Mark Bristow

With more than two decades of experience in cybersecurity, Bristow has played a key role in responding to major cyber incidents, including the Ukrainian power grid attack, the SolarWinds breach, the Colonial Pipeline ransomware attack, and Russian attempts to infiltrate the U.S. power grid. He is passionate about protecting cyber-physical systems because they are foundational to the daily lives of the people and communities they serve.

Before joining MITRE, Bristow served as branch chief for Cyber Defense Coordination at the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA), where he focused on national cyber defense. In that role, he applied his expertise in incident response, industrial control systems, network monitoring, and cyber defense to support national security and resilience initiatives while helping shape national policy. Previously, he served as director of the Hunt and Incident Response Team and the incident response chief for the Industrial Control Systems Cyber Emergency Response Team at CISA and its predecessor, the National Protection and Programs Directorate.

Bristow dedicates significant time to guiding and supporting emerging security professionals. He believes mentoring, collaboration, and continuous learning are essential to building a stronger, more resilient cybersecurity community. As a certified SANS instructor, he teaches ICS515: ICS Visibility, Detection, and Response, sharing his extensive real-world experience with students. He frequently speaks on industrial control systems security and has guest lectured at Georgetown University, George Mason University, and the U.S. Naval Academy.

Outside of work, Bristow is a Visual Flight Rules-certified pilot and enjoys scuba diving.