Andrew Sirkin Email & Phone Number

New York, United States

• Certified the firm from scratch in ISO 27001, 27701, & 22301.
• Prepared and managed audits, compliance assessments, and security due diligence questionnaires.
• Developed and implemented policies, procedures, and standards to ensure compliance with industry regulations and legal requirements.
• Ensured a mature vendor management program, including selection criteria based on risk factors.
• Managed the firm’s Data classification and Data Loss Prevention programs to protect confidential and privileged information and safeguard against unauthorized access, modification, destruction, and disclosure.
• Assisted in the review of security requirements in outside counsel guidelines and vendor contracts.

New York, New York, United States

• Planned, developed, implemented, and supported the company's security, governance, risk, and IT security compliance initiatives, including ISO 27001 and ISO 22301 certifications.
• Advised Firm management and assisted in the design and development of new systems, applications, and solutions for enterprise-wide information and security compliance, including operations, system analysis, system.
• Created a mature vendor management program, taking the old practice of using an Excel-based questionnaire and evolving it into a ranked form, including selection criteria based on risk factors.
• Created the firm’s DLP program, merging systems into a mature and comprehensive environment.
• Developed and executed plans for compliance and mitigation of risk, including policies and procedures, insider and third-party risk, risk-based audits, and internal controls.
• Ensured compliance with backup, logging, patching, antivirus, audit, and remediation activities.

Greater New York City Area

• Earned the firm an ISO-27001:2013 certification and was responsible for developing and implementing processes to meet audit criteria.
• Discovered and fixed security problems in existing operational procedures using current security frameworks and risk management methodologies. Based on these procedures, created new documentation and processes for.
• Implemented a more comprehensive patch management program for servers, increasing firm's BitSight and Security Scorecard ratings by hundreds of points.
• Used vulnerability scanners and pen testing along with in-depth reporting tools to discover and repair weaknesses in assets, including implementing a full patch cycle for servers.
• Implemented a SEIM solution and deep monitoring of data to ensure against attacks, and was the first responder to a number of security incidents.
• Subject Matter Expert (SME) in multiple information security programs and domains.