Enterprise Cybersecurity Program
A multi-year enterprise cybersecurity program across a distributed retail and fuel estate of 800+ locations.
Security governance built for a distributed estate.
A multi-year enterprise cybersecurity program spanning approximately 800+ locations, led by Abdul Kunateh as Senior Project Manager III. The work combined governance and risk framework design with the field execution required to raise the security posture of a large, geographically distributed operating environment — point-of-sale systems, back-office systems and corporate-managed endpoints alike.
- Scope
- 800+ locations
- Duration
- Multi-year program
- Role
- Senior Project Manager III
- Focus
- Governance, risk, MFA, patching, endpoint hardening
Risk concentrated at the edge, not in the data center.
A distributed estate of this size changes the nature of security risk. The environment spanned point-of-sale systems, back-office systems and corporate-managed endpoints, and every location added endpoints, network paths, local practices and people to the organization's total exposure. Controls that are straightforward to enforce centrally become materially harder to apply consistently across hundreds of sites running on their own daily rhythms.
By the time the program took shape, the symptoms were specific rather than abstract. The multi-factor authentication rollout had stalled in the field. Patch cadence was drifting quarter to quarter. Hardening standards existed, but they were not being enforced consistently across the footprint.
Underneath those symptoms sat a governance gap rather than any single technical weakness. Without a shared framework defining ownership, standards, escalation and cadence, security work fragments: authentication practices vary, patching falls behind unevenly across the footprint, endpoint configurations drift from the intended baseline, and leadership loses a reliable view of where real risk is concentrated.
The program therefore had to address two problems at once — strengthening technical controls across point-of-sale, back-office and corporate-managed endpoints, and establishing the governance and risk structure that would keep those controls in place after any individual rollout finished.
Leading the program across security, infrastructure and operations.
As Senior Project Manager III, Abdul's responsibilities centered on leading the program end to end and holding it together across the functions it depended on:
Program leadership
Directing a multi-year cybersecurity program across an 800+ location footprint — point-of-sale, back-office and corporate-managed endpoints — from planning and sequencing through field execution.
Governance and risk structure
Establishing the framework that defined standards, ownership, risk visibility, escalation paths and reporting cadence, and maintaining the written risk register that scored and prioritized vulnerabilities by business impact.
Remediation service levels
Setting remediation SLAs against severity bands, so the response a finding received followed from how serious it was rather than from where or by whom it was raised.
Cross-functional coordination
Coordinating security, infrastructure and operations teams so technical requirements and field realities were reconciled rather than traded off — including the weekend cutover windows and regional variations that field work across hundreds of sites depends on.
Procurement partnership
Partnering with Procurement on the tooling and vendor decisions the program relied on, including the contract considerations that came with them.
Executive reporting
Translating technical risk into the terms leadership needed to make decisions on priorities, sequencing and investment.
Adoption and sustainment
Driving the operating discipline — cadence, accountability and follow-through — that kept controls in place after deployment.
Framework first, then disciplined execution across the estate.
The program advanced along four connected workstreams rather than as a sequence of isolated deployments.
Governance and risk framework
Defining the security standards, ownership model, escalation paths and reporting cadence — anchored by a written risk register that scored vulnerabilities on business impact, and remediation SLAs tied to severity bands. One consistent way to see and act on exposure across every location.
Multi-factor authentication rollout
Restarting the MFA rollout that had stalled in the field and carrying it across the estate, sequenced and supported around live operating hours so adoption held once the deployment teams moved on.
Patching discipline
Converting a patch cadence that had been drifting quarter to quarter into an operating routine, with the visibility and accountability required to keep hundreds of point-of-sale, back-office and corporate-managed endpoints current.
Endpoint hardening
Enforcing the hardening standards that already existed but were not being applied consistently, bringing endpoints to a defined baseline and reducing the configuration drift that erodes protection site by site.
Execution had to fit the operating environment. Cutovers were scheduled into weekend windows, regional variations were planned for rather than discovered mid-rollout, and Procurement was engaged early where tooling and contract considerations affected sequencing. The framework set the standard, and MFA, patching and hardening made that standard real in the field.
A measurably stronger security posture across the footprint.
40%
Cybersecurity Threat-Exposure Reduction
800+
Locations Supported
Multi-Year
Program Duration
Working alongside the security, infrastructure, operations and procurement teams, the program delivered an approximately 40% reduction in cybersecurity threat exposure across the estate. It was a collaborative organizational result, achieved not through a single control but through governance, authentication, patching and endpoint discipline applied consistently across 800+ locations over a multi-year horizon.
Sustaining that result over a multi-year horizon mattered as much as reaching it. Because the work established a governance framework and an operating cadence alongside the technical rollouts, the improved posture became part of how the organization ran rather than a temporary gain tied to one initiative.
About These Case Studies
The initiatives featured represent selected examples from Abdul Kunateh's professional career. Certain organization details, technologies, and operational information may be generalized to protect confidential and proprietary information. Results reflect collaborative organizational efforts; case studies demonstrate Abdul's leadership responsibilities, contributions, and strategic thinking within these initiatives.
Complex Problems Require More Than Good Ideas.
They require leadership, clarity, disciplined execution, and systems capable of turning strategy into measurable results. Whether leading transformation from inside an organization or advising leaders through Kunateh Impact, the work centers on one question: how do we build organizations capable of consistently turning potential into performance?