Over the past two years, I have created an Information Security Department focusing on requiring controls to mitigate risk and stay compliant with required contracts/regulations in the financial industry (PCI, GLBA and Privacy, etc). I align strategy with management, build frameworks for tactical work, and work with staff to implement operational aspects. I have hands on experience building teams to manage cybersecurity and information security programs as well. More importantly, I love being able to de-mystify the world of technology into risk terminology for upper management and operations teams.
I led the InfoSec team to create an IT asset management policy, a new vulnerability management program, establish a formal security awareness program, and create a framework of identifying IT controls to work towards automation with a feedback loop. Our greatest achievement has been maturing the IT department security culture from a compliance driven mindset to risk informed (NIST CSF Tier 2 maturity) in the span of 2 years. We set maturity goals based off risk assessments using CIS v8.0 and NIST 800-53 control frameworks and track effectiveness with our IT audit program.