Information Security GRC & Third-Party Risk Analyst

SUMMARY

Bayong Fokwen

Information Security GRC & Third-Party Risk Analyst

Houston, TX 210-***-**** ********@*****.*** LinkedIn Information Security GRC professional with 6+ years of experience in governance, risk management, third-party risk assessments, security compliance, and vendor security programs across enterprise environments. Skilled in conducting internal and external audits, managing risk registers, performing vulnerability assessments, and supporting compliance initiatives involving ISO 27001, SOC 2, PCI DSS, NIST, GDPR, GLBA, and NYDFS CRR 500. Experienced with RSA Archer, ServiceNow VRM, BitSight, Nessus Tenable, and vendor due diligence processes, with a strong focus on strengthening security controls, mitigating organizational risk, and maintaining regulatory compliance. TECHNICAL SKILLS

GRC & Risk Management: Governance, Risk & Compliance (GRC), Third-Party Risk Management (TPRM), Vendor Risk Assessments, Enterprise Risk Management, Risk Registers, Risk Assessments, Risk Treatment, Control Testing, Control Mapping, Gap Analysis, Security Control Assessments, Change Management, IT General Controls (ITGC), Vulnerability Management, Incident Response, Remediation Tracking Compliance Frameworks & Standards: ISO 27001, SOC 1, SOC 2 Type II, PCI DSS, NIST Cybersecurity Framework (NIST CSF), GDPR, GLBA, NYDFS CRR 500, OWASP Top 10

GRC & Security Tools: RSA Archer, ServiceNow VRM, BitSight, Nessus Tenable, AuditBoard, JIRA, Confluence, Smartsheet, ClickUp, Formstack, Airtable, ISORA, Microsoft 365 Third-Party & Vendor Security: SIG Lite, SIG Core, Vendor Due Diligence, Vendor Onboarding, Security Questionnaires, Third- Party Assessments, Vendor Remediation Management, Security Ratings Monitoring, Contract Security Reviews Audit & Compliance Activities: Internal Audits, External Audits, Evidence Collection, Audit Readiness, Compliance Reporting, Policy Development, Procedure Documentation, Control Validation, Artifact Reviews, Regulatory Compliance Management Security & Infrastructure: Vulnerability Scanning, Security Architecture Reviews, Penetration Test Reviews, Business Continuity Planning (BCP), Disaster Recovery Planning (DRP), Cyber Liability Reviews, Remote Access, VPNs, Firewalls, Web Application Firewalls (WAF)

Cloud & Platforms: AWS, Google Cloud Platform (GCP) Professional Skills: Stakeholder Management, Cross-Functional Collaboration, Executive Reporting, Security Awareness Training, Technical Documentation, Problem Solving, Critical Thinking, Risk Communication, Project Coordination, Regulatory Compliance Management

WORK EXPERIENCE

Selective Service System Jul 2023 – Present

GRC Analyst

• Engineered and maintained security governance frameworks by aligning organizational policies and controls with ISO 27001 requirements, strengthening enterprise information security practices and audit readiness.

• Directed SOC 2 Type II and PCI DSS audit activities by coordinating evidence collection, remediation efforts, stakeholder communications, and compliance deliverables across multiple business functions.

• Conducted annual control self-assessments and vulnerability reviews using Nessus Tenable, partnering with technical teams to remediate critical findings and improve security preparedness.

• Maintained risk registers in collaboration with control owners, documenting findings, tracking remediation milestones, validating evidence, and ensuring timely closure of identified control gaps.

• Created information security procedures, workflows, and supporting documentation that improved incident response processes, audit preparation efforts, and vendor security management activities.

• Led enterprise risk assessments and vulnerability analyses across critical business operations, identifying security exposures and recommending mitigation strategies that strengthened the organization's risk posture.

• Managed compliance activities through RSA Archer, monitoring audit findings, remediation plans, and control effectiveness to maintain continuous governance and regulatory visibility.

• Utilized BitSight to monitor external security ratings and support ongoing third-party risk evaluations for vendors providing critical business and technology services.

• Conducted vendor due diligence activities by distributing SIG Lite and SIG Core questionnaires, reviewing responses, and supporting risk-based onboarding and assessment processes.

• Performed detailed reviews of SOC 1/SOC 2 reports, ISO 27001 certifications, penetration testing reports, cyber liability insurance, BCP/DR documentation, policies, and architecture diagrams to validate vendor compliance.

• Coordinated daily with vendors and internal stakeholders to resolve outstanding findings, obtain required artifacts, provide remediation guidance, and maintain effective communication throughout assessment lifecycles.

• Documented assessment results, prepared final vendor security reports, delivered GRC awareness sessions, and leveraged resources such as NVD and OWASP Top 10 to stay informed on emerging cyber threats and vulnerabilities.

ExxonMobil Feb 2022 – Jun 2023

GRC and Vendor Analyst

• Championed the development of security policies and governance frameworks supporting IT/OT controls, third- party risk management initiatives, and enterprise compliance requirements across critical operations.

• Managed RSA Archer administration activities by maintaining organizational controls, vendor assessments, risk records, and compliance workflows to support ongoing governance initiatives.

• Mapped enterprise controls to SOC 2 requirements, ensuring security practices remained aligned with internal standards and external audit expectations.

• Reinforced compliance programs by aligning control frameworks with PCI DSS, ISO 27001, GDPR, and NIST requirements as regulatory obligations evolved.

• Maintained and enhanced the enterprise control library by evaluating regulatory updates, identifying gaps, and implementing improvements to strengthen governance processes.

• Led change management activities for hardware and software implementations, ensuring security controls and compliance considerations were incorporated throughout technology deployments.

• Provided guidance on control design, control mapping, gap analyses, and risk assessments to support privacy, confidentiality, integrity, and availability requirements across business functions.

• Conducted enterprise risk assessments and threat analyses, co llaborating with subject matter experts to develop mitigation strategies and remediation plans for identified security risks.

• Directed internal audits for GLBA, PCI-DSS, ISO 27001, NYDFS CRR 500, and SOC 2 Type II readiness programs, coordinating artifact collection and validating control effectiveness before external reviews.

• Oversaw enterprise vulnerability management initiatives by prioritizing findings, facilitating remediation activities, and improving visibility into cybersecurity risks across IT and operational environments.

• Delivered executive security posture reports and managed multiple concurrent governance initiatives, enabling leadership teams to make informed risk decisions while maintaining high standards of quality and compliance. ServiceNow, CA Feb 2019 – Jul 2021

Information Security GRC Analyst

• Conducted third-party security assessments for technology and cloud vendors, evaluating security practices and documenting risks prior to onboarding and contract renewals.

• Administered SIG Lite and SIG Core questionnaires, reviewed supporting artifacts, and coordinated with vendors to address outstanding control gaps and compliance concerns.

• Assessed SOC 1 and SOC 2 reports to validate vendor control effectiveness and provided risk recommendations to procurement and information security stakeholders.

• Configured vendor assessment workflows within ServiceNow VRM, streamlining review activities and reducing manual tracking efforts across third-party onboarding processes.

• Maintained vendor risk registers and remediation plans, ensuring identified findings were properly documented, prioritized, and monitored through closure activities.

• Monitored external security ratings through BitSight and escalated high-risk vendor exposures, improving visibility into third-party cybersecurity risks across critical suppliers.

• Collaborated with legal and procurement teams to incorporate security requirements into vendor agreements and support compliance with organizational governance standards.

• Reviewed third-party controls against ISO 27001 requirements, identifying improvement opportunities and assisting vendors with remediation planning for key security findings.

• Supported GDPR compliance reviews for international service providers, helping ensure appropriate data protection measures and contractual safeguards were established for regulated information.

• Prepared quarterly vendor risk summaries covering more than 60 strategic suppliers, enabling leadership teams to make informed decisions on third-party engagements and risk acceptance. EDUCATION

Laureate Higher Institution of Business Administration Bachelors in Technology in Management

CERTIFICATIONS

CompTIA Security+ SYO-601

Certified SAFe Scrum Master

Certified in Risk and Information Systems Control (CRISC) AWS Certified Solutions Architect Associate

AWS Certified Cloud Practitioner

Contact this candidate