Looking for a job

Ryan Kurtenbach

@ryankurtenbach

Cybersecurity governance leader at KSDE who created Kansas’s first risk-based program and cut agency risk by 40%.

At the Kansas State Department of Education, I built KSDE’s first risk-based cybersecurity program aligned to NIST CSF 2.0. It reduced the agency’s risk footprint by 40% and improved incident response time by 80%.

I authored the Kansas K-12 Cybersecurity Guide and supported its adoption across 285 districts and 78 schools. A NIST CSF 2.0 audit helped increase cybersecurity maturity by 60% in one year and establish audit readiness.

Earlier, at State of Kansas,OITS, I developed cybersecurity programs for four state agencies and four state hospitals, closing 90% of high-risk findings within nine months. Across roles in government, healthcare, education, banking, and energy, I’ve worked on security governance, compliance, audits, and infrastructure.

Experience

Work history, roles, and key accomplishments

Director, Information Technology

Kansas State Department of Education

Dec 2024 - Aug 2026 (1 year 8 months)

Modernized applications across all K–12 districts, strengthening cybersecurity governance and data integrity while increasing agency processing by 35% and district processing efficiency by 85%. Built KSDE's first risk-based cybersecurity program aligned to NIST CSF 2.0, reducing the agency's risk footprint by 40% and improving incident response time by 80%.

NIST CSF Cybersecurity Governance Risk Management Compliance Audit Readiness Policy Development AI driven workflows GRC Executive Reporting FISMA Budget Management Leadership

Information Security Officer

State of Kansas, OITS

May 2022 - Dec 2024 (2 years 7 months)

Developed complete cybersecurity programs for 4 state agencies and 4 state hospitals with NIST 800-53 rev.5 controls, governance, and artifacts; tracked high-risk findings through remediation, closing 90% within nine months and reducing repeat audit findings by 85%. Redesigned outdated cloud-migration security to FedRAMP standards for 4 applications across 9 states.

NIST 800 53 FedRAMP Cloud Security SDLC Secure Coding Contract Management Audit Coordination Compliance remediation

Information Security Analyst

Central National Bank

Dec 2021 - May 2022 (5 months)

Enhanced security for 500 users across 4 systems and 34 branches by implementing unified telemetry and improving incident response; lessened threat detection time to less than 15 minutes and response time to 20 minutes. Recognized privileged-access vulnerabilities; implemented MFA and least-privilege access controls across 100% of privileged accounts, mitigating 80% of risks identified in the risk

Telemetry Incident Response MFA Least Privilege XDR Endpoint Security Risk Assessment Compliance

Computer & Information Systems Manager

Newman Regional Health

Jul 2018 - Dec 2021 (3 years 5 months)

Executed a hardware and software refresh across 35 systems serving 1,500 users, eliminating obsolete infrastructure; lowered service desk tickets and after-hours calls, lowering operating costs by 35% through cut overtime payroll. Guided a data center upgrade and migrated the EHR from cloud to on-premise to address high hosting costs; lowered record load times from 30 to 45 seconds to less than 5

ITIL Service Desk Management EHR Migrations Data Center Upgrade Microsoft 365 Mobile Workforce Solutions Risk Based Cybersecurity Risk Analysis

Director of Network and Security Solutions

Emporia State University

Feb 2014 - Jul 2018 (4 years 5 months)

Directed a network redesign across 24 buildings serving 3,500 users; achieved 98% outdoor coverage, slashed dropped Wi-Fi connections by 80%, amplified network speed, pulled back costs by 25%, and improved reliability and scalability. Managed ISO 27001 ISMS, converting to NIST 800-53 as required by Kansas, conducted annual internal audits and post-incident reviews.

network design ISO 27001 NIST 800 53 Security Control Assessment Strategic Planning Budget Management Network as a Service

Information Security Analyst

Westar Energy (now Evergy)

Oct 2009 - Feb 2014 (4 years 4 months)

Enforced continuous monitoring, documentation, and validation of critical cyber asset controls across 5,000+ assets at 11 power plants, 2 wind farms, and 4 locations; reviewed and tested controls while maintaining 100% NERC-CIP compliance under strict NERC-CIP and SOX requirements. Discovered security gaps and installed enterprise architecture across 100+ systems, including access control, intrusi