IT Controls & Cybersecurity Governance Analyst

Sam Victor

Tel: 352-***-**** Email: ************@*****.***

Education Embry-Riddle Aeronautical University Daytona Beach, FL B.S., Homeland Security Graduated Cum Laude: December 2021 Minor: Cybersecurity and Forensic Accounting

M.S., Cybersecurity Management & Policy Graduated Summa Cum Laude: March 2023 Work D.R. Horton Arlington, TX

Experience IT Controls Analyst (June 2024 – Present)

- Lead the development, implementation, and continuous improvement of enterprise IT policies, standards, and procedures, ensuring alignment with NIST Cybersecurity Framework, NIST SP800 series guidance, PCI DSS, and ISO 27001 while supporting regulatory compliance for a Fortune 500 public company.

- Partner with IT Infrastructure, Security, Network Operations, Application Support, Internal Audit, and other internal business stakeholders to translate technical, operational, and regulatory requirements into practical governance documentation and control standards.

-Develop and maintain Business Continuity Plans (BCPs) by conducting Business Impact Analyses (BIAs) and department interviews to identify mission-critical processes, recovery priorities, key personnel, technology dependencies, manual workarounds, and third-party risks across corporate functions including Finance, HR, Corporate Tax, and Internal Audit.

- Coordinate enterprise disaster recovery and business continuity initiatives by prioritizing critical applications, documenting recovery strategies, facilitating recovery planning meetings, and supporting disaster recovery testing efforts.

- Develop operational resilience documentation, incident response improvements, and lessons-learned reporting following high-impact infrastructure incidents, resulting in enhanced recovery procedures, clearer executive communication, and stronger disaster recovery playbooks.

- Manage governance and compliance activities for Electronic Payment Devices (EPDs), ensuring adherence to PCI DSS requirements, internal audit controls, vendor contractual obligations, device inventory requirements, tamper inspection processes, and annual compliance assessments.

- Author and maintain enterprise security policies covering vulnerability management, privileged access management, password security, backup and recovery, vendor risk management, mobile device/BYOD security, asset lifecycle management, environmental controls, and system hardening.

- Develop risk-based vulnerability management standards by establishing remediation timelines, exception processes, compensating control requirements, and governance procedures aligned with NIST guidance and industry best practices.

- Collaborate with Internal Audit and external auditors to respond to compliance inquiries, strengthen policy language, provide evidence of control effectiveness, and remediate audit findings through documented corrective actions.

- Develop and maintain IT asset lifecycle governance for leased hardware, including procurement, inventory tracking, custody, returns, disposal procedures, and financial accountability for lost or unreturned assets.

- Perform technology risk and operational impact assessments for infrastructure outages, application failures, and third-party service disruptions, identifying business impacts, recovery priorities, and mitigation strategies.

- Research, evaluate, and recommend enhancements to authentication, identity management, and privileged access controls by incorporating current cybersecurity guidance and emerging industry best practices.

- Support enterprise security awareness and compliance initiatives by contributing phishing awareness campaigns, security communications, and cybersecurity training content designed to reduce organizational risk.

- Facilitate cross-functional meetings with technical and business stakeholders to gather requirements, document recovery strategies, improve operational processes, and drive governance initiatives from planning through implementation.

- Led the planning, development, and facilitation of enterprise cybersecurity tabletop exercises, designing realistic incident scenarios to validate incident response, business continuity, disaster recovery, and cross- functional communication procedures while identifying opportunities to strengthen organizational resilience.

BNSF Railway Fort Worth, TX

I IT Auditor II (June 2022 – June 2024)

- Conducted comprehensive audits of IT systems, infrastructure, and processes to ensure compliance with regulatory requirements and company policies.

- Identified and assessed risks related to information security, data integrity, and system reliability, recommending and implementing controls to mitigate risks.

- Collaborated with cross-functional teams to develop and maintain audit programs, ensuring alignment with organizational goals and industry best practices.

- Prepared detailed audit reports outlining findings, recommendations, and corrective actions, communicating complex technical concepts to non-technical stakeholders.

- Utilized audit tools and software to analyze data, identify anomalies, and improve audit efficiency.

- Provided training and guidance to staff on IT audit processes, controls, and best practices.

- Stayed current with industry trends, regulations, and emerging technologies to enhance audit methodologies and practices.

- Demonstrated ability to quickly learn and assess risks of new IT systems, ensuring thorough and accurate audits across diverse technology environments.

- Developed comprehensive audit plans by conducting thorough research on systems, processes, and industry standards, ensuring efficient and effective audit execution.

- Successfully communicated project objectives, timelines, and audit findings in meetings with stakeholders, facilitating understanding and alignment across teams. U.S. Department of State Washington, D.C.

Bureau of Arms Control, Verification and Compliance (Sept. 2020 – Jan. 2021) Chemical and Biological Weapons Department

Foreign Affairs Officer (Intern)

- Work closely with policy and science experts on a range of U.S. chemical weapons deterrence priority areas

- Developed policy and White House guidance related to Middle East and Syria chemical weapons issues

- Coordinate with Departmental offices, U.S. embassies, other U.S. government agencies, and foreign governments

- Monitor Political situations and issues; draft demarches, guidance cables, press guidance, and policy papers

ERAU EcoCAR Challenge Daytona Beach, Florida

Team Lead/Communications Manager (December 2018 – December 2021)

- Responsible for communicating and connecting the team to school, outside organizations and sponsors, organizing and executing team events, marketing, and documenting the team efforts (team liaison)

- Ensured component, subsystem, and full vehicle designs meet strict competition rules

- Driveline integration

- Developed/executed vehicle test plans

- Develop cybersecurity plan and countermeasures for our 2019 Chevrolet Blazer Certifications

- CompTIA Security+

- ServiceNow CIS-Risk and Compliance

- OneTrust Certified Privacy Professional

- Optro Core Administrator Certification

- AuditBoard Level I Certification

Additional Experience

- SCCA Corner Worker/Marshall and Driver

- Apex Track Days Volunteer and Driver

- Orlando Drift Club Volunteer and Driver

- ARCA Pit Crew Volunteer

- Lone Star BMW CCA Volunteer and Driver

- Free Lance Photographer for IMSA Drivers

Contact this candidate