Information Technology Compliance Analyst

Paul J. Graham

617-***-**** ● *******@*******.*** ● Walpole, MA 02081

Results driven Information Technology Professional with extensive experience working in highly regulated and cross-functional environments. Motivated technical analyst with precise attention to regulations, policies, and potential risks to ensure compliance and foresee vulnerability. Collaborative, hands-on SME with intellectual curiosity as it relates to new technologies and best industry practices.

Self-starter with continual desire to learn

Complex problem solving

Strong analytical skills

Communicate across highly technical staff, leadership, and other internal/external stakeholders

Strategic direction & planning

Highly regulated and matrixed environments

Vendor Management

Security Risk Assessments

Project Management

Professional Experience

Staples Inc. (2-month contract) Mar 2024 – May 2024

Governance, Risk, and Compliance Analyst

Create, edit, and implement customer questionnaires to maintain data integrity

Utilize “Logicgate” platform to store and access company policy’s adhering to compliance standards

Document and report control failures/gaps to appropriate stakeholders and advise on strategic solutions

Dynamo Software – Watertown, MA (contract) Jun 2023 – Oct 2023

Governance, Risk, and Compliance Analyst

Create a Risk Charter to formally outline the approach for managing risks, and to document the company’s risk strategies and procedures

Work with vendors like BitSight and Security Scorecard to calculate security ratings, analyze the company’s security performance, and measure cyber risk

Assess annual due diligence questionnaires from clients regarding security controls

Utilize applications, such as, CrowdStrike, Qualys, AWS Benchmark, Zyston, and Security tickets to create power point slides and dashboards for the Risk Committee Charter

Perform annual security audits

Steward Healthcare – Westwood, MA Nov 2013 – Nov 2022

Senior Security Analyst

Manage the IT variance program

Work with the team on Risk Assessments. Clients needing access to Stewards network for patient information, financial information

oRisk Recon - Discover and monitor third-party risk and quickly act on the threats that would have the highest potential to damage your organization. This is a quick and brief

review of the vendor you need to deal with.

Management of the tracking, investigation, and response for security incidents, audit, and assessment findings

oSplunk was a reporting and logging tool that I used to collect and monitor traffic and devices throughout the network

oMicrosoft SIEM for monitoring the network for threats, view network alerts

oMonitoring data from all sources, including users, applications, servers, and devices running on premises or in any cloud

oFairwarning for monitoring the hospitals to see who was accessing patient files, what date, how long they were in the file, do they have permission to be in the file. Were changes made to the file, etc

oPhishing exercises used to send out e-mails to select group to see if they open an attachment, reply to the e-mail. We had a set of instructions set up if they are not 100 percent about the safeness of the e-mail to send it to special e-mail address for these types of e-mails they are unsure of. Awareness e-mails were sent out about e-mail security on a quarterly basis

Responsible for development of Archer GRC compliance program’s workflow, reports, and end user documentation

Network data loss prevention, event identification, and analysis (RSA, Microsoft)

oIdentifying Confidential Information, Patient Information on users Desktops, C drive that should be stored on a secure drive. Watching for users that are printing, faxing or scanning Confidential Information, Patient information. Monitoring outgoing e-mails that may have attachments with the same type of confidential data attached to the e-mail

oWorking with the user and identify the data to them and educating them on why the confidential data should not be stored on their desktop or C drive in case the machine was lost or stolen

oCreating pivot tables in Excel to clear all of the false positives and concentrate on a set of IP addresses, location or names that you are searching for

Monitor and ensure compliance with authoritative obligations among associates, contractors, and business partners

Boston Financial Data Services – Quincy, MA Jan 2005 – Nov 2013

Senior Network Engineer

Maintain 50 multi-million-dollar mutual fund remote clients via a Channelized T3 connection

Manage 4 remote company locations using an OC3 Sonet Ring

Support of the Juniper VPN and B2B VPN solution

Network Management tools, HP Openview, Ethereal, Network General Sniffer, Ciscoworks, ExtraHop, Gigiamon

Maintain network Firewalls securing the Internet, B2B solutions, DMZ’s and Partner networks

LAN switches: Avaya user switches and 6509 Core switches through the network

Liaison to Security Team: Blue Coat Proxy, IPS/IDS, Palo Alto Firewall

Coldwell Banker – Consultant – Waltham, MA Jun 2003 – Jan 2005

Senior Network Engineer

Maintained 130 remote office locations consisting of VPN’s, Frame-relay, point-to-point T1’s and ISDN backup

Responsible for LAN/WAN, consisting of Cisco switches (6509, 3550, 3750) and routers (2500, 2600,7200)

Worked with VPN concentrator for all High-Speed VPN's

Responsible for Network security via Cisco PIX 525 Firewalls

Allied Domecq Retailing – Randolph, MA Jan 2001 – Jun 2003

Network Infrastructure Engineer

Responsible for 800 user Virtual Private Network using a variety of access methods including Dial, Broadband and DSL, using Sonicwall SOHO2, SOHO3, TELE3 and PIX 501 Firewalls

Worked on the design, configuring and implementation of High-Speed access for our world-wide franchise stores

Responsible for maintaining network in order to support company’s business process

Maintained all network related documentation utilizing Visio Enterprise documentation software

Provided 2nd and 3rd level support for end user community

Maintained the network security and infrastructure via Check Point Firewall and Cisco PIX 525, creating DMZ’s, Partner Networks

Designed and planned all network cabling and wiring closet upgrades

Bayer Diagnostics – Medfield, MA Nov 1995 – Jan 2001

Network Analyst

Provide support for end user community for network issues such as installing Bay Network concentrators, Cisco switches including Cisco 5500, 5000. Kalpana switches and Cisco routers including the 7513, 2600, 2500

Design local area network for Medfield, Walpole and Norwood sites

Worked on network design for the disaster recovery team

Converted multiple facilities from shared Token Ring to switched Ethernet

Design and support networks for remote sites

Set up ISDN/BRI backup for all major sites

Responsible for all software, hardware, and memory upgrades for Cisco routers and switches

Configure and install front end routers for network security for all non-Bayer sites

Network Technician

Created a training manual for the Network Management System Netview 6000

Trained Computer Operators and Help Desk personnel on Netview 6000

Monitored network activity daily via Netview 6000

Troubleshoot and resolve all network layer 1 and 2 problems

Responsible for all upkeep of Wiring Closets and documentation

Senior Computer Operator

Ran and monitored nightly backups

Worked on 3090 Mainframe and AS400 Mid-range systems

Performed special requests for programmers

Member of the Disaster recovery team

Wrote and debugged Cobol programs

Systems

Vendor Hardware experience: Cisco, Bay Networks, IBM

Platforms: Cisco router; 804, 1710, 2500, 2600, 3600, 7206, 7513, AS5300, Cisco switches; 2924, 2950, 3550, 3750, 5000, 5500, 6500, Bay Network Hubs, Paradyne and Adtran CSU DSU’s, modems, Infrastructure cabling, Firewall Systems, access servers, Aurorean Network Gateways Aurorean Software Client, Sonicwall SOHO2 and SOHO3 Firewall, Sonicwall Global Management system, PIX501, PIX 515, PIX525 Firewall’s, Checkpoint Firewall

Management: Netview 6000, HP OpenView, Ethereal, Concord Network Health, Cisco Works, Network Associate Sniffer products PIX PDM, PIX ADSM, Visio 2000

Network Protocols: TCP/IP, IPX/SPX

Routing protocols: EIGRP, OSPF, RIP, BGP

WAN: T1, T3, ISDN (PRI/BRI), Fractional T1 Wireless Links, Satellite, Sonet Ring

LAN: Ethernet, Token Ring

VPN: PPTP, IPSEC, SSH

Supporting an 800 user VPN, Dial up using Aurorean Software Client, High-Speed using DSL, Cable Modem, ISDN

Network Management tools, Agilent software

Honors, Certifications, and Associations

Network Engineer Certification

AS400 Operator Certification

Professional Training and Education

Cisco

Catalyst 500 Series configuration

Introduction and Advanced Cisco Router Configuration

Cisco Internetwork Troubleshooting

Cisco Secure PIX Firewall

Bay Networks

Token Network Connectivity

Ethernet Connectivity

Lan/Wan Technology Overview

IBM

Implementing Netview for AIX

AS400 System Operator Workshop

AIX6000 Basic System Administration

Network Associates

Ethernet Network Analysis and Troubleshooting

Troubleshooting with the Expert Sniffer Analyzer

Checkpoint

Checkpoint Firewall I class

PaloAlto

Installation, Configuration, Management and Troubleshooting

Norwood High School, Norwood, MA

High School Diploma

Contact this candidate