Andrew Stravitz Email & Phone Number

Allendale, New Jersey, Us

I'm excited to announce the launch of "Touchpoint Cyber LLC." I've been fortunate to launch an IT Risk and Cybersecurity consulting practice. My first client is located in Connecticut, and is a prestigious "Asset Management Firm / Hedge Fund." I've been helping with their SOC1 preparation, risk assessments and security program development. I'm available to help with all your cybersecurity needs, with over 20 years of experience building programs in e-commerce, financial services and utility sector. I've been working as a fractional (virtual) CISO. I'm available to assist with complex IT Cybersecurity project(s) which require business alignment, complex integration and ownership, assist with regulatory compliance issues (SOC1 or SOC2, PCI Compliance, etc.), internal and external audits, and review and document your security stack, security strategy, awareness training, metrics, product evaluation and selection, policies, standards, procedures, tabletop exercises, etc. With a masters in accounting and budget responsibilities for over a decade, I have assisted my existing client(s) negotiate hundreds of thousands in savings; resulting in stronger programs for lower costs. You can set up a consultation on my calendar:https://touchpointcyber.com/ and select "Schedule a Consultation"

Boston, Ma, Us

• Veolia fully acquired SUEZ in Q2 2022 forming the largest water utility worldwide• Promoted to Sr. Director to focus supporting on the Municipal Water Business Unit post-merger• Responsible for GRC program development, vendor risk management (VRM), RFP new business generation, critical infrastructure framework (OT, ICS, SCADA) and training development• Architected Nozomi SCADA security solution to provide OT/IoT near real-time inventory, vulnerability management, alerting and risk prioritization based on Perdue Model mapping to ISA/IEC 62443 • Lead the effort to produce both SOC1 and SOC2 reports to support regulated utility BU

Paris, Ile De France, Fr

• Part of the Global Cybersecurity Strategy team developing roadmap and executing vision• Developed NIST Policy framework and governance risk and compliance program (GRC)• Responsible for overseeing all aspects of regulatory framework, and securing critical SCADA infrastructure, rollout of IPS/IDS, MSSP, incident response procedures, and security architecture• Implementing IT-GRC program based on NIST and ISO27001 security frameworks• Rolled out next generation end-point security (EDR) in both corporate and SCADA networks • Building and mentoring a highly effective cybersecurity team, rolled out centralized SOC, firewall audit tools, and set up comprehensive vulnerability management system (Rapid7 Certified)• Responsible for Tabletop Simulation Exercises and Security Awareness program• Deployed global shared services with local cyber tools to protect information assets via CrowdStrike, Varonis, Zscaler, Cisco Firepower, Fortinet, Imperva, Splunk and Nozomi

Frankfurt Am Main, Hessen, De

• Lead the NYS-DFS 500 interpretation, resource planning, project management • Completed the responses of the FFIEC Cybersecurity Maturity Assessment Tool• Handled audit and regulatory responses

New York, Ny, Us

• Transformed the information security program by assessing, identifying and creating an information security roadmap and multi-year projected budget. • Coordinated the annual Disaster Recover and Business Contingency Planning test(s). • Mapped the internal control structure against the newly established FFIEC / FSSCC Cybersecurity Assessment Tool (494 mapped controls) to determine the maturity level of the bank. • Created and presented the InfoSec Dashboard to the Board of Directors, providing relevant metrics on the state of the InfoSec program. Co-chair of the IT/IS Steering Committee. • Resolved numerous preexisting audit, compliance and regulatory issues (GLBA) by formulating response plan, tracking documentation, and executing remediation plans. • Improved the resiliency of the network perimeter, implementing APT detection strategy and preventive controls on end-points, designed new NAC strategy with 802.1x Radius integration, VPN redesign, privileged account management and enhanced computer forensic capabilities. • Redesigned the vulnerability management program to prioritize remediation based on risk. • Implemented a new MSSP program to provide centralized 24/7/365 security monitoring. • Responsible for the Bank’s physical security, including upgrade path for cardkey and camera systems

New York, Ny, Us

• Created, architected, and engineered the security road map, which aligned the information security initiatives to focus on high-risk areas• Managed Information Security Special Projects, reporting directly to CISO• Realigned the Web Application Firewall (WAF) strategy; RFI, RFP and global implementation • Assumed responsibility for policies, standards, procedures, and guidelines• Lead effort to combat advanced persistent threats (APT’s)• Authored a series of strategy documents including cloud security directive, database security, highly confidential initiatives, legal and regulatory compliance, and MSSP project• Information Security Officer responsible for supporting all information security functions related to the Global Corporate Solutions business unit

New York, Us

Dedicated and proven leader who championed a highly effective information security program for 8 years at B&N.com; thwarting numerous attempted external threats.• Oversee all security related audits and regulatory activity, including Sarbanes Oxley, PCI DSS, etc.• Responsible for all aspects of the Information Security Program based on ISO 17799 framework• Incorporated secure development lifecycle working with developers and defect management • Developed the credit card encryption methodology used universally across all business lines• Manage and supervise IT security staff and consultants – including “NOOK” independent review• Evaluate application security based on OWASP and WASC standards via vulnerability scanning• Certified application security tester using HP WebInspect DAST scanning tool• Created an Employee Security Awareness Training Program to educate all employees• Perform due diligence and act as an advocate for all customer privacy & security concerns• Design the application security schemata based on using public encryption algorithms to protect database and password information. Designed P3P site policy• Provide litigation and forensic support for the legal department• Implemented various security gateway devices and email firewalls to improve efficiencies

Amsterdam, North Holland, Nl

• Developed Strategy as part of core team in Global Office of the CISO• International assignment, lead a variety of security audits based on BS7799• Performed Risk Assessments against industry best practices, ISO17799, OCTAVE (CERT)• Assessed information systems for vulnerabilities using third-party tools (GFI, NetIQ, etc.)

Tel Aviv, Il

• Developed a new US based internet startup from seed money from parent company, as part of the CEO’s immediate executive team• Responsible for all aspects of the project development• Authored IT banking policies and procedures for the business plan and approved by the OCC• Designed web front-end to the legacy Alltel Systematics • Fortified the Banks perimeter building out security stack and high availability infrastructure • Managed a 5-million-dollar budget

Amsterdam, North Holland, Nl

• Authored and reviewed Policies and Procedures, including: TCP/IP Policy, Antivirus Policy, Firewall Policy, SWIFT procedures, Laptop Policy, Internet Usage Policy, and Security Awareness Program.• Lead project manager of team that secured company laptops world-wide. Implemented the PKI backbone with ODBC replication in New York, London, Hong Kong & Amsterdam offices.• Lectured to new and existing employees as part of a security awareness training initiative.• Assisted in the Y2K implementation of the SWIFT Alliance Application (UNIX Platform) from ST400 (Dec Vax).

Zurich, Zürich, Ch

• Responded to security related outstanding audit points and implemented solutions.• Implemented the first Internet connection at the NY Branch providing secure web and email access. • Network Administration for the following products: Windows NT, MS Exchange Server, Guardian Firewall, Little Brother (Proxy Filter), McAfee Antivirus, PGP Encryption, DHCP, WINS and MS Proxy Server. • Administrated Open VMS (VAX/VMS V.71) on the VAX; and OS/400 on the AS/400. • Administered various financial systems in the bank including: SWIFT(VMS), Wall Street System (DEC/VAX), Maxdata (UNIX), EBS, Windows NT, Novell, Exchange Server, Firewall, Proxy Server, and Midas (AS/400).• Generated and reviewed daily logs on various Bank systems (e.g. PS Audit logs on AS/400) . • Centralized the administration the AS/400 using PentaSafe products, based on C-2 level security and IBM standards. Completed the core requirements for AS/400 System Administration at an IBM facility.• Developed the first security awareness training program working with human resources.

Montreal, Qc, Ca

• Performed security reviews with end users & created firm security policy, including Windows NT.• Supervised a staff of six employees that supported the correspondent clearing business.• Implemented system security in a multi-platform environment, including Windows NT, Apple Talk, AS/400, Mainframe & Encryption.• Investigated legal issues using forensic computer techniques, restored Novell and NT servers using Arc serve and other specialized software. • Developed, designed and tested new and existing mainframe applications for strong security controls.• Administered Top Secret Security in a MVS / CICS environment.• Promoted from Manager to VP, employment check: evs.jpmorganchase.com

Master Of Science - Ms, Accounting

Bachelor Of Science - Bs, Psychology Minor: Computer Science, Economics