Senior IT Risk & SOX Security Compliance Leader

Senior Compliance Leader

IT Risk with **+ years leading enterprise security Sarbanes Oxley 303/404 assessments and security assessments across global financial services and federal technology environments. With responsibility for planning, governance, stakeholder coordination, certification readiness, and successful execution of ISO certification programs, with a strong hands-on SOX internal controls over financial reporting experience.

Expert in SOX Controls Management, Industry Certification Mgmt., and Technology Gap Assessments with Technology and Business Asset Owners to evaluate risk posture, control maturity, and regulatory exposure. Proven ability to own security workstreams endtoend, define and implement controls, and execute handson assessments.

Trusted advisor with a strong track record securing acquisitions, separations, and regulated environments. Handson NIST SP 800-171,172 controls and NIST800-53A Revision 5 controls with 5.2.0 updates.

PROFESSIONAL EXPERIENCE

Contract Employment

RiskIT Mgmt Services – Information Security & Privacy Advisor consultant for clients: 1/2026 – current

•Parents Matters Cybersecurity Program Consultant 01/2026–Present

Facilitate cybersecurity training. Develop portal content, training modules, and privacy by design and other infosec awareness materials, focused on architecture of Controls and Security and industry ISO and NIST certifications.

•US Navy PM - Privacy and Cybersecurity consultant 12/2023-12/2024; assessments in preparation for Regulatory compliance.

•Mailchimp Protiviti Consultant - Privacy Assessment. 12/2023-12/2024

•IBM Consultant - 12/2023-12/2024. Assisted in OCC Credible Challenge Process to identify operational weakness for a national banking and financial services client. Reviewed client’s information security internal operational procedures for risks and findings based on FFIEC Handbook, NIST 800 (AC) and Cybersecurity Framework’s security standards.

Wells Fargo (TEKsystems) Software Engineer SIEM Software Security & Risk IT 12/2024–12/2025

• Facilitated SIEM process integration for log onboarding, threat detection, and monitoring enhancements supporting security activities. Ensured secure Day 1 operations compliance with NIST 800 control sets AU-2, AU-6, AU-12, IR4, IR5, and SI-4, in line with corporate policies and ISO 27001:2022 Annex A controls 8.15 and 8.16.

• Confirmed the SIEM Cloud provider’s ISO 27001 certification and the status of the last recertification audits. Confirmed Risk Management Processes including ISO 3100, ISO/IEC 27005, ISMS, ISO 27701. PIMS.

I personally performed SIEM and M365 server-based AD/Entra IAM entitlement reviews and user RBAC for administrators, support staff, and general users. Application service retirement decommissioning, including server offboarding, AD/Entra based user migration.

Dell Federal (PRI Global) IT Compliance Cybersecurity BISO Advisor 12/2020–12/2023

• Conducted ISO 27001 Operational Effectiveness assessments, evaluating security posture, control gaps, regulatory exposure, and remediation effort.

• Applied NIST 800-171 moderate impact controls with respect to CMMC’s 110 level-2 and level-3 controls, with an additional 24 controls from NIST 800-172. Additionally, focused on FedRAMP’s 325 moderate and 421 high-impact NIST 800-53 A controls. Controls included:

Audit and Accountability (AU - 9 controls): Creating, protecting, and reviewing system audit logs so that user activity and security events can be tracked and investigated.

Awareness and Training (AT - 3 controls): Ensuring personnel are trained on security risks, insider threats, and specific organizational policies.

Configuration Management (CM - 9 controls): Establishing baseline configurations, tracking hardware/software inventories, and managing security impact analyses for changes.

Incident Response (IR - 3 controls): Tracking, handling, reporting, and testing cybersecurity incidents and operational response plans.

Maintenance (MA - 6 controls): Managing, controlling, and securing physical and remote maintenance tools and activities on system components.

Media Protection (MP - 9 controls): Securely handling, storing, transporting, and sanitizing digital and physical media (including hard drives, backups, and paper) containing CUI.

Personnel Security (PS - 2 controls): Screening individuals prior to authorization and protecting organizational assets during personnel transitions or terminations.

Physical and Environmental Protection (PE - 6 controls): Limiting physical access to organizational systems, equipment, and operating environments (using badges, visitor logs, and escort controls).

Risk Assessment (RA - 3 controls): Periodically assessing risk (including vulnerability scanning and risk mitigation).

Security Assessment (CA - 4 controls): Continuously monitoring security controls, developing/updating System Security Plans (SSPs), and tracking remediation via Plans of Action and Milestones (POA&Ms).

System and Communications Protection (SC - 16 controls): Securing architectural boundaries, implementing FIPS-validated cryptography for data at rest and in transit, and managing subnet isolation.

System and Information Integrity (SI - 7 controls): Identifying, reporting, and correcting system flaws in a timely manner; providing protection from malicious code (antivirus/EDR); and monitoring alerts.

• Normalized security postures across environments impacted by activity, working with Archer eGRC on the Archer IRM framework, solutions, use cases, and Container questionnaires.

• Partnered with legal, privacy, infrastructure, and engineering teams to execute security plans.

US Navy (Artech) Risk IT Compliance Consultant 03/2020–12/2020

Conducted IBM Cloud readiness assessments for missioncritical systems based on.

Strengthened cyber resilience by aligning risk controls with ISO 27001 surveillance audit.

FullTime Employment

Flight Centre Americas BISO – PCI Program Manager 12/2018–03/2020

Led Controls Management for corporate policy and standards focused on NIST 800-171/172 and SOX controls for NA location within US, Mexico, Canada; and Australia.

Achieved PCI-DSS certification compliance with PAN and SAD and 12 Principal Requirements.

Aligned organization with ISO27003, 27005,, ISO 27001 ISMS, ISO 27701 PIMS.

Archer eGRC management focused on Application Questionnaires, and Vendor Management, including privacy by design management.

Wipro / Ensono Chief Information Security Officer (CISO) 03/2016–11/2018

Architected and directed security due diligence and integration activities for acquired and divested client environments, assessing cyber risk, control maturity, and regulatory exposure.

Managed Information Security Officer duties and operational staff on daily IS management activities and TARA and CGA assessments, and led GDPR compliance and global cloud delivery security programs; as well as Annual Industry Certification achievements, including CIS Controls, PCI-DSS, SOC1, SOC2, CLOUD-STAR, and support of client annual assessments. Use of Archer eGRC modules IT Risk, Controls Assurance, Cyber Incident and Breach Response modules.

Led Controls Management for corporate policy and standards focused on NIST 800-171/172 and SOX controls for Global location within US, EMEA, LATAM and APAC.

Partnered with global delivery teams to embed security into cloud transformation initiatives.

RiskIT Management Services Security & Compliance Program Manager 08/2014–04/2016

PM for SOX assessments of internal controls, including management responses, approvals, MBIs/BIs, and residual risk tracking; and PM for application security assessments focused on OWASP Top 10 and software development, using static and dynamic monitoring to identify threats; delivered phishing campaigns and awareness presentations.

Assessed privacy programs and tools automation; recommended enhancements to governance, education, privacy by design, DFM, and controller/processor agreements.

PM for Controls Assurance on internal and regulatory compliance audits including PCI, CIS and ISO Controls, with strong focus cybersecurity program controls.

JPMorgan, Jersey City, NJ VP Program Service Manager (LOD1) 07/2012–07/2014

Service Delivery Management with weekly performance metrics to executive leadership and the board, highlighting global application vulnerability remediation progress. Produced quarterly and annual Archer eGRC risk reporting to support SOX and FFIEC / Operational Effectiveness compliance filings.

US DOT Maritime Administration / Merchant Marine Academy ISSO 01/2009–07/2012

Defined longterm strategy for FISMA and FedRAMP moderate controls and compliance, aligning NIST 800 53 and ISO 27001 ISMS based policies and procedures with information protection and security strategy. Supported Phase1 -3 Audits, including documentation review, operational effectiveness and Recertification audits; and lastly the Recertification audits.

Implemented NISTbased cybersecurity framework for public safety systems; coordinated penetration testing, vulnerability management, and threat remediation.

Developed and executed BCP/DR plans with business and technology teams.

Coordinated with NY and DC FBI CyberCell for training and Cyber Awareness Month.

National Stock Exchange, NJ CISO 06/2007–12/2008

Architected corporate policies and standards based on NIST 800 171/172 controls designed for SOX. Directed and architected risk and security services’ RCSA deployment based on HITRUST, GLBA, and SEC control guidelines; oversaw remote access, 2FA, malware, and virus management.

Coordinated penetration testing, vulnerability assessments, and risk remediation; enhanced patch and configuration management.

Led interface for Business Continuity and Pandemic Planning for NSX, SRO, and member brokerdealers, working with SIFMA and member firms.

Citigroup SVP Program Manager, IT Risk Management (LoD2) 1995–2007

Senior managed, architected and deployed the Sarbanes Oxley (SOX) assessment RCSA framework and processes based on corporate policies as defined by selected NIST controls working with businesses and audit. Achieved 100% audit success across multiple years.

Partnered with businesses and Audit to ensure SOX, Basel, and GLBA compliance; led RCSA audits with onshore/offshore teams and matrixmanaged ~80 staff across US, EMEA, LATAM, APAC.

Performed annual cyber assessments to support global IT infrastructure. Focused on NIST 80053A, technical controls, CIS Controls, ISO controls including ISO 3100, ISO/IEC 27005, ISO 27001 ISMS, Network testing and isolation for PCIDSS, OWASP application security and software security.

EDUCATION

MS, Information Systems – CUNY Graduate School of Engineering & Computer Sciences

BS, Industrial Psychology – CUNY School of Arts & Sciences

Certifications - CISSP, PMP, ITIL v4

SELECTED ACHIEVEMENTS

100% Audit Success: Wells Fargo SIEM, Flight Centre DSS, Ensono DSS, SOC1, SOC2, JPMChase CSA, Citigroup global RCSA framework delivered flawless audit outcomes for over a decade.

Zero Audit Findings: Flight Centre Americas PCI DSS program eliminated compliance gaps across North America.

Cloud Security Leadership: Dell Federal programs ensured FedRAMP and CMMC compliance for federal cloud adoption.

Worked with Archer Integrated Risk Management and Archer Enterprise Governance, Risk and Compliance. Also worked with Archer eGRC development with vendor while at Citigroup that focused on operational risk management and regulatory compliance modules.

HANDSON SKILLS (some)

Annual Budget Management – $1MM-$10MM; Financial Resource Planning, Risk, Quality and Performance Metrics. Artificial Intelligence (AI): LLM Generative AI models, including: ChatGBT, Copilot, Claude; AI based network and endpoint, application, source code, and database scans. Threat intelligence. Certifications and hand-on: AZ500, PCI DSS RoC, ISA. CISSP, ITIL v4. Hands-on with CISA, CRISC, CIPP. Digital Workflows: ServiceNow, Agile Jira, Azure DevOps, Asana. eGRC: Archer IRM/eGRC, RiskVision, inhouse iCAPs. Operational Risk, Regulations & Standards: NIST 80053A rev5, SSAE 18 (SOC1), SOC2, COSO, COBIT, CMMC, CIS, ISO 3100, ISO/IEC 27005, ISO 27001 ISMS, ISO 27701 PIMS, PCIDSS, FedRAMP, FISMA; 23 NYCRR 500, FFIEC Handbook, FDICIA, DoddFrank, GDPR, CCPA, LGPD, PIPEDA, SOX 202/303/404, GLBA, SEC, HITRUST, HIPAA, 501(k), HL7. PO&AMS / continuous monitoring Privacy: Secure-by-Design approach. ROPA(Article30(1)), PBD, DPIA, Questionnaires; OneTrust; Cookiebot; Google Tag Manager; KnowBe4. CybeReady based Phishing Awareness Monitoring. ZeroFox Look-Alike Domain Monitoring; and HolisticCyber monitoring usage against licensing Productivity: MS Office (Word, Excel—pivot tables, VLOOKUP), Power Point, OneDrive, SharePoint, Teams, Zoom. Platforms: SQL, Oracle, UNIX, Linux, Windows. SWIFT, MERVA. Project and Program Management: Agile Frameworks: Scrum, Kanban, SAFe, Lean; Waterfall, Hybrid PM, SDLC; KPIs. Resiliency & Legal: Crisis mgmt., BCP/DR/COB/COOP runbooks; contract reviews (MSA, ICA, DPA, DTA); M&A. Security & Cloud: Azure, AWS, Ensono/DCS; PaaS/SaaS IAM & SSO (Azure AD, Okta, MFA, 2FA, SSO, Duo, SAML); DLP, RBAC; Trustwave; Qradar; SOC/SIEM. Software Security: IAM, Identity Access Mgmt, RBAC, SIEM, GitHub, GitLab. Secure Networking: Microsoft Defender. PIM, PAM, Azure AD, Azure Firewall. Soft Skills: Executive communication, board reporting, stakeholder alignment, training & awareness. Testing & Forensics: Pen testing & vulnerability mgmt.. (Kali Linux, Metasploit, Nmap, AppScan); static/dynamic testing for OWASP Top 10; digital forensics, MDF. Vulnerability Mgmt.: AI COPILOT SAST and DAST testing; code testing, application security configuration testing.

Contact this candidate