Jeff Ericson – MedRisk

At MedRisk, a managed care organization founded in 1994 and headquartered in Conshohocken, Pennsylvania, maintaining a safe and supportive environment begins with a focus on people, security and culture. For Jeff Ericson, chief information security officer and senior vice president of infrastructure, that responsibility extends far beyond firewalls and servers. It stretches into every corner of the organization, touching every employee, every device and every decision made under the company’s roof.

Jeff Ericson | MedRisk | CISO/SVP of Infrastructure

MedRisk was established to revolutionize physical rehabilitation for workers’ compensation patients and has grown over three decades into the leader in managed care, physical rehabilitation and medical bill review for the casualty claims industry. The company’s sustained growth has placed enormous demands on its technology infrastructure — demands that Ericson has spent nearly two decades helping to meet, guiding it through a variety of modernization efforts and three major acquisitions that collectively expanded the managed infrastructure to 10 times its previous size.

While some of those acquisitions brought a handful of technical personnel, the most recent added almost no infrastructure or security staff, placing even greater emphasis on shared accountability across the organization. Efficiency is key to meeting those challenges head-on, and Ericson has built a team and a culture designed to do exactly that.

The weight of vigilance

Ericson and his team oversee the entire computing environment, including desktops, servers, security, facilities and reception. He describes his role as both tactical and strategic — balancing frontline help desk responsibilities and real-time alert monitoring against long-range initiatives, security assessments and executive planning. Though his work does not directly generate revenue, he views it as something arguably more vital: revenue protection and enablement, the foundation on which the business operates, scales and thrives.

That mindset is tested constantly. On any given day, his team may field thousands of alerts. A recent stretch produced 3,600 in a single cycle. The volume alone illustrates the intensity of the modern threat landscape.

“I think the depth of security and the constant onslaught of things is the biggest challenge,” Ericson says. “The connectivity makes things a completely different game.”

He points to a striking example: a threat originating from Digital Ocean, a provider that accounts for roughly one-sixth of internet traffic. Blocking that source was a defensible choice, but it underscored a sobering reality — even decisive action still leaves the vast majority of the internet as a potential source of exposure.

“You can block one-sixth of the internet, but that leaves five-sixths of the internet out there,” he says. “You are constantly trying to stop stuff.”

Artificial intelligence adds another layer of complexity. While it brings certain efficiencies, Ericson is clear-eyed about its risks. AI helps defenders, but it also helps attackers identify vulnerabilities and probe systems in ways that were not previously possible. The threat environment does not stand still, and neither does his team.

The human firewall

Technology alone, Ericson believes, will never be sufficient. The most durable line of defense is cultural. By reinforcing that every employee is a member of the security team, he has built what amounts to a force multiplier — a distributed network of vigilance that extends the reach of his small core group across the entire organization.

“We have more than 3,500 people on our security team rather than just a small group of people,” Ericson says. “People will reach out to me via texts or emails, letting me know about something or of some vulnerability.”

That culture has been built deliberately through recognition programs, tabletop exercises and ongoing communication. MedRisk holds security star awards and conducts annual drills that involve subservice providers in realistic scenario planning. Ericson acknowledges that most security feedback tends to be corrective, which makes moments of positive recognition all the more valuable. One memorable campaign offered a range of apple-themed prizes — apple turnovers, apple cider and, for one lucky recipient, an iPad.

The humor is intentional. Ericson is known internally for sending multi-factor authentication codes at the most inconvenient moments. Rather than shy away from that reputation, he leans into it as a teaching opportunity.

“You have to remind people why we’re here,” he says. “Nobody dies because you have to enter a second code.”

Protecting what matters most

Efficiency runs through everything Ericson’s team does. A key infrastructure initiative involves consolidating data centers and replicating workloads, enabling operations to shift to a backup site within a defined recovery time objective should the primary location fail. The effort protects against costly outages and preserves the client’s confidence that underpins the company’s continued success.

His team also maintains millions of dollars in backup systems — investments he describes plainly as an insurance policy. Justifying those expenditures requires persistence and clear-eyed advocacy, particularly in an environment where security spending is often scrutinized alongside other priorities. Budget pressure remains one of his most consistent challenges, requiring him to advocate without overstating risk.

“We have made investments, but you probably can never do enough,” he says. “If it runs perfectly, nobody notices, which ends up being out of sight, out of mind. You have to make your own case.”

The road that led here

Ericson did not always envision a career in cybersecurity leadership. He grew up watching his father operate punch card machines on massive mainframes — an early and formative exposure to the possibilities of computing that planted a seed without defining a direction. His own professional path ran through database work. He describes himself as someone who fell in love with data, and who did not fully anticipate where that passion would lead.

He earned a degree in information technology and management from Widener University and joined MedRisk in May 2006. He assumed his current role as CISO and senior vice president of infrastructure in October 2024. He describes himself as unflappable and even-keeled by nature — an introvert, he says, though colleagues consistently see someone else entirely: a dynamic leader who communicates with clarity and conviction.

He has held this post through quiet periods and turbulent ones alike. The average CISO tenure at most organizations is roughly 18 months before a significant breach or a change of direction. Ericson has been at MedRisk for nearly two decades. He attributes that staying power to genuine passion for the work, for its pace and complexity, and for a team culture that rewards both competence and character in equal measure.

He plays golf and has traveled far and wide—a trip to Norway is on his bucket list. And when the alerts are finally quiet and the systems are humming without incident, he finds satisfaction in something most people never think to notice. In his world, a day when nothing goes wrong is not a forgettable day. It is the whole point — proof that the work is working, and reason enough to show up and do it all over again.