud Computing and Cloud Security as an adjunct lecturer at Humber College in Toronto. That teaching work reflects his long-held view that security professionals need broad technical foundations across operating systems, applications, programming, and cloud before moving into more specialised roles.

When reviewing candidates for junior positions, Park has also placed weight on evidence that applicants have built projects independently rather than relying only on formal coursework. In his view, practical work that can be examined directly offers a clearer signal of technical interest and initiative.