Providing security compliance, governance, and program improvement assessment consulting services that strengthens the information security practices and controls for a public defense organization.

Following the acquisition, joined the CISO and helped institute a global security center of excellence and three-year roadmap that integrated four legacy teams within seven facilities in two countries. Instituted risk and audit management program, conducting assessments that remediated data loss threats, strengthened product and technical controls, and improved security operations activities. Conducted acquisition security compliance readiness and business line maturity assessments. Liaised with customers on risk assessments, contract provisions, incidents, and control innovations. Participated in product and IT change management activities and security operations investigations. Partnered with development and architecture teams to ensure penetration test, cloud, code SAST/DAST, and network vulnerability remediations occurred to strengthen security defenses. Attained two new HITRUST Certifications and completed one inaugural SOC-2 with oversight and continuous assurance for five independent HITRUST Certifications and four SOC-2 audits. Performed monthly reviews to ensure HIPAA, IT General Control and NIST assessment readiness. Completed metrics and executive reporting; maintained BC/DR Plans and testing; led team of four.

Altruista Health was acquired by HealthEdge Dec. 2020Promoted following the successful achievement of HITRUST and instituting a positive risk-based security and privacy compliance culture and governance program throughout the U.S. and India within one year.Appointed and served as the designated security, data privacy and corporate compliance official. Matured control adoption, risk-based decision making, and organizational compliance culture. Performed risk assessments that identified cyber, IT, threat prevention, and network vulnerabilities. Instituted audit program that assessed controls, resulting in SDLC, IT and defense improvements. Led contract compliance program evolution, policy management, and continuous education program. Investigated internal, environment and endpoint threats and led incident management activities.

Strategized and implemented firm’s first enterprise-wide compliance program strategy, resulting in the formation of the company’s official security and privacy regulatory compliance and risk program. Designed data security safeguards, privacy processes, and corporate compliance governance. Partnered with infrastructure team on network defenses and change management processes. Implemented vendor program, performed assessments, and conducted business reviews. Conducted security tool RFPs, instituted business continuity testing; managed team of two.

Strategized, led a team of seven, and developed compliance, risk, governance, and audit programs and processes that safeguarded the data maintained within the FEP member enrollment system. Led or performed 18 SOC-1/SOC-2, IT General Controls, vendor, and recovery annual audits. Collaborated with InfoSec to institute cybersecurity controls, conducted systems control reviews based on NIST and CIS 20 standards and maintained data loss prevention processes. Amended access process, risk oversight, and SDLC reviews to mature governance controls.

Returned to lead original team and executed strategies that strengthened data breach safeguards. Performed risk mitigation activities, policy management, control reviews, and facility assessments. Assessed BCBS Plans and vendors to validate compliance risk and disaster recovery practices. Produced monthly education campaign, conducted RFP response risk analysis, led 20-person Plan advisory group, and performed security/disaster recovery prospective vendor site visits.

Joined the government relations team to help influence health IT, privacy, and security regulations.Performed analysis, wrote testimony, and developed responses on draft regulations and bills. Communicated with CMS, legislators, and industry groups to address concerns with standards.

Served as first program lead, developing strategies, programs, and processes that helped ensure privacy, security, and GLBA compliance among the FEP Director’s Office, BCBS Plans, and vendors. Advised BCBS Plans on privacy, security, and transactions/code set regulatory change activities. Communicated with executives and OPM on strategy, project status, budget, and risk resolution. Created annual BCBS privacy and security education conferences and led steering committees. Served on RFP and product review teams to ensure that federal contracting guidelines were met.

Joined the company HIPAA implementation war room, managing 25 privacy, security, and transactions/code set regulatory compliance implementations with a nine-person cross-functional project team. Oversaw risk analysis for health plan acquisitions to ensure security and privacy control readiness. Managed project activities and served as primary liaison for the successful achievement of URAC Privacy Accreditation.

Planned, implemented and managed national stakeholder, community and online awareness initiatives, including executing communications strategies for four business acquisitions, an IPO and 20 community and VIP events.