10 Merck security leaders
Craig Morea, AVP Cyber Security Engineering at Merck, is one of ten Merck security leaders listed here, alongside people who hold or have held IT risk management, product security and threat detection roles at the company. A reader can learn how security leaders work at Merck from people who have held the role.
Professionals to explore
Craig Morea
LinkedInExperience: AVP Cyber Security Engineering · Merck
AVP Cyber Security Engineering at Merck since December 2024, based in Newark, Delaware, with a background in internal security, technical sales and professional services. Craig Morea also held Cyber Security, Executive Director at Merck (2023–2024), Sr. Director of Engineering, Architecture, Cloud, and Product Security (2021–2023) and Director of Cyber Security Engineering & Threat and Vulnerability Management (2019–2021) at Splunk, and a security strategy, architecture and engineering director role at Symantec (2017–2019).
George Shatzer
LinkedInExperience: Director, Cybersecurity Strategic Initiatives · Merck
Director, Cybersecurity Strategic Initiatives at Merck since September 2023, based in Carlisle, Pennsylvania, working with stakeholders across IT and the company on disruptive technologies such as AI and quantum computing and assessing their cybersecurity and information risk implications. George Shatzer also served as an Officer in the US Army (1993–2023) and held Director, Strategic Research and Analysis at the Strategic Studies Institute and US Army War College Press (2018–2023).
Keith Respass
LinkedInExperience: Executive Director, IT Risk Management and Cybersecurity · Merck
Executive Director, IT Risk Management and Cybersecurity at Merck since November 2020, based in Bluffton, South Carolina. Keith Respass also held Director, Information Risk Management (2007–2020), Director, Network Architecture and Planning (2005–2007), Manager, Communications Infrastructure Project Management (1999–2005) and Sr Network Engineer (1992–1999) at Merck.
Kirti Chemburkar
LinkedInExperience: Director, Product Security Platform Engineering · Merck
Director, Product Security Platform Engineering at Merck since January 2026, based in Cary, North Carolina, with a profile describing work across pharmaceutical, biotech and financial services that spans product security, cloud security and enterprise risk. Kirti Chemburkar also held Associate Director of Application & Cloud Security at Merck (2022–2026), Senior Information Technology Manager, VP at TD (2020–2022) and Data Product Manager, VP at JPMorganChase (2015–2020).
Michael Donath
LinkedInExperience: Director, Attack Surface Reduction (ASR) · Merck
Director, Attack Surface Reduction (ASR) at Merck since May 2019, with a profile headline of Head of Strategic Plans / Cyber Fusion Center and work covering vulnerability management, penetration testing, advanced cyber resilience testing and breach and attack simulation.
Nathan Morrow
LinkedInExperience: Director - Cyber Threat Detection and Response · Merck
Director - Cyber Threat Detection and Response at Merck since March 2025, based in Newark, Delaware, and a Cyberspace Operations Officer with the United States Air Force since January 2025, with a profile citing firewalls, Linux system administration, red team operations and cloud risk analysis among its skills.
Robert Willis
LinkedInExperience: Executive Director, Core Cyber Security Engineering - Product Security · Merck
Executive Director, Core Cyber Security Engineering - Product Security at Merck since November 2024, based in Greater Philadelphia, focused on business needs for unified cloud and application security while reducing risk and improving resilience. Robert Willis also held Senior Director, Business Information Risk Officer - Merck Animal Health (2023–2024), Director, Business Information Risk Officer - Merck Human Health and Animal Health (2022–2023) and Director, IT Risk Management, Enterprise Resiliency and Sustainability Program Lead (2020–2022) at Merck.
Rocco DiPrinzio
LinkedInExperience: Director, Enterprise Identity and Access Management · Merck
Director, Enterprise Identity and Access Management at Merck since October 2023, based in Greater Philadelphia, with a profile describing enterprise IT experience in pharma designing IAM and productivity solutions that meet regulatory and security standards. Rocco DiPrinzio also held Associate Director - Enterprise Identity & Access Management (2017–2023) and Associate Director, Desktop & Application Services (2013–2016) at Merck.
Scott McClymont
LinkedInExperience: Sr. Director - Cybersecurity Rapid Innovation · Merck
Sr. Director - Cybersecurity Rapid Innovation at Merck since April 2026, based in the New York City area, with specialties in application security, API security, security architecture, cloud security and the secure software development lifecycle. Scott McClymont also held Sr. Director - Cybersecurity GRC (2025–2026), Associate Director - Security Architecture & Risk Management (2023–2025) and Senior Manager - Security Architecture (2020–2023) at Verizon.
Scott R. Nawrocki
LinkedInExperience: Director, Information Protection, Digital Forensics & Insider Risk · Merck
Director, Information Protection, Digital Forensics & Insider Risk at Merck since April 2023, based in the New York City area, directing information protection efforts within Merck IT Risk Management & Security. Scott R. Nawrocki also served as Cyber Fusion Center Lead (Interim) at Merck (2025–2026), and held Chief Security Officer and Managing Director, Head of Digital Investigations & Cyber Defense at Nardello & Co. (2020–2023) and a biotechnology threat focus role in cyber at the FBI (2019–2020).
Choose the right perspective
Pick the person whose security area is closest to your question, since security engineering, IT risk management, product and cloud security, identity, threat detection and insider risk roles call for different experience. Check the dates on each role so you know how recent the experience is.
Questions to take into the conversation
- 01How did you keep security engineering in step with cloud and application teams in your own role?
- 02What have you learned from your own work about protecting research data and intellectual property from insider and outside threats?
- 03How have you assessed the security risks of AI and other new technologies before they were adopted?
Reaching Merck security leaders
How can I contact one of these Merck security leaders?
Pick one of the 10 people on this page and choose "Book a paid call", or describe your project to find others. You offer a fee for a 15-minute call or a written answer, Instant Expert finds the person's work email and sends the invitation, and they decide whether to accept. The list covers 1 company: Merck, based on profile data retrieved on October 17, 2026. Being listed here doesn't mean someone has agreed to take calls.
How much does it cost to reach Merck security leaders?
You choose the offer, starting at $5 per person. The offer is what the person receives, and Instant Expert's fee is added on top, so a $100 offer costs you $125. The fee is 20% of what you pay. You're charged only when the person books the call or sends the answer.
What if they don't reply?
You pay nothing. Instant Expert sends follow-up reminders, and if the person hasn't booked or answered within 7 days, the request expires and any hold on your card is released. You can invite several of the 10 people on this list at once and cap your total spend, so you pay only for the ones who accept.
Can an AI agent ask one of these Merck security leaders a question?
Yes. An agent with a USDC wallet on Base can ask one question without an Instant Expert account. It names the person, for example by the LinkedIn URL on this page, and pays per ask over x402 (HTTP 402). The person answers in writing or by voice note, and if nobody answers within 7 days, the payment goes back to the wallet automatically. Claude and ChatGPT can do the same through the Instant Expert connector: setup is at /docs/mcp for Claude and /docs/chatgpt for ChatGPT. x402 docs
About this directory
This is a professional research starting point based on business profile data retrieved on . Titles and companies reflect that source snapshot; roles marked former had ended by then. Check the linked profiles for current details. Inclusion does not imply Instant Expert membership or availability.
Request a correction or removal