Cybersecurity • Technical Project Management • IT Operations

I lead technical work where security, delivery, and operations meet.

I’m Mike Shelton, Head of Pentesting at Red Sentry. My background spans offensive security leadership, technical project management, cybersecurity consulting, and IT operations.

View experience Resume Contact LinkedIn

01Offensive Security Leadership

02Technical Project Management

03Cybersecurity Delivery

04IT Operations

About

Technical depth, delivery discipline, and practical leadership.

I lead the pentesting practice at Red Sentry, where my work spans technical leadership, project management, security delivery, team development, QA, resource planning, scoping, and client escalations.

My career has moved through IT support, systems administration, IT management, cybersecurity operations, security consulting, technical project management, and offensive security leadership. The common thread has been solving operational problems in technical environments.

I’m strongest when the work is complicated, ownership is unclear, and technical teams need a practical path from requirements to execution.

What I Do

Offensive Security Leadership

Pentest practice leadership, methodology, QA, technical escalation, capability development, staffing, and delivery standards.

Technical Project Management

Complex project delivery, scoping support, SOW alignment, scheduling, stakeholder communication, risk management, and closeout.

Cybersecurity Delivery

Security consulting operations across pentesting, reporting, remediation validation, client readouts, and delivery process improvement.

IT Operations

Infrastructure, systems administration, security controls, vulnerability management, migrations, support, and IT leadership.

Experience

March 2025 – PresentRed Sentry

Head of Pentesting

Lead the penetration testing practice across delivery quality, methodology, QA, technical standards, team development, scoping support, resource planning, and client escalations.

Oversee day-to-day delivery across PMs, lead testers, pentesters, and contractors, including scheduling, capacity, project risk, and delivery readiness.
Support engagements from scoping and planning through testing, reporting, remediation validation, and closeout.
Partner with Sales, Product, and Operations to improve scoping, delivery tooling, workflows, and repeatable engagement processes.
Serve as an escalation point for complex findings, scope ambiguity, access issues, client concerns, and non-standard assessment requests.
Define and maintain testing methodologies, reporting standards, QA expectations, and rules of engagement across offensive security services.
Develop tester capability through skills assessment, training, mentoring, CTFs, and targeted learning plans.

July 2024 – October 2024Trail of Bits

Project Manager II

Managed cybersecurity consulting delivery across client communication, technical teams, timelines, reporting, and engagement closeout.

Managed end-to-end delivery of penetration testing and vulnerability assessment engagements against client requirements, SOWs, timelines, and deliverables.
Served as the primary client point of contact for project status, technical findings, recommendations, and next steps.
Coordinated security consultants and cross-functional stakeholders to keep engagements moving.
Supported technical and executive reporting, translating complex findings into clear, actionable information.
Improved project workflows and delivery processes to increase consistency and reduce friction.

February 2022 – May 2024Include Security LLC

Technical Project Manager

Led delivery of cybersecurity consulting engagements and coordinated distributed technical teams across the full client lifecycle.

Managed end-to-end delivery of penetration testing and security assessment engagements from kickoff through reporting and closeout.
Led kickoff meetings, status updates, readouts, and technical discussions as the primary client contact.
Coordinated distributed security consultants across multiple time zones, managing schedules, dependencies, blockers, and timelines.
Translated client requirements into clear project plans, priorities, and deliverables.
Supported report delivery and client readouts, connecting technical findings to practical remediation guidance.
Improved delivery workflows and processes to reduce friction and improve consistency.

March 2020 – February 2022Legence Bank

Cybersecurity Administrator

Managed security operations and controls across enterprise infrastructure in a banking environment.

Managed and secured enterprise IT infrastructure across endpoints, servers, networking, and security systems.
Led vulnerability management, security monitoring, patching, and remediation efforts.
Administered and improved controls including firewalls, endpoint protection, and access controls.
Developed and maintained IT security policies and procedures.
Delivered security awareness training and partnered with business stakeholders on security initiatives.

August 2018 – March 2020Rides Mass Transit District

Information Technology Manager

Led IT operations, infrastructure, security, projects, and staff in a public-sector environment.

Managed day-to-day IT operations across infrastructure, systems, networking, security, and end-user technology.
Led IT projects including MFA deployment, server migrations, system upgrades, and infrastructure improvements.
Supervised IT staff, assigned priorities, and supported operational coverage and development.
Managed monitoring, patching, backups, access controls, and security reviews.
Evaluated technology needs, vendors, and upgrade options against cost, reliability, security, and business requirements.

Earlier experience

Information Technology ManagerWalker’s Bluff Casino Resort

November 2017 – August 2018

System AdministratorLegence Bank

August 2014 – November 2017

Information Technology Support TechnicianSoutheastern Illinois College

December 2013 – August 2014

IT SupportFerrell Hospital

August 2013 – December 2013

AuditorMediacom Communications

June 2011 – February 2013

Cannon Crew Member, 13BU.S. Army Reserve

May 1997 – April 2004

Selected Work

Examples of the kind of problems I work on.

These examples are anonymized and focused on the operating problems, decisions, and outcomes rather than client-specific details.

Case study

Pentest Delivery Operating Model

Challenge
Engagement ownership, readiness, scheduling, and delivery expectations were inconsistent across Sales, PM, and testing.

Work
Defined clearer handoffs, delivery stages, access-readiness expectations, scheduling controls, QA ownership, and remediation workflows.

Impact
Created a more repeatable delivery model with clearer accountability and fewer mid-engagement surprises.

Case study

Capacity & Staffing

Challenge
Project count alone did not reflect actual tester workload, QA rotations, skill requirements, or contractor dependency.

Work
Built practical capacity planning around tester capability, QA rotations, project weight, contractor usage, and delivery windows.

Impact
Improved staffing visibility and made it easier to identify when internal capacity was exhausted before delivery quality suffered.

Case study

QA & Team Development

Challenge
Reporting consistency and technical capability varied across testers and assessment types.

Work
Strengthened QA expectations, severity consistency, technical review, skills tracking, mentorship, and training tied to real delivery needs.

Impact
Created clearer quality expectations while using recurring delivery issues to drive targeted team development.

Case study

Scoping & Delivery Alignment

Challenge
Technical scope, effort, staffing, and client timelines were not always aligned before delivery commitments were made.

Work
Connected scoping inputs to effort models, delivery assumptions, resource feasibility, and clearer SOW expectations.

Impact
Improved the handoff between Sales, scoping, PM, and testing while reducing avoidable scope and scheduling friction.

View program & delivery work samples

Writing

Security thinking beyond the resume.

I write about offensive security, technical delivery, identity, attack paths, AI security, and the operating decisions behind reliable security work.

AI Security

What AI & LLM Penetration Testing Actually Looks Like

What changes when the target includes prompts, models, retrieval, tools, agents, and the application wrapped around them.

Read article Offensive Security

What Red Teaming Actually Looks Like

Why adversary simulation is different from simply making a penetration test larger or broader.

Read article Security Delivery

Project Count Is Not Capacity

Why workload planning breaks when every technical engagement is treated as equal.

Read article

View all writing

Beyond the Day Job

I also write cyber thrillers and short fiction.

As Michael Shelton, I write The Echo Phantom Chronicles, fiction that explores technology, digital identity, justice, and the human consequences behind the screen.

The author site is intentionally separate from this professional portfolio, but the same cybersecurity background informs both.

Visit my author site

The Silent Sentinel

How I Lead

Clear expectations, practical support, and room to own the work.

My job as a leader is to make the environment around technical people clearer, more sustainable, and easier to execute in.

Give people context

Teams make better decisions when they understand the outcome, constraints, and why the work matters, not just the task in front of them.

Protect focus and sustainability

I try to reduce avoidable churn, make workload visible, and keep urgent work from becoming the default way the team operates.

Coach through real work

I prefer practical development tied to current delivery needs, technical review, mentorship, targeted training, and increasing ownership over time.

Address problems directly

I value calm, specific feedback and clear expectations. The goal is to fix the issue without creating unnecessary drama around it.

Operating Principles

The rules I come back to when delivery gets messy.

These are practical operating principles I use across security delivery, project management, team leadership, and cross-functional work.

Clear ownership beats hidden work

Ambiguity creates rework and burnout. I prefer clear owners, decision points, handoffs, and escalation paths before work becomes urgent.

Quality should be a system

Good outcomes should not depend on heroics. Methodology, QA, reporting, and delivery controls should make quality repeatable.

Capacity is more than project count

Workload has to account for complexity, skill fit, QA duties, dependencies, client readiness, and the actual effort required to deliver well.

Temporary fixes need an end state

Short-term coverage is sometimes necessary, but temporary workarounds should not quietly become the operating model.

Escalate with options

When something is at risk, I try to surface it early with the tradeoffs, consequences, and a practical decision to make.

Technical reality has to survive the handoff

Sales, PM, delivery, Product, and leadership need a shared understanding of scope, risk, assumptions, and what success actually requires.

Recommendations

What people I’ve worked with say.

Selected recommendations from people who have managed or worked alongside me across cybersecurity delivery and IT operations.

“As a Technical Project Manager, Mike led numerous security assessments for one of IncludeSec’s largest clients. He effectively addressed their particular needs and swiftly adapted to regular client-driven changes in process. He’s passionate about cyber security and I’d recommend him to anyone looking for a project manager in the cyber security space.”

Mike OstrowskiFormer Manager • Include Security LLC

“I really appreciated how he did such a great job managing the project, communicating with stake holders, and kept on top of issues till they were resolved. Not only is he technically great but he is also a great person.”

Abraham Kang, Esq.Former Colleague • Include Security LLC

“Michael’s strong technical knowledge, coupled with a proactive attitude and dedication to excellence, raised our operational capacity to an entirely new level and gave us that extra sharp edge.”

Cheryl WheelerFormer Colleague • Legence Bank

View more on LinkedIn

Background

Built from operations up.

Before moving fully into cybersecurity consulting, I spent years in infrastructure, systems administration, IT management, banking technology, healthcare IT, and public-sector environments.

EducationA.S. Information Technology SecuritySoutheastern Illinois College

EducationA.S. Information TechnologySoutheastern Illinois College

MilitaryU.S. Army ReserveCannon Crew Member, 13B • 1997–2004

ProfessionalInfraGardMember

Where I Fit

Technical credibility with delivery and operational leadership.

My background fits roles where technical security, project delivery, and operational leadership overlap. I’m especially interested in offensive security leadership, technical project management, cybersecurity delivery, security consulting operations, and IT leadership.

Contact

Want to talk about a role, project, or security delivery challenge?

Send me a note here. The form delivers the message privately without publishing my email address in the page source.

Resume PDF LinkedIn GitHub