Founder
Sets the firm’s direction and answers personally for the standard of every engagement.
Leadership
Led by people who have done the work.
MarkTillson is led by its Founder, Lola Osoba, CISA, CISM, and a senior team that has delivered technology, compliance and security programs since 2016.
Founder
Lola OsobaCISA, CISM
Lola Osoba founded MarkTillson in Dallas in 2016 to close a gap that costs organizations dearly: the distance between the people who build technology and the people who have to prove it is secure.
A Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM), Lola brings two disciplines to every engagement. The auditor’s discipline asks whether a control truly works, and whether the evidence would convince a skeptic. The security manager’s discipline asks whether the program is governed, funded and owned, so it keeps working after the consultants leave.
That combination shapes how MarkTillson operates. Engineers design with the audit in mind. Compliance work is grounded in how systems actually run. Findings are ranked by business consequence, and every report is written for the executive who has to sign off on it.
Clients reach Lola directly. Every engagement has a line to the Office of the Founder, and any concern about scope, quality or people is heard the same day.
How Lola runs the firm.
Four principles that every MarkTillson engagement inherits from its founder.
01Audit the design before you build it
An auditor’s eye at the whiteboard saves a year of rework. Every architecture we propose is tested against the questions an assessor will ask.
02Govern what you measure
Security management is a business discipline. Risks are owned, priced and reported in language a board can act on.
03Evidence is the deliverable
A control that cannot be shown working is a control that does not exist. We leave clients with proof, not promises.
04Seniority is not negotiable
The person who scopes your engagement is the person who delivers it.
Our leadership model
In many firms, partners sell and juniors deliver. Here, the senior practitioner who scopes your engagement delivers it.
Who is accountable for what.
Every part of the firm has a named owner, and every engagement has a senior lead.
Financial Services Security & Compliance Lead
Owns PCI DSS, SWIFT CSCF and DORA methodology and delivery.
AI Governance, Cloud & Digital Trust Lead
Owns AI governance, attestation readiness and cloud security engineering.
Offensive Security & Enterprise Resilience Lead
Owns penetration testing, red teaming and resilience work.
Head of Quality
Reviews every deliverable before it leaves the firm, outside the delivery team.
Engagement Leads
Senior practitioners who scope, lead and sign off each engagement.
Every proposal names your engagement team, with the experience and certifications of each practitioner.
What you can expect from our people.
01A named lead from day one
Any change to key people is agreed with you first.
02Senior presence in fieldwork
Scoping and difficult findings are never delegated.
03Independent quality review
Every deliverable is reviewed outside the delivery team.
04A direct line to the founder
If something goes wrong, you reach the person who can fix it.
The expertise around the table.
Our expertise & credentials- IT audit & internal control
- Information security management
- Payment card security
- Financial-sector operational resilience
- Federal and defense compliance
- AI governance & model risk
- Cloud security engineering
- IT services & infrastructure
- Penetration testing & red teaming
- Privacy & data protection
- Incident response & recovery
Speak with an expert
Speak with a senior practitioner.
Your first conversation is with someone who leads engagements, not a business development team.