Some roads you don't travel alone.

Ophir Cyber is fractional CISO leadership focused on one thing: bringing your teams together and finding the path forward. It's built on trust earned by someone who's traveled this ground before and knows where the real challenges are.

Built through two decades at brands that couldn't afford to get this wrong.

Specialized Bicycle ComponentsFounding CISO → Deputy CIO
2019 – Present
Vail ResortsDirector, Information Security, Risk & Compliance
2014 – 2019
Connect for Health ColoradoFounding Privacy & Security Officer
2014
Ball Aerospace and TechnologiesEnterprise Security Analyst
2011 – 2014
IBMProgressive Security & Compliance Leadership
2001 – 2011

A guide, not a vendor.

Ophir Cyber is a fractional CISO practice founded on one idea: you shouldn't need Fortune 500 headcount to get Fortune 500-caliber security leadership.

Ryan S. Dunn, Founder of Ophir Cyber
Ryan S. Dunn
Founder, Ophir Cyber
CISSP · CISA · CRISC
CIPP/US · Associate C|CISO
Broomfield, CO
Security and IT leadership across Consumer goods · Resort & hospitality
Aerospace & defense · Health insurance
Founder

Ryan Dunn spent 20 years in cybersecurity leadership before deliberately stepping into a broader business technology role — Deputy CIO, leading Product & Supply Chain Technology, and Data & Analytics — specifically to close a gap he'd watched security leaders struggle with for over a decade.

He built Specialized Bicycle Components' first global, board-reportable security program from scratch, then led enterprise IT operations alongside it — cloud, infrastructure, service desk, and DevOps — through a 75% reduction in tech debt and a fully remote shift during COVID with zero disruption.

Earlier, as Director of Information Security, Risk & Compliance at Vail Resorts, he built enough executive credibility framing security as business risk that requests for InfoSec advisory support more than doubled. Before that: founding privacy and security officer for Colorado's state health insurance marketplace, and enterprise security analyst supporting spacecraft ground control systems at Ball Aerospace.

Off the clock, he's usually somewhere above treeline — which is exactly where the firm's name comes from.

Why "Ophir."

Ophir Pass sits above 11,000 feet in Colorado's San Juan Mountains, near Ouray and Telluride — a narrow, exposed shelf road cut into the mountainside in 1881 to reach the mining camps below. It's still one of the more demanding routes in the state: short, technical, and unforgiving of a wrong line.

It's also where I've spent a lot of the time that isn't devoted to security programs and board decks. The mountains are where I go to think clearly, and Ophir Pass in particular has become a kind of personal marker — a route worth respecting, not fearing, once you know it.

The name of the pass itself traces back further, to Ophir, the legendary biblical land of gold — the same reason gold-mining towns across the American West borrowed the name. That layered meaning is exactly the point: a route built to protect something valuable, that takes real experience to navigate well.

That's the job. No organization needs someone shouting about every exposed ledge on the mountain. It needs someone who's made the crossing, knows where the real drop-offs are, and can get the business through to the other side — without unnecessary detours, and without misjudging the line.

Three ideas Ophir Cyber is built on

Know the Terrain

Speak risk, not tickets

Security that can't be explained in terms of revenue, reputation, and operations doesn't get funded — and doesn't get followed. Every recommendation gets translated before it reaches your table.

Convoy, Not Solo Runs

Get the silos moving together

The hardest part of security is rarely technical — it's getting product, finance, engineering, and legal into the same convoy and moving in the same direction. That's the specific muscle this brings.

Plan for Something to Go Wrong and Be Prepared

Incident response, not improvisation

Something will eventually go wrong — the difference is whether there's a tested response plan waiting, or a scramble to build one mid-incident. That means a documented plan, clear roles, and a rehearsed process for containment, communication, and recovery before you ever need it.

One core engagement. A few specific ways it shows up.

Ophir Cyber's primary offering is fractional CISO leadership — a guide who's on the route with you, not a report that gets left at basecamp.

Core Offering

Fractional CISO Leadership

Ongoing, embedded executive security leadership — scaled to fit your budget and your stage, without the full-time executive price tag or the year it takes to hire one.

  • Direct ownership of security strategy, architecture, and roadmap
  • Board and executive risk reporting in business terms
  • Vendor, budget, and team oversight — as much or as little as you need
  • A single accountable owner, not a rotating cast of consultants
Assessment

Program Assessment & Roadmap

A clear-eyed read on where your security program actually stands, and a prioritized roadmap tied to business risk — not a 40-page checklist audit.

Board Reporting

Executive & Board Risk Reporting

Security metrics translated into the language your board and CFO already use: exposure, return, and tradeoffs — not CVE counts.

Compliance

Privacy & Compliance Alignment

PCI DSS, GDPR, CCPA, and framework alignment (NIST CSF, ISO) handled as a business function, coordinated with legal — not bolted on separately.

Emerging

AI Governance & Enablement

A practical governance framework that clears the path for AI adoption instead of blocking it — the same approach used to stand up an enterprise AI Governance Board from scratch and get teams building safely, faster.

Risk

Risk Assessments

A clear, prioritized view of where your actual exposure sits — technical, operational, and third-party — sized to business impact, not just severity scores.

Leadership

Team Turnarounds

Stepping into underperforming or misaligned security and technology teams to reset direction, rebuild trust, and get delivery back on track.

Performance

OKR & KPI Development

Turning security priorities into measurable goals your team can actually execute against — and your leadership can actually track.

Strategy

Strategy Development

A multi-year security and technology strategy tied to business objectives — not a framework checklist, but a plan your team can actually execute and your leadership can actually fund.

Twenty years of results, before Ophir Cyber existed.

Selected outcomes from two decades leading enterprise security and technology programs as a full-time executive — the same discipline now available on a fractional basis.

$9M+ Cyber risk exposure reduced through proactive vulnerability management and a bug bounty program 10x ROI
98% Faster threat detection — mean time to detect cut from 24+ hours to under 15 minutes 24×7 SecOps
100+ Countries covered by a board-reportable security program built from the ground up Global scale
13 yrs First cross-functional stakeholder alignment achieved in over a decade at a $1B+ organization Alignment
200+ Retail and F&B locations kept at PCI DSS Level 1 compliance with zero disqualifying findings Compliance

Results achieved in prior executive roles (CISO, Deputy CIO). Included as founder track record, not as Ophir Cyber client work.

Let's talk about what you're protecting.

A first conversation is free, and it's a fit check — for you and for us. If it's not the right match, you'll leave with a clearer picture of where your program stands either way.

Opens your email client with the details filled in — nothing is stored or sent anywhere else.