Devin Shirley Has a Black Belt in Security

Getting your Trinity Audio player ready...

An attacker wields a rubber pistol while a blindfolded student attempts to disarm the assailant. The drill is one of many that occur inside a nondescript martial arts studio in Little Rock. The popular self-defense center known as Krav Fit is where founder Devin Shirley has been training law enforcement officers, military members, and civilians in the principles of Krav Maga since 2004.

While Shirley is a third-degree black belt and a level six instructor, running Krav Fit is a side hustle. He spends most of his time as the chief information security officer for his company. In both roles, Shirley helps those around him identify and neutralize threats as quickly as possible.

A passion for service and defense runs in the family. Shirley and his brother became just the thirteenth set of twins to graduate from West Point in the military academy’s 222-year history. During his time along the Hudson, Shirley honed skills in boxing, wrestling, and hand-to-hand combat. After graduating, he became a commissioned signal officer in the US Army, where he was charged with operating and securing critical communications systems as a leader in the Signal Corps. He also began training in jujitsu and kickboxing.

After five years, Captain Shirley left the military and transferred his skills and training to the civilian world by taking an IT management position with a semiconductor company located in Dallas. Shirley had a lot to learn about corporate America but says his Army experience helped him thrive in fast-paced new environments.

“’Collaborate and survive’ was our motto at West Point, and that’s what I used to guide me in my first civilian job,” he explains. “I had a lot of experience working with outside entities while leading internal teams toward a common goal.”

Shirley worked overtime to complete numerous training activities to obtain knowledge and expertise in multiple domains. Personal reasons brought him back to his native Arkansas, where a job at Baptist Health led to two surprises during employee onboarding—Shirley found a niche in healthcare IT and met his future wife at the same time.

In 2016, Shirley joined Arkansas Blue Cross and Blue Shield (BCBS) and then stepped up to serve as the organization’s chief information security officer. “There is a clear theme in my life and career,” he says. “I’ve found that I love jobs and positions that involve providing protection and responding to threats.”

As CISO, Shirley has built a robust security team to protect the insurer against data breaches and keep its customers’ private information safe. Under his leadership, that team has grown into a complete program. Shirley also oversees the company’s physical security. Together, his teams implement the programs and policies that control system access, monitor risk, keep BCBS compliant with regulations, and identify and respond to threats.

“It’s not if, it’s when. Cybersecurity threats will eventually happen, so you better be prepared.”

Devin Shirley

It’s a high-stakes game. With events caused by ransomware attacks, things like denial of service and business email compromise are becoming more common. Recently, another company in the industry fell prey to a ransomware attack that exposed the social security numbers, diagnoses, and contact information of millions of Americans.

Shirley knows the risks, which is why he’s focused on resilience. “It’s not if, it’s when,” he says. “This will eventually happen, so you better be prepared.”

Shirley knows that continually looking for vulnerabilities and enhancing cybersecurity programs is required to put an organization in the best position to continue functioning when unexpected security events arise. Additionally, improving the security culture by increasing training to educate employees about how to spot phishing campaigns and taking measures to help prevent attacks is necessary.

Like he and his squad mates did in the Army, Shirley is keeping watch in his current role. In fact, there are many parallels between his experiences as a CISO, as a self-defense instructor, and as an Army officer. In each role, one must safeguard their domain against evolving threats. Doing so requires preparation, leadership, vigilance, intelligence, and agility. They monitor the outer perimeter, anticipate attacks, learn about potential foes, establish technical defenses, build strategies, run training exercises, and research new tools.

Unlike his counterparts on the battlefield, however, Shirley has adversaries that can strike from any place and at any time. They are often coordinated, anonymous, powerful, and instantaneous. His team stands ready to protect against hacks that could compromise sensitive data, disrupt critical operations, or undermine the public’s trust in an organization.

---

---

“WireX Systems is proud to work alongside chief security officers and their teams at leading healthcare providers, helping them mitigate risk and strengthen their security posture,” says Tomer Saban, co-founder and CEO at WireX Systems. “By providing real-time, actionable insights and enabling rapid detection and response to security threats, we ensure they can answer the critical question: who is accessing my data and how.”

---

---

---