In healthcare, a security incident can stop clinical care, which puts the CISOs below in some of the most demanding seats in the field. Five of the seven have led security at children’s hospitals, from Arkansas and Connecticut to Minnesota, Southern California, and Toronto. Their routes into the role vary widely. One started as an Air Force computer operator. Another worked as an intelligence analyst before earning a master’s in information assurance. A third built a data center for Gap and supported the Grand Ole Opry’s IT. Others came up through Big Four audit, health insurance, and clinical applications. Together they protect children’s hospitals, academic medical centers, public health systems, and regional providers.
Chris Wilkins – VP & CISO, Marshall Health Network
Chris Wilkins spent nine years as a computer operator in the U.S. Air Force before joining Arkansas Children’s Hospital as a systems analyst in 1998. Apart from a brief stint as a telecom analyst at Baptist Health, he spent more than 20 years at Arkansas Children’s, moving from network administrator to security administrator to director of IT security, where he built the enterprise security program, its awareness training, and its budget. He then managed IT security operations at Methodist Le Bonheur Healthcare in Memphis and served as CISO of Spartanburg Regional Healthcare System in South Carolina for three years. Wilkins became VP and CISO of Marshall Health Network in Huntington, West Virginia, in October 2024.
E-Jaaz Ali – CISO, Alameda Health System
E-Jaaz Ali started in desktop support at Golden Gate Telecommunication before spending six years in intelligence. As an intelligence analyst, he coordinated information security programs, wrote operating procedures for classified systems used by more than 50 people, and cut costs by more than 20% by streamlining the deployment of personnel and assets across five countries. As a senior intelligence analyst with the Department of Defense, he served as information security NCOIC and mentored a team of 13. After earning a master’s in computer science and engineering with an emphasis on information assurance from Santa Clara University, he spent five years as a senior security engineer at El Camino Hospital, building programs for medical device security, third-party and M&A risk assessments, and internal audits against HITRUST and NIST CSF. Ali has served as CISO of Alameda Health System since May 2020 and holds CISSP and HCISPP certifications.
John Shepard – CISO, Connecticut Children’s
John Shepard has spent more than three decades in security in the Hartford area. He started at Aetna in 1993 as an IT internal auditor and spent five years as a senior security engineer. At Cigna he managed information protection security engineering for six years and served as information protection director for nine. Shepard joined Connecticut Children’s in March 2016 as CISO and director of information security, a role he has held for more than ten years.
Micheal Perryman – CISO, San Juan Regional Medical Center
Micheal Perryman started as a field service engineer running the hardware help desk at Gaylord Entertainment’s headquarters, supporting the Grand Ole Opry, Opryland, and Country Music Television through Y2K remediation. At Gap Inc. he rose from network engineer to data center services manager, leading the build of a new data center in Gallatin, Tennessee, relocating all servers from Kentucky with no business downtime, and building out the network for a 1.5 million square foot logistics center. After working as an information security NOC engineer at Convergys and spending 13 years leading IT at Ted Pella, he moved into healthcare at Sky Lakes Medical Center in Oregon as senior network architect and then manager of secure network architecture. Perryman became CISO and VP of information security at San Juan Regional Medical Center in Farmington, New Mexico, in October 2024, overseeing operational resilience and information security for its clinical and business systems.
Joshua Roth – CISO, CHOC Children’s
Joshua Roth started as a senior network engineer at Spectrum Communications, leading more than 100 network implementations for municipalities and school districts. As an outsourced network services manager for the City of Riverside, he ran infrastructure for its police, fire, and utility departments and led a citywide wireless system supporting public safety. He joined Kaiser Permanente in 2007, managing network security services and malicious code defense, then worked as a security and privacy manager at Deloitte and supported healthcare clients at McAfee. Back at Kaiser Permanente from 2013 to 2022, he directed cyber security data protection services, covering cloud security, data loss prevention, key management, email security, and web application firewalls. Roth became CISO of CHOC Children’s in Orange, California, in March 2022. He has more than 19 years in healthcare and holds CISSP and QTE certifications.
Sam Githinji – CISO, Children’s Minnesota
Sam Githinji started as an information systems analyst at Bemis Company and moved into healthcare at Park Nicollet Health Services as an applications analyst, building speech recognition forms for clinicians. He moved into security there, working incident response and forensics before building and leading the IT security and compliance team, including policies to secure biomedical devices. At HealthPartners he managed identity and access management, leading the Epic security implementation, then ran enterprise technology risk management and third-party risk. Githinji joined Children’s Minnesota in 2017 as director of information security and compliance and became CISO in 2021. He chairs the enterprise Information Risk Advisory Council, guides AI security governance, and works with clinical engineering to build security into medical device management.
Scott Currie – CISO, UC San Diego Health
Scott Currie started in M&A IT due diligence before spending five years at PwC, managing a portfolio of more than 20 audit clients in Boston and leading the privacy practice in the Toronto office. He served as IT compliance manager and North American CISO for Johnson & Johnson’s consumer companies, then led security at two automated pharmacy dispensing companies, PharmaTrust and MedAvail Technologies. In 2016 he became the inaugural CISO of The Hospital for Sick Children in Toronto, building its security strategy from the ground up, partnering with a managed security provider for a 24/7 SOC, and designing the security architecture for a shared health information system with the Children’s Hospital of Eastern Ontario. He later also served as CISO of University Health Network and sat on the Ontario government’s Cyber Security Expert Panel, chairing its communications and stakeholder relations subcommittee. Currie became CISO of UC San Diego Health in August 2022.
Security at the Point of Care
These seven CISOs share an understanding that in healthcare, security failures reach patients. Wilkins, Shepard, and Githinji built their careers largely inside health systems and insurers, rising from technical roles to lead security. Ali and Roth brought intelligence and network engineering backgrounds into hospital environments. Perryman moved from retail data centers into clinical networks, and Currie carried audit and pharmacy technology experience into building programs from scratch on two sides of the border. Across children’s hospitals, academic medical centers, and regional providers, they keep the systems behind patient care secure and available.
Discover more CISOs securing their organizations:
- Where the Fleet Comes Ashore: Virginia Beach’s Cybersecurity Leaders to Watch
- The Gate City’s CISOs to Watch
- Atlantic Edge: Portugal’s Cybersecurity Leaders to Watch
- Famously Hot, Seriously Secure: Columbia’s CISOs to Watch
- The Duke City’s CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.