John J. Irvine, AIGP

Case Briefing

For the investigator's eyes

Case

97-JJI

Subject

John J. Irvine, AIGP

Assigned to

You

It started in January 1995 at Highland Technologies, where a young software product manager designed and led development of HighView ST, a document imaging and workflow platform.

Then, in August 1997, he walked into FBI Headquarters as a computer forensic examiner, and a career in digital forensics began. The FBI, the DEA, and the CIA followed. Three decades later he's working both threads at once: investigating, and building the tools that do the looking.

Where to start

• Subject Profile: who he is and what he says about himself.
• Employers: every place he's worked, 1995 to today.
• The OPM File: the one everybody asks about.
• AI Projects: what he's building now.
• Teaching and Education: where he learned it and where he passes it on.
• Case Chronology: the whole story on one page.
• Blog: what he's written down, in his own words.
• #slopcore: the after-hours work. Music, with video.

Subject Statement

In his own words, taken down as given

Name

John J. Irvine, AIGP

Headline

Product Management Executive | Insider Risk & Cybersecurity Platforms | AI Governance

Current

Director of Product, Insider Risk Portfolio, Everfox

I've spent the better part of three decades doing two jobs. One is finding out what happened on a computer, and who did it. The other is building the software that lets other people find out.

The first job started at FBI Headquarters in 1997 and ran through federal law enforcement, the Intelligence Community and the commercial world. I was an examiner first, and later the one leading the examiners. The second job started two years before that and never really stopped: I've built enterprise security platforms, scaled them, and taken them to market.

Insider risk is where the two turn out to be the same job. The evidence is on the machine, but the case is always about a person. At Everfox I lead product for the Insider Risk Portfolio: tools that help an organization detect it, investigate it, and respond to it.

These days the tools do some of the thinking. A machine can surface a risk, but somebody has to answer for what's done about it. So the work now includes oversight, expert validation, governance, and decisions that can be defended afterward. Human judgment stays at the center. That's the part I intend to get right.

The statement as filed

From his LinkedIn profile:

I lead product for Everfox’s Insider Risk Portfolio, bringing together two threads of my career: conducting and leading digital forensic investigations, and building enterprise software products. Insider risk is where those disciplines converge—understanding human behavior while creating tools that help organizations detect, investigate, and respond to it.

Across a 25+ year career in federal law enforcement, the Intelligence Community, and the commercial sector, I’ve worked as a digital forensic examiner, led technical and investigative teams, and built, scaled, and commercialized enterprise software and cybersecurity platforms. That combination gives me both a practitioner’s understanding of complex investigations and an executive product perspective spanning strategy, roadmaps, go-to-market execution, M&A positioning, and organizational leadership. Today, my work also encompasses AI-enabled cybersecurity products that require human oversight, expert validation, governance, risk controls, and defensible decision workflows.

The next generation of security products must do more than surface risk; they must help organizations act on it responsibly. I intend to shape that future by combining investigative rigor, product leadership, and AI governance—keeping human judgment and accountability at the center.

Achievements

Career highlights on record

• Led product strategy and execution contributing to three corporate acquisitions across commercial software markets, most recently CyFIR LLC’s acquisition by eSentire in 2021.
• Spearheaded the development of CyFIR Enterprise, the cybersecurity platform used to identify the OPM breach affecting 21.5 million U.S. government personnel records during a live sales demonstration.
• Earned the AIGP credential as part of its inaugural cohort and now work where cybersecurity product development, AI governance, and enterprise risk controls intersect.
• Held P&L responsibility for a $7.5M government-focused cybersecurity division supporting the FBI, leading 40+ forensic examiners, software developers, and reverse engineers while maintaining employee turnover below 5% against a market average of 34%.
• Increased eSentire Agent product adoption by 1,569% by integrating acquired CyFIR technology into new product and service lines.

Known Skills

Capabilities observed in the field

Product

• Product strategy, roadmaps, and lifecycle management
• Voice of Customer, customer discovery, and requirements definition
• Go-to-market strategy, positioning, product marketing, and sales enablement
• M&A and acquisition strategy, IP development, and P&L management

Security

• Digital forensics and incident response (DFIR)
• Insider threat
• MDR / XDR and enterprise cybersecurity platforms

Governance

• AI governance, expert validation, and risk controls
• Federal, Intelligence Community, and commercial markets

Affiliations

• FBI InfraGard
• International Association of Privacy Professionals (IAPP)

Everfox

Insider Risk Portfolio

Role

Director of Product, Insider Risk Portfolio

Period

Jun 2026 to present

Location

Herndon, Virginia (hybrid)

Directs product strategy, roadmap, and execution for Everfox's Insider Risk Portfolio, leading an outstanding team of Product professionals.

The role unites two career-long threads, digital forensic investigations and enterprise product management, in a domain where understanding how insiders behave is inseparable from building the tools that detect and respond to them.

eSentire, Inc.

Acquired CyFIR LLC

Role

Vice President, Digital Forensics Products

Period

Jul 2021 to Apr 2026

Retained after the acquisition as eSentire's senior forensics and CyFIR product authority, aligning customers, engineering, product, sales, marketing, account management, support, and training around roadmap, enablement, adoption, and go-to-market outcomes.

Findings

• Directed technical integration of the CyFIR Enterprise platform into eSentire's MDR products and services, expanding digital forensics and incident response capabilities and increasing product adoption by 1,569%.
• Collaborated with product and engineering teams to develop and launch new products and services, contributing domain expertise through strategy, roadmap planning, requirements, development, launch, enablement, and lifecycle management.
• Developed an AI-assisted product management workflow using Claude to standardize ideation, competitive research, requirements generation, and go-to-market documentation for product managers.
• Owned Voice of Customer, customer discovery, and feedback loops for major eSentire Agent customers, turning their needs, adoption blockers, and support trends into requirements and roadmap inputs.
• Served as internal and external forensics evangelist, speaking at industry events and supporting sales engagements.
• Designed and launched eSentire's first Digital Forensics Laboratory and served as its Laboratory Director.

Dell Technologies, Inc.

Role

Global Digital Forensics & Incident Response Strategist

Period

Sep 2020 to Jul 2021

Assessed and modernized forensic investigation tools and procedures across Dell's global digital forensics department, closing capability gaps opened by the rapid shift to remote and hybrid work.

Served as the primary internal point of contact for ANAB ISO accreditation of the practice, working with outside consultants toward one of the world's most demanding accreditation standards.

CyFIR LLC / CyTech Services

The startup years

Role

Chief Product Officer / Chief Technology Officer

Period

Nov 2012 to Jul 2021

Acquired an early-stage forensics technology platform and led its full product redefinition as the company's sole product, engineering, and product marketing executive.

Findings

• Directed development of CyFIR Enterprise into a highly scalable, enterprise-grade remote digital forensics and incident response platform.
• Built the product and engineering team from the ground up, moving from a hybrid CTO/CPO role to pure Chief Product Officer as the company matured.
• Led through the spin-off of CyFIR LLC as a separate entity from CyTech Services.
• Positioned CyFIR Enterprise as an acquisition target through focused IP development and differentiation. eSentire acquired it in 2021, and his employment was written into the acquisition agreement as a key personnel requirement.

See also

The OPM File, on the desktop.

Integrity Applications Inc.

Role

Principal Investigator, Digital Forensics

Period

Sep 2011 to Nov 2012

Established IAI's first digital forensics practice and commercial services laboratory.

Harris Corporation / Crucial Security

On site at the Federal Bureau of Investigation

Role

Advanced Programs Manager, Digital Forensics / Director of Technical Analysis

Period

Apr 2006 to Sep 2011

Findings

• Led 40+ digital forensic examiners, forensic application developers, and malware reverse engineers supporting the FBI's Investigative Analysis Unit.
• Held P&L ownership of $7.5M in annual services revenue while managing R&D of new hardware and software product lines.
• Forensically investigated counterterrorism, child exploitation, cyber intrusion, and other criminal matters while running department operations.
• Built forensic subject profiles covering technical capability, networks, contacts, employment, family, location, and behavioral indicators.

The Emerging Technologies Group

On site at the Central Intelligence Agency

Role

Site Manager / Sr. Computer Forensic Examiner

Period

Aug 2003 to Apr 2006

Led a team of media exploitation specialists in the CIA's Computer Operations Group's Analysis Branch, supporting counterterrorism and cyber profiling operations while carrying an active caseload.

CSC, Inc.

On site at the Drug Enforcement Administration

Role

Site Manager / Sr. Computer Forensic Scientist

Period

Jun 2002 to Aug 2003

Led a team of digital forensic scientists in the DEA's Digital Forensics Laboratory supporting national counternarcotics investigations while carrying an active caseload.

RM Vredenburg

Acquired Highland Technologies

Role

Manager, Information Services

Period

Nov 1998 to Jun 2002

Built and led the Information Services division supporting HighView, the enterprise document imaging and workflow platform he had designed at Highland Technologies. It was the first of three commercial software products he helped take to a successful acquisition.

Federal Bureau of Investigation

Computer Analysis and Response Team, Headquarters

Role

Computer Forensic Examiner

Period

Aug 1997 to Nov 1998

Where the forensic thread begins. Performed forensic examination of digital evidence in child exploitation, fraud, national security, and other criminal cases for the Headquarters element of the FBI's Computer Analysis and Response Team (CART).

Highland Technologies, Inc.

The first product job

Role

Software Product Manager

Period

Jan 1995 to Aug 1997

Designed and led development of HighView ST, a COTS enterprise document imaging and workflow management platform.

Before the forensics, there was product. He left for the FBI in 1997 and came back to HighView a year later at RM Vredenburg, which acquired Highland.

The OPM File

U.S. Office of Personnel Management

Platform

CyFIR Enterprise

Setting

A live sales demonstration

Scale

21.5 million

Every investigator has the one case people ask about. This is his.

From the résumé

Directed product strategy and development for CyFIR Enterprise—the remote forensics platform that, during a live sales demonstration at the U.S. Office of Personnel Management, surfaced the malicious code central to the most impactful data breach in U.S. Government history, affecting 21.5 million cleared employees.

From the LinkedIn profile

Spearheaded the development of CyFIR Enterprise, the cybersecurity platform used to identify the OPM breach affecting 21.5 million U.S. government personnel records during a live sales demonstration.

On the record

The House Committee on Oversight and Government Reform's 2016 report on the breach tells this part of the story, starting on page 135.

The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation (PDF, opens at page 135)

The Fourteen

A self-improving agent orchestration system, 2026

Tools

Claude Code and Codex

Designed and operates a personal 14-agent orchestration system in Claude Code and Codex, coordinating autonomous agents across research, drafting, analysis, and build tasks.

The system is self-improving: the more cases it works, the better it gets at the job.

A Native Mac App

Swift, 2026

App

Job Tracker

Tools

Claude Code and Codex

Available

Mac App Store

Built and shipped a native macOS application in Swift using Claude Code and Codex, working as an AI-paired non-engineer.

Next on the docket: another soon-to-be-released project, this one for podcasters.

Job Tracker on the Mac App Store

Cold Cases

Abandoned hardware returned to service, 2026

Platform

macOS 27

The label printer

Revived a label printer its manufacturer abandoned long ago. With every macOS release the hardware slipped further out of reach, until a new print and driver application, written for macOS 27, carried it into a second life.

The fax line

Built an electronic fax system for macOS that sends and receives old-fashioned faxes right from the Mac, for the offices that still won't take anything else.

The manufacturer closed the file. He didn't.

Three Witnesses

Parallel competitive product research, 2026

Engines

Claude Cowork, ChatGPT, Perplexity

Built a parallel competitive product research workflow that runs the same query across Claude Cowork, ChatGPT, and Perplexity, cross-checking the results to counter single-model blind spots.

Any investigator will tell you: never rely on a single witness.

Interactive Artifacts

Claude Artifacts, 2026

• An Artifact that interviews users and ranks AI platforms against weighted criteria.
• An Artifact that consolidates global economic and stress indicators into an interactive dashboard.

A Machine-Usable Conscience

AI self-governance, 2026

Externalized a personal ethical and stylistic specification through structured AI interviewing, producing a machine-usable rubric. Custom Claude skills use it to refuse out-of-character tasks and to generate work in a documented voice.

It extends 15 years of teaching law and ethics in digital forensics into working AI self-governance.

AI-Assisted Product Management

eSentire

Tools

Claude

Developed an AI-assisted product management workflow using Claude to standardize ideation, competitive research, requirements generation, and go-to-market documentation for product managers.

George Mason University

Masters of Digital Forensics program

Role

Adjunct Professor (part time, evenings)

Period

Aug 2011 to present

Created and launched an original 16-week graduate course, "Topics of Law and Ethics in Digital Forensics," building the curriculum from the ground up and teaching from 25+ years of operational experience across the FBI, CIA, DEA, and commercial enterprises.

Findings

• Teaches graduate-level digital forensics law, ethics, governance, expert validation, and investigative methodology to cybersecurity professionals.
• Holds a running average of 4.91 out of 5 from students for class and instruction quality, among the highest in the university.
• Serves on the degree program's Advisory Board, helping shape its academic direction and curriculum.

George Mason University

Academic record

School

George Mason University

• BS, Management, May 1993
• MS, Information Systems, Dec 2000
• Graduate Certificate, Software Systems Engineering, Dec 2000

Certified AI Governance Professional

AIGP, inaugural cohort

Issuer

International Association of Privacy Professionals (IAPP)

Since

Apr 2024

Applies AI ethics, governance, expert validation, risk controls, and regulatory readiness principles to enterprise cybersecurity product strategy.

Case Chronology

1993 to present

1. 1993 BS, Management, George Mason University
2. 1995 Software Product Manager, Highland Technologies
3. 1997 Computer Forensic Examiner, FBI CART Headquarters
4. 1998 Manager, Information Services, RM Vredenburg
5. 2000 MS, Information Systems, George Mason University
6. 2002 Site Manager, DEA Digital Forensics Laboratory (CSC)
7. 2003 Site Manager, CIA Computer Operations Group (ETG)
8. 2006 Director of Technical Analysis, FBI (Harris / Crucial Security)
9. 2011 Adjunct Professor, George Mason University
10. 2011 Principal Investigator, Integrity Applications Inc.
11. 2012 CPO / CTO, CyFIR and CyTech Services
12. 2020 Global DFIR Strategist, Dell Technologies
13. 2021 eSentire acquires CyFIR; VP, Digital Forensics Products
14. 2024 AIGP, inaugural cohort
15. 2026 Director of Product, Insider Risk Portfolio, Everfox