KWAKU ASSIAMAH
Frederick,MD
Summary
Results-driven GRC and Third-Party Risk Management Lead with 9+ years of experience designing, implementing, and maturing enterprise Governance, Risk, and Compliance programs in regulated financial and education environments. Proven track record building a TPRM program from ground up, leading vendor risk lifecycle from inherent risk assessment to continuous monitoring, and coordinating SOC 2, ISO 27001, PCI-DSS, and SOX audits. Expert in control mapping (NIST 800-53, ISO 27001, CIS), policy lifecycle management, risk register governance, POA&M management, and cross-functional alignment with Legal, Procurement, Privacy, Engineering, and Audit. Managed and mentored a team of 5 analysts, reduced vendor review backlog by 60%, and improved audit readiness and on-time vendor reassessments by 45%.
Overview
1
1
Certification
12
12
years of professional experience
Work History
Third-Party Risk & GRC Lead
Morningstar Inc
Chicago, IL
01.2017 - Current
- Lead end-to-end Third-Party Risk Management lifecycle for 300+ vendors: intake, inherent risk tiering (based on data sensitivity, system access, network connectivity, financial impact), due diligence, residual risk scoring, contracting, and continuous monitoring.
- Built and operationalized enterprise TPRM program from ground zero including charter, policy, procedures, RACI with Procurement/Legal/Privacy, SIG Lite/Core questionnaires, risk-tiering model (Critical/High/Medium/Low), and executive reporting dashboards.
- Perform deep-dive security reviews of vendor evidence packages: SOC 1/2 Type II, ISO 27001 certificates, PCI AoC/RoC, SIG, CAIQ, penetration test reports, and Business Continuity/Disaster Recovery plans; map control gaps to NIST 800-53 Rev 5 and ISO 27001:2022 Annex A and document findings with remediation.
- Own risk register and exception process: document risks, assign owners, define mitigation and compensating controls, track POA&Ms to closure, and present residual risk to Risk Committee and senior leadership for risk acceptance.
- Manage company-wide security policy library of 35+ policies, standards, and procedures aligned to NIST CSF and ISO 27001. Lead annual policy reviews, gap analysis against new regulations (GDPR, CCPA), and drive remediation with control owners.
- Coordinate and serve as primary liaison for SOC 2 Type II, ISO 27001:2022 surveillance, and PCI-DSS assessments: define scope, collect and QA evidence, manage auditor requests in Vanta/Drata, track open items, and close findings, improving audit readiness by 50%.
- Implemented SLA-based workflow between InfoSec, Procurement, and Legal reducing average vendor review TAT from 21 days to 8 days and reducing backlog by 60% while improving on-time annual reassessments for Critical vendors from 68% to 95%.
- Mentor, train, and manage team of 5 GRC/TPRM analysts on risk assessment methodology, control mapping, professional report writing, and stakeholder communication; developed onboarding playbooks and QA checklists.
- Partner with Legal and Privacy to assess PII, FERPA, GDPR data processing activities, DPAs, and fourth-party risk; integrated privacy risk into vendor tiering and continuous monitoring via OneTrust and BitSight security ratings.
GRC Analyst - Vendor Risk Management
Tidewater Community College
Virginia Beach, VA
06.2015 - 01.2017
- Executed 150+ third-party and internal system risk assessments evaluating security controls against NIST 800-53 and ISO 27001, documenting control gaps, and recommending mitigations.
- Reviewed and interpreted SOC reports, ISO 27001 certs, and PCI Attestations to determine vendor compliance posture, residual risk, and conditional approval recommendations.
- Developed vendor criticality rating methodology based on data classification (FERPA, PII), system interconnectivity, and access level; flagged 25+ high-risk vendors for enhanced due diligence and continuous monitoring.
- Collaborated with Legal and Privacy Office to ensure third-party contracts included required FERPA, GDPR, CCPA, and breach notification clauses and proper data handling requirements.
- Maintained GRC documentation in Archer and ServiceNow GRC, supported security awareness training compliance tracking, and contributed to policy exception reporting.
Information Assurance Analyst - GRC
Tidewater Community College
Newport News, VA
05.2014 - 06.2016
- Executed full NIST Risk Management Framework (RMF) lifecycle for 6+ moderate-impact systems: FIPS 199 categorization, security control selection (NIST 800-53), SSP authoring, security control assessment (SCA), SAR creation, and POA&M management.
- Performed control assessment and testing, interviewed system owners, collected artifacts, and authored Security Assessment Reports (SARs) with prioritized remediation roadmap.
- Ran vulnerability scanning using Nessus, Qualys, WebInspect, and nCircle IP360, validated findings, and partnered with IT Operations to drive remediation and reduce critical vulnerabilities by 40%.
- Authored and maintained Authorization packages including SSPs, Contingency Plans (CP), Configuration Management Plans (CMP), and Interconnection Security Agreements (ISA).
Education
B.S. - Biochemistry
Virginia Commonwealth University
Richmond, VASkills
- Third-Party Risk Management (TPRM) Lifecycle
- Inherent Vendor Risk Scoring
- SOC I and II Analysis
- ISO 27001 & NIST 800-53
- PCI DSS assessment
- GRC Program Development & Maturity
- Information Security Policy & Standards Management
- Risk Register
- POA&M Management
- Control Mapping: NIST CSF
- Audit Readiness & Coordination: SOC 2
- Vendor Questionnaires : SIG, CAIQ, Custom Security Questionnaires
- Strategic planning
- Regulatory Compliance: SOX
- HIPAA
- Privacy: GDPR, CCPA
- PII Data Flow
- GRC solutions: Archer, OneTrust, UpGuard, ServiceNow, Fusion
- Risk Assessments
- Stakeholder Engagement (Legal, Business Unit & Procurement)
- Effective communication
- Problem solving
- Team Leadership
Certification
CISA - Certified Information Systems Auditor, ISACA, Active
Accomplishments
- Built TPRM program from 0 to 1 covering policy, procedures, questionnaires, risk-tiering, and reporting, now managing 300+ active vendors.
- Created annual risk-based reassessment program for Critical/High-risk vendors, increasing on-time completion from 68% to 95% and providing executive visibility into third-party risk posture.
- Reduced vendor review backlog by 60% through intake streamlining and SLA-based triage model between InfoSec, Procurement, and Legal.
- Matured audit evidence collection process using Vanta/Drata automation, improving completeness and timeliness for SOC 2 and ISO 27001 by 50% and achieving zero repeat findings in last 2 audit cycles.
Professional Development
- In Progress: CRISC, CISSP, OneTrust Certified - Third-Party Risk
- Continuous training in NIST 800-53 Rev 5, ISO 27001:2022, FedRAMP, and TPRM best practices
Timeline
Third-Party Risk & GRC Lead
Morningstar Inc
01.2017 - Current
GRC Analyst - Vendor Risk Management
Tidewater Community College
06.2015 - 01.2017
Information Assurance Analyst - GRC
Tidewater Community College
05.2014 - 06.2016
B.S. - Biochemistry
Virginia Commonwealth University