In line with Echelon Risk + Cyber's value of People with Personality, we are excited to continue our Cybersecurity Champion series, where we spotlight the incredible individuals who make up our team. Each month, we share the stories of professionals whose talent, dedication, and unique perspectives help keep organizations secure.
Meet Drew Foley, Cybersecurity Consultant at Echelon Risk + Cyber. A cybersecurity graduate of Thomas College, Drew began his career as an intern in 2024 and has taken on more responsibility at every step since. He works in vCISO advisory and defensive security, where his interest in advising clients and managing risk is part of the day-to-day. He was also recently honored with Echelon Risk + Cyber’s Teamwork First Award, which recognizes someone who is always willing to jump in and support others, no matter the team.
1. What initially drew you to cybersecurity, and how did your path lead you to Echelon Risk + Cyber?
When I was in high school, I developed a strong interest in computers. I enjoyed watching videos of people building computers, taking them apart, and explaining how all the components worked together. I also took a computer science class taught by one of my science teachers that introduced some cybersecurity concepts. I found the cybersecurity side especially interesting and started to see it as a potential career path. There was also an alumnus from my high school who attended Thomas College, where I eventually enrolled. He spoke highly of the cybersecurity program and how much he was enjoying it, which encouraged me to give it a try. I ended up really enjoying the field, and that's what set me on the path toward a career in cybersecurity.
In college, I took a couple of ethical hacking classes and some policy writing, and that was where I figured out this is really what I want to do. My professor would bring in people from government agencies and private firms to talk about what they were doing. It was really interesting, and it motivated me to get better. I’m also a career learner, someone who is always willing to dive into new topics, and that fits our industry. It’s very fast moving, and every week there’s something new. It challenges me to keep improving, and there’s always something else I can learn. It always makes me feel a little uncomfortable, which is where I want to be, because then I know I’m continuing to grow.
Everything in my background leading up to Echelon was motivating. It pushed me to learn, and it challenged me in a way I found interesting and wanted in my job.
2. You started as an intern and now have been promoted twice. What’s something you’ve learned along the way that you didn’t expect?
The first is the technical skills I picked up. I originally came in as more of a GRC and policy resource, and I got the opportunity to work with some very gifted and talented people. They let me shadow them and get hands-on experience with specific tools, and that really helped me grow my technical knowledge. When I came in as an intern, I felt behind the eight ball. Everyone had all this technical ability, and I came in with more of the paperwork side, understanding risk. I didn’t think I’d get to work on different systems and different engagements, but I did. That’s the unique thing about Echelon. We’re one team. Obviously we have our different sections of the business, but everyone is welcoming and wants you to grow, because they know in the long term it’s going to make their job easier. Without the support of my teammates exposing me to all of that, I probably wouldn’t have been promoted twice. Of course I needed to take the time to dive in and learn, but they were always available for questions and to show me the new things they were learning.
The second is the business side. I didn’t have a ton of experience with how consulting firms work, so I’ve been exposed to the inner workings of the company. I’ve been able to learn what the sales department is doing and how the vCISO arm of the business is run. Working with some of our risk advisory people has also shown me how they run their practice. Everyone was open to sharing what they were doing, and I wasn’t expecting such open arms. I’ve become kind of a jack of all trades who gets brought in whenever there’s something to help out with, and I’m grateful the team was open to that.
3. You recently received Echelon Risk + Cyber’s Teamwork First Award, which recognizes someone who is always willing to jump in and support others. What does teamwork mean to you, and why does it matter in this line of work?
I think the lesson comes from being on a sports team. I was a basketball player in high school and college, and if one person isn’t showing up, the whole team can crumble. I’ve always been a team player. I want to do whatever I can for the team to be successful. If that means learning a new skill or jumping in on a project, I may not have a ton of experience in, I’ll do it, if I can provide support and help the client and the team grow.
Being someone who isn’t difficult to work with and who the team can rely on is one of the things I focus on most. The promotions are good, but I want my reputation to be that I’m a team player who is always available to help with the best of my ability. That’s where I get motivation. If a coworker hears I’m working on something and thinks, “Oh, that’s getting taken care of,” that’s the type of team player I want to be. I don’t want them to worry that something isn’t getting done on time or that the client is unhappy. If that’s the one thing I can bring to the table, I’ll be happy.
4. What do you enjoy most about advising clients?
A lot of the time, clients come to us with a new challenge. Maybe it's a new security tool they want to implement, a policy they need to develop, or guidance on how to mature their security program. That's what I enjoy most about the role. I love helping clients solve problems, sharing best practices, and finding practical solutions that fit their environment. If it's something I'm not familiar with, I enjoy diving in, doing the research, and figuring out the right approach. Whether that means configuring a new tool, developing a roadmap, or helping align them with a new framework, every engagement brings something different, and I enjoy helping turn their vision into reality.
What makes that work even more rewarding are the relationships we build along the way. With vCISO and STaaS engagements, we're often working with the same clients for years rather than just a few weeks or months. Over time, you develop a deep understanding of their organization, their goals, and their challenges, and you become a true extension of their team.
I also enjoy getting to know the people behind the work. Every client brings different experiences and perspectives, and there's always something new to learn. Many organizations face similar challenges, so solutions that work well in one environment can often be adapted for another. At the same time, clients frequently introduce us to new ideas and approaches that we can bring to future engagements.
At the end of the day, my goal is to make sure clients are successful and that we're delivering on what we promise. They're trusting us to provide sound advice, industry best practices, and guidance that helps them make informed decisions. That's a responsibility I take seriously and a big part of what motivates me. Seeing the impact of our work and building those long-term partnerships is ultimately what I enjoy most about advising.
5. What’s one piece of advice you’d give to someone aspiring to get into cybersecurity today?
My biggest piece of advice is to embrace the chaos and commit to being a lifelong learner. Cybersecurity is constantly evolving, so you have to be willing to jump into the deep end, learn new technologies, and be the person who raises their hand when a new challenge comes up. The people who are most successful in this field are often the ones who stay curious and aren't afraid to step outside their comfort zone.
At the same time, it's important to find your niche. Cybersecurity is a broad field with countless paths you can take, whether that's offensive security, defensive security, governance and risk, policy development, or something else entirely. Early in my career, I received advice that has always stuck with me: it's okay to cast a wide net and explore different areas, but eventually you need to figure out what you're good at, what you enjoy, and what you want people to come to you for help with.
That's important because something is always changing. This year it's AI, and next year it could be quantum computing or another emerging technology. Priorities shift quickly, and if you're constantly learning new things without finding an area that genuinely interests you, it's easy to burn out. Having a specialty gives you a foundation while still allowing you to adapt and grow as the industry evolves.
Ultimately, embrace the constant change, stay curious, and take the time to discover where your strengths and interests align. Once you find that, it becomes much easier to navigate the many opportunities that cybersecurity has to offer and build a career that's both successful and rewarding.
6. What’s something you’ve really come to appreciate about being part of Echelon Risk + Cyber?
Honestly, it’s being on this team. Everyone is bought in and wants to make this company one of the best in the country, and they’re willing to support you. Even with all the work they’re doing, the company cares about you. It isn’t some giant corporation where you’re a number. I really think you’re a name here. They want you to produce and do well, and they want you to help, because then it takes some things off their plate.
People are willing to train you up and get you on new engagements, and they let you shadow things and show you what they’re doing. It makes it a lot easier to work here because everyone is on the same page. At the end of the day, they’re passionate about this company and about cybersecurity, and they’re really smart and capable. That motivates you to be up to that standard, and it comes from the top down. The CEO isn’t asking you to do anything he wouldn’t expect of himself.
7. Outside of work, how do you like spending your time? Any hobbies or interests that you’re passionate about?
Outside of work, I enjoy staying active. Whether it's going to the gym, getting outside for a walk or hike, or playing sports, I like keeping myself moving and maintaining a healthy lifestyle. I played basketball in college, and once that chapter ended, I needed something to fill that competitive outlet. I'm still very competitive, so you'll usually find me playing in men's league basketball and softball.
I also enjoy traveling. As a remote employee, I take advantage of the flexibility to work from different places when I can. I make frequent trips to New York City and Kansas, and I enjoy exploring new locations and experiences along the way.
Another passion of mine is reading, especially nonfiction. I've always been a bit of a history enthusiast, with a particular interest in World War II and the American Revolution. If I'm not reading a book on one of those topics, there's a good chance I'm watching a documentary about them. That interest started at a young age. Growing up, I would watch historical documentaries constantly, including a series about U.S. presidents that I replayed more times than I can count.
And honestly, I genuinely enjoy my work. Cybersecurity is a field that's always evolving, which keeps things interesting and challenging. Between work, staying active, traveling, and diving into history, I stay pretty busy and wouldn't have it any other way.
8. What does being a Cybersecurity Champion mean to you?
I’m really excited to receive this recognition because it shows how much I’ve grown. When I started as an intern, the imposter syndrome was real. You’re trying to figure out where you fit in and whether you’re doing a good job. Being recognized like this tells me that the path I’m on and the work I’ve put in have made an impact.
At the same time, it’s motivating. If I’ve been given the title of champion, I need to keep proving I deserve it. I can’t get comfortable with the recognition. I need to keep learning, improving, and pushing myself to be better.
I don’t feel like I’ve made it, and I’m not sure I ever will. There’s always another challenge to take on and another opportunity to grow. But I’m grateful that people are noticing the work I’m doing, and that’s all I can really ask for.
Want to build a career like Drew's? Discover more about Echelon's team, culture, and open positions.