Kristin Butler

I bring 25+ years leading cybersecurity, privacy, and risk programs inside companies moving fast — building security functions from the ground up, then holding them together through PE ownership and serial acquisition. At Personify Health, I ran our first-ever umbrella audit (SOC 1, SOC 2, HITRUST r2, HIPAA, NIST AI RMF) across two acquisitions in under nine months with a clean result, and cut security spend over $230K the same year. At NextGen Healthcare, I built the security organization from inception, delivered nine consecutive clean SOC 2 Type II reports, and integrated five acquisitions without disrupting a single audit cycle. I%27ve also led breach response affecting over a million patients and directly managed HHS investigations — I know what regulators actually look for, not just what the framework says.

I%27m the strongest fit for boards and advisory roles at PE-backed or privately held companies navigating active M&A, particularly in healthcare and other regulated industries, where a due-diligence gap or a botched integration can kill deal value or trigger regulatory exposure. My value is turning security and compliance risk into a business conversation the rest of the board can act on — before it becomes a headline.