Compliance Analyst Information Security

VINCENT NJINDANGAM

THIRD-PARTY RISK/COMPLIANCE ANALYST

Email: ************@*****.***, Bowie, MD. Cell No: 240-***-****

PROFESSIONAL SUMMARY

An efficient and result oriented Professional, with over 6 years’ experience as a Third-Party Risk/Compliance Analyst, with the goal to maximize value and minimize risk. Great experience in vendor intake process, Vendor Categorization, security assessment, analyzing technical reports -Penetration test, vulnerability scans, SOC and creating risk assessment reports. Good knowledge of governance risk and controls related to various compliances/Standards. Ability to efficiently communicate at all levels with very good experience in information security awareness and security controls assessment. Dynamic, detail oriented, innovative and possess the ability to adapt quickly to changing environments and interact well at all levels. Excellent skills and experience in reexamining and implementing security control procedures to ensure efficiency and mitigate risks.

SKILLS/TOOLS

Vendor management

Risk assessment

Team player and fast learner.

Devoted and reliable

Detailed oriented and time management.

Multi-tasking and leadership

Ability to work under pressure without compromising accuracy.

Excellent analytical and organizational skills

Good communication skills

Planning

Prioritization

Information security

Policies and Procedures

Aptitude in office 365 and Google suite

ISO 27000/ PCI-DSS /SOC2/GDPR/HIPAA/CCPA/ NIST/ HITRUST/SOX

ZenGRC, Slack, Venminder, SCOUT, SecurityScoreCard.

EXPIRIENCE

THIRD-PARTY RISK/COMPLIANCE ANALYSTS Wells Fargo (WTS) 03/2022-present

Maintain a comprehensive inventory of all vendors that the organization works with and categorize them based on criticality to business and the type of data in scope.

Perform security assessment on vendors to assess their control environment, compliance with relevant laws and regulations.

Work closely with the vendor POC and relevant stakeholders within the organization to develop risk mitigation strategies that reduce risk and help maximize value.

Conduct reassessment of all vendors based on their category/inherent risk level to ensure that they continue to meet the organization expectations and comply with all relevant policies and regulations.

Identify, document and report on the risks associated with vendors to senior management and other stakeholders within the organization.

Stay current on the industry best practices and continuously improve the organization vendor risk management program.

Participate in the development of organization BCP/DRP to help organization cope in case of a sudden failure in business operation/disaster.

Reviewed and made recommendations on organization wide policies and procedures to ensure the organization maintains a good security posture, meets requirements, and maintain compliance such as GDPR, PCI-DSS, SOX, New York Financial and CCPA.

Assist in coordinating compliance audits, assessments and manage practical action plans to respond to audit discoveries and gaps.

Collaborate with relevant stakeholders to ensure compliance requirements are integrated into business processes and systems.

Work together with various departments to ensure control implementation is up to date and request evidence for review.

Support in conducting awareness and training programs and phishing campaign to all employees using Knowb4.

Document and track all identified risks in the risk register and ensure that they are fixed/closed within a defined milestone.

THIRD PARTY RISK ANALYST, PepsiCo (WTS) 12/ 2018– 03/ 2022

Work in partnership with Teams such as Business, Procurement, Security, and Legal during vendor intake process.

Perform vendor classification according to Data handling, criticality, and relationship as well as company policies and procedures.

Conduct vendor security review by sending VSQ/SIGs and requesting evidence.

Engage with specified vendor contact to obtain evidence of control operations.

Evaluate VSQ/SIG response and analyze supporting evidence such as SOC reports, penetration test, vulnerability scans, information security policy and procedure to identify any gaps /findings within the vendor’s control environment.

Update risk registry and engage with vendors to obtain risk treatment plan, for all identified gaps and make recommendations.

Review and update company risk registry, risk acceptance prior to creating risk assessment reports.

Create Vendor Risk Assessment Report and escalate issues when necessary.

Ability to communicate vendor security issues to stakeholders, ensuring that they understand the associated risks and actions needed to remediate those risks.

Performs Continuous monitoring and Reassessment with experience using BitSight and Security score card to make sure vendor controls are properly implemented to ensure confidentiality, integrity, availability, and privacy throughout the contract.

Reexamined and made recommendations on organization wide policies and procedures to ensure the organization maintains a good security posture, meets requirements, and maintain compliance such as GDPR, PCI-DSS, SOX, New York Financial and CCPA.

Good mastery of GRC tools such as SCOUT, ZenGRC, and ServiceNow.

Act as a liaison during organization internal and external audits by gathering evidence and responding to security questions.

Create information security documentation and workflows to assist with incident response, audits, and vendor requirements.

Assist in conducting awareness and training using KnowBe4.

Assist in the development, review, implementation and maintenance of policies, procedures, standards, and guidelines in accordance with applicable regulations including ISO 27001, NIST 800-53 Framework Controls, HIPAA, and PCI-DSS.

Present gap analyzes to stakeholders and management to give a better knowledge of the risk level.

Responsible for reviewing vendor’s contracts to ensure that all security concerns are well addressed.

Good working experience with compliances such as ISO 27001/ PCI-DSS /GDPR/HIPAA/CCPA/ NIST/ HITRUST

THIRD PARTY RISK / COMPLIANCE ANALYST 06/2016-11/2018 eBay, Washington DC (MBA Tech)

Conducted vendors categorization and Risk assessments.

Analyzed vendors evidence, SOC reports, pen test report and vendors policies and procedures.

Identified gaps/exclusions and recommended remediation initiatives.

Tracked and notified remediation progress of vendors on identified vulnerabilities.

Maintain potent working relationships and open channels of communication with Vendors to ensure vendor alliance with policy and procedures.

Accountable for conducting awareness and training using KnowB4.

Worked with various organizational teams to sustain internal and external auditing processes.

Worked with vendor relationship manager to resolve any Vendor related issues especially on nonresponsive Vendors and Vendors refusal to provide evidence for assessment.

Reexamined and made recommendations on organization wide policies and procedures to ensure organization maintains a good security posture, meet requirements, and maintain compliance such as ISO, GDPR, PCI-DSS and CCPA.

Review vulnerability scans and Pen test reports.

Guided post risk categorization and vendor continuous monitoring post-contract.

EDUCATION

Bachelor’s degree in computer science University of Buea

CERTIFICATION

CompTIA Security+ certified

CISA (Certified Information Systems Auditor)

AWS (Certified Cloud Practitioner)

Contact this candidate