McDermott Will & Schulte, a global law firm

Brian also drafts, reviews, and updates cybersecurity agreements and general technology contracts and supports clients in sophisticated information technology and business process outsourcing transactions. He regularly helps clients navigate complex private equity transactions, drawing on his experience with technology, security, AI, and intellectual property matters.

While in law school, Brian served as lead articles editor of the SMU Law Review.

Prior to attending law school, Brian spent more than 20 years working as a consultant, focusing on cybersecurity, information security, and IT risk management for US and global companies, primarily in regulated industries. He brings extensive knowledge of hacking mechanisms and security controls, IT operations, and information security standards for the financial services, healthcare, and energy industries, among others. He also contributed cybersecurity, privacy, and export controls updates to Outsourcing: Law and Business.

See Less

• Investigated and interviewed multiple employees in a complex matter involving theft of documents from employees’ workstations during the employment separations of a business team, including supporting the resulting litigation through legal and technical analysis of the former employees’ actions
• Reviewed and developed AI policies and standards for multiple organizations based on AI frameworks such as the NIST AI Risk Management Framework (AI RMF) and ISO/IEC 42001
• Managed multiple annual cybersecurity maturity and risk assessments for a financial technology company (based on the NIST Cybersecurity Framework and ISO/IEC 27001) under attorney-client privilege and provided legal analysis and counseling on responding to assessment results
• Managed annual IT audits for compliance with India’s Information Technology Rules (which incorporate ISO/IEC 27001) for an audit and advisory firm with India-based operations and provided legal support for annual System and Organization Controls (SOC) 2 and ISO/IEC 27001 audits
• Advised multiple merchants and service providers on Payment Card Industry Data Security Standard (PCI DSS) compliance, including counseling a Level 1 merchant in preparation for its Qualified Security Assessor (QSA)-led Report on Compliance (ROC) and advising on the transition to PCI DSS v4.0 requirements
• Drafted a suite of agreements for a startup service provider, including master services agreements, subcontractor agreements, nondisclosure agreements (NDAs), security addenda, privacy policies, and other legal documents needed to serve commercial and government clients

See Less