Andrew Sirkin Email & Phone Number

New York, United States

• Certified the firm from scratch in ISO 27001, 27701, & 22301.• Prepared and managed audits, compliance assessments, and security due diligence questionnaires.• Developed and implemented policies, procedures, and standards to ensure compliance with industry regulations and legal requirements.• Ensured a mature vendor management program, including selection criteria based on risk factors.• Managed the firm’s Data classification and Data Loss Prevention programs to protect confidential and privileged information and safeguard against unauthorized access, modification, destruction, and disclosure.• Assisted in the review of security requirements in outside counsel guidelines and vendor contracts.• Collaborated with cross-functional teams to establish and maintain effective Governance, Risk, and Compliance processes and practices.• Conducted risk assessments to identify vulnerabilities and potential security threats.• Monitored and assessed security controls to mitigate risks and enhance data protection.• Participated in incident response and security incident investigations as required.• Ensured compliance with backup, logging, patching, anti-virus, audit, and technical remediation activities.• Identified opportunities, through policy-driven security practices, the Principle of Least Privilege (PoLP), Role Based Access Controls (RBAC) for applications, infrastructure, and business/practice groups to prevent excessive permissions and rights to the firm’s IT environment.• Managed security awareness activities to ensure training was completed in accordance with firm requirements.• Stayed up to date with relevant laws and regulations, ensuring the firm's adherence to compliance requirements.• Kept abreast of emerging trends and technologies in information security and GRC.• Acted as a subject matter expert in GRC matters, offering training and support to colleagues as needed.• Provided guidance and recommendations to management on security best practices.

New York, New York, United States

• Planned, developed, implemented, and supported the company's security, governance, risk, and IT security compliance initiatives, including ISO 27001 and ISO 22301 certifications.• Advised Firm management and assisted in the design and development of new systems, applications, and solutions for enterprise-wide information and security compliance, including operations, system analysis, system design, system hardening, vulnerability scanning, incident response, disaster recovery, and business continuity planning.• Created a mature vendor management program, taking the old practice of using an Excel-based questionnaire and evolving it into a ranked form, including selection criteria based on risk factors.• Created the firm’s DLP program, merging systems into a mature and comprehensive environment.• Developed and executed plans for compliance and mitigation of risk, including policies and procedures, insider and third-party risk, risk-based audits, and internal controls.• Ensured compliance with backup, logging, patching, antivirus, audit, and remediation activities.• Assisted in evaluating, planning, configuration, and implementation of new/existing compliance applications/tools that helped ensure compliance with Firm policies and procedures.• Identified and recommended potential areas where existing data security policies and procedures required change to enhance security policies and procedures.• Developed monitoring and visibility systems for security incidents and vulnerabilities.• Identified opportunities through policy-driven security practices, the Principle of Least Privilege (PoLP), Role-Based Access Controls (RBAC) for applications, infrastructure, and business/practice groups to prevent excessive permissions and rights to the firm’s IT environment.

Greater New York City Area

• Earned the firm an ISO-27001:2013 certification and was responsible for developing and implementing processes to meet audit criteria.• Discovered and fixed security problems in existing operational procedures using current security frameworks and risk management methodologies. Based on these procedures, created new documentation and processes for various departments, and monitored for compliance.• Implemented a more comprehensive patch management program for servers, increasing firm's BitSight and Security Scorecard ratings by hundreds of points.• Used vulnerability scanners and pen testing along with in-depth reporting tools to discover and repair weaknesses in assets, including implementing a full patch cycle for servers.• Implemented a SEIM solution and deep monitoring of data to ensure against attacks, and was the first responder to a number of security incidents.• Subject Matter Expert (SME) in multiple information security programs and domains.• Organized and conducted the testing and rollout of DUO as a 2FA replacement for RSA.• Built and maintained a security training program for all employees, including practical training for lawyers and other admin staff, such as phishing testing, security awareness, DLP, and privacy.• Provided IT staff with security training via tabletop and live-fire incidents, and generated reports.• Worked closely with colleagues and management to reduce the budget for both security and IT.• Regularly contributed to the LS-ISAO (Legal Services Information Sharing and Analysis Organization), including weekly analyst calls to discuss trends and threats within the industry.