I came to security through people, and stayed for the systems.
I’m Coco Bloom, founder of Entelechy Security. I help security and GRC leaders turn complex evidence into defensible decisions, and build the programs and tools to put them into practice.
Current role
Five years in cybersecurity and GRC, more than three specializing in third-party risk — spent inside real programs, reviewing evidence and rebuilding the workflows behind vendor decisions.
Founder & Principal Consultant, Entelechy Security
November 2024 – present · Remote
Clients across the United States, Canada, New Zealand, and Australia. I deliver engagements directly; the teams I work with are on the client side.
- Sole owner of a 600+ vendor risk portfolio supporting 3,000 users across more than 50 subsidiaries for a multinational healthcare technology organization.
- Rebuilt that organization’s vendor assessment intake-to-decision workflow, reducing cycle time from roughly six months to 2–7 days.
- Three-plus years on third-party risk end to end: intake, tiering, assessment, remediation tracking, and the risk register behind it.
Where the experience comes from
My experience spans managed service providers, the inner workings of GRC platforms, and international enterprises with dozens of subsidiaries and locations.
That range has shown me how security and governance processes work, where they break down, and what it takes to make them practical for the people who run them.
Why a psychology degree turns out to be useful in GRC
My first degree was in psychology, and it shows up in the practical parts of this work. Questioning a vendor’s engineer or a client’s finance lead is an interview, not an interrogation — the answer depends on how the question is framed.
It also shapes how I write awareness training and design processes. People follow a workflow when it fits how they already work; when it does not, they route around it and the control quietly stops existing.
In investigative work the same discipline applies to my own reasoning: what the evidence shows, not what I expect it to.
Platforms and tools I have worked with
Hands-on experience, not partnerships. Tooling follows the program; it does not define it.
- Lema.ai
- FreshService
- Power Automate
- Vanta
- Drata
- Anecdotes
- Cyera
- Ostendio
- Jira
- Confluence
- Monday.com
- HubSpot
- Power BI
If the background fits the problem, let’s talk about the problem.
A few sentences about the framework, the deadline, or the queue that is stuck is enough to start.