Manuel Cruz

About

Good IT starts with knowing how the business runs. I've worked in Finance and HR as well as IT, so I understand what the people using our systems need.

I lead IT at Pankl Aerospace Systems, a precision aerospace manufacturer in Cerritos, California, and I'm the company's ITAR Empowered Official. I started in desktop, network, and store support, and I still handle the hard problems myself. Along the way I've also run Finance and HR.

15+ YRS

Aerospace and manufacturing

2020

Started our NIST 800-171 program, which became CMMC 2.0. Level 2 self-assessment about three years later.

100%

Of Microsoft 365 moved to GCC High in 2023: email, OneDrive, Teams, SharePoint

9MO

To move the management system off an outdated on-premises platform

Selected work

Projects I led, start to finish.

Each one involved outside partners: an MSP, a security firm, specialists, equipment vendors, or our headquarters in Austria. I owned the plan and saw each one through.

Security & compliance

NIST 800-171 · CMMC 2.0 Level 2 · Since 2020

Taking the plant to CMMC 2.0 Level 2

I started our NIST 800-171 program around 2020, when the plant had a flat network and no security framework. Working with a security partner and our MSP, it took about three years to reach a Level 2 self-assessment, and I've run the program ever since.

Ran weekly working sessions with the security partner and the MSP.
Came in on weekends to test hardening changes without disrupting production.
Rolled out network segmentation, 802.1X port authentication, and access control lists.
Coordinated physical security: cameras and site access control.
Wrote the policies the framework requires, revise them every year, and keep the SSP and POA&M current with the MSP.

Result

Level 2 self-assessment complete and maintained, with access reviews, training, documentation, and audit evidence kept current. When a prime contractor asks about our cybersecurity posture, we answer with documented evidence.

Machined aerospace part with a caliper and micrometer on engineering drawings

Document control

On-premises → Government cloud

Moving the documents the plant runs on

Our management system holds what production and quality work from: procedures, work instructions, forms, machine setups, the skills and competency matrix, handbooks, and company goals. AS9100 and ISO 14001 auditors review it, along with our internal auditors, and it was running on an outdated on-premises server.

Learned how our headquarters in Austria had built theirs and turned that into a specification for our site.
Worked with a SharePoint specialist to build it: approval workflows, email reminders, and a log of every change.
Tied document metadata to the SharePoint list, so a title changed in the document header updates the list, and the other way around.
Tested every workflow path: starting a review, approving, rejecting, and recording why something was rejected.
Formed a task force to load the documents, documented the process, announced the change, and rolled it out.

Result

The system now runs in our government cloud tenant with approvals and change history built in. Nine months, start to finish.

Aisle of a cloud data center with blue-lit server racks

Microsoft 365

Commercial tenant → GCC High · 2023

Moving the whole company to Microsoft's government cloud

I needed a home for our ITAR data and CUI (controlled unclassified information) that met the requirements, and our commercial Microsoft 365 tenant wasn't it. I moved us to GCC High in 2023, before the final CMMC rule took effect in December 2024.

Made the call to move and worked through the licensing.
Planned the cutover with our MSP: email, OneDrive, Teams, and SharePoint. Nothing stayed on the commercial tenant.
Handled communication with users before, during, and after.
Early on, joining Teams meetings between commercial and government tenants was unreliable, so I trained people on the browser workaround until Microsoft fixed it.
When our Cox contract ended, moved our phones to CallTower, one of the few providers that support Teams calling in GCC High.

Result

A compliant home for ITAR data and CUI, with stronger security across email, files, and collaboration. It also gives our prime contractors confidence in how we handle their data, which strengthens our position for new work.

Network cables routed across a brushed steel machine panel

Shop floor

OPC UA · Machine monitoring

Seeing what every machine is doing

OPC UA is a standard protocol that many modern CNC machines use to share data with software. Connected to monitoring software, a machine reports whether it's running, stalled, or in alarm. The software sends alerts so someone can respond right away, and it tracks utilization and efficiency over time. Older machines that don't support OPC UA can join through add-on hardware that reads their signals.

Handled the network side of connecting machines to the monitoring software.
Worked with machine builders and the software vendor to get connections working and keep them working.

Result

Modern visibility of the shop floor, with a path to bring older machines in too.

Day to day

The work that keeps it running.

MSP governance

Our MSP handles daily support. I review their performance against the SLA, standardized onboarding and offboarding with them, and scoped the onboarding workflow in their ticketing system so it runs the same way every time. Security KPIs are reviewed with our security partner, monthly and now quarterly.

SLA reviewsOnboardingAdmin accounts

Data loss prevention

Set up DLP with our security provider around a five-level classification: public, internal, confidential, CUI, and secret. Ran a focus group with users before rolling it out, so the rules matched how people actually work.

ClassificationCUIFocus group

Identity & access

Conditional access, MFA, and Intune policies built around business needs, including frequent travel to specific countries. Exceptions only with a business justification. SSO for ADP and 1Password, and regular reviews for stale accounts.

Entra IDIntuneAccess reviews

Experience

From the help desk to the leadership table.

2016 – Present

Director of Information Technology

Pankl Aerospace Systems · Cerritos, CA

IT for the U.S. aerospace manufacturing subsidiary of an Austrian group, reporting to the CEO. Direct reports across IT, Finance, and HR, an MSP, and corporate IT nine time zones away. ITAR Empowered Official.

Nov 2016Financial Controller, and the site's in-house IT
Jan 2019IT Manager title added
Nov 2019HR Manager title added
Jan 2024Director of Information Technology

2014 – 2016

IT Support Specialist

Living Spaces Furniture · La Mirada, CA

Desktop and remote support for corporate, stores, and distribution centers: drive cloning and hardware setup for rollouts, remote Cisco switch support, and Verifone terminals. Documented the team's procedures and trained new hires. Earned my CCNA in 2016.

2007 – 2014

IT Support, Accounting, HR & Payroll

CP-Carrillo / Pankl Engine Systems · Irvine, CA

IT support, an ERP implementation, financial operations, and payroll for a performance-engine manufacturer.

Credentials

Training and tools.

Education & certifications

BS, Business Administration, Management Information Systems: California State University, Long Beach
ITAR Empowered Official: Pankl Aerospace Systems
CCNA: Cisco, 2016–2019
Pankl International Leadership Program: Austria
ITAR compliance training · Dale Carnegie: Professional development

What I work with

Microsoft 365 GCC HighEntra IDIntuneActive Directory SharePointExchange OnlineConditional access & MFADLP 802.1XVLANs & ACLsCiscoabas ERP ADP1PasswordJiraConfluence IntelliGRCNIST 800-171CMMC 2.0ITAR

Contact

Let's talk.

The best way to reach me is LinkedIn. Send a message and I'll get back to you.

Connect on LinkedIn