Bernard E. Mboe Email & Phone Number

United States

Lead role in continuous development, monitoring and ensuring Zillow compliance to ISO27001, NISTCSF, GLBA, NIST 800-53 and a supporting role on PCIDSS, NACHA and Privacy compliancemaintenance.• Point person for internal reviews, gap analysis and updating of internal policies, standard and procedureper changes in regulatory requirement and internal operational changes.• Facilitated the alignment of organizational policies and controls with ISO27001, NIST CSF, GLBA,NIST 800-53, ISO 27001, frameworks and standards, and SOC 2 audit requirements.• Carry out quarterly gap analysis efforts by identifying non-compliance issues, crafting corrective actionsplans, and work with subject matter expert (SME) and stakeholders to remediate gaps while trackingprogress in a risk register, fostering a culture of security and compliance across the organization.• Developed and implemented risk management plans in accordance with NIST and ISO 27001guidelines.• Monitored risk factors and provided detailed reports, actionable insights, and recommendations to seniormanagement.• Zillow SME in risk assessments, crafting risk factors, identifying, triaging, assessing, andprioritising risks, and documenting findings in the risk register.• Active role in internal organization’s audit initiatives, ensuring compliance with internal and externalregulatory requirements, in preparation of ISO27001, NIST CSF, GLBA, NIST 800-53, PCIDSS,NACHA, SOC2 and Privacy external audit.• Organize annual training sessions, quarterly phishing campaign trainings to educate staff on compliance standards, and general cybersecurity best practices leveraging NIST 800-53, OWASP updates &New compliance• Advised management and team members on technology-related risks, improving security posturethrough strategic implementation,• Carry out monthly vulnerability scan in accordance with Zillow Information security policy• Coordinated with internal and external teams to address threats and risks

United States

Residence GRC SME, developed PureFinace compliance program from the ground up, developinginternal cybersecurity security policies and procedure, control library creation (leveraging NIST 800-53), asset triage and implementation of controls on in-scope assets.• Ensure alignment of cybersecurity practices with business objectives and regulatory requirements• Assist in the creation and management of the cybersecurity governance framework• Conduct risk assessments on third parties to identify and evaluate potential cybersecurity risks• Develop and implement risk mitigation strategies and controls• Monitor and report on risk management activities and the effectiveness of controls• Continuously Monitored a wide range of enterprise applications for abnormal or suspicious activities,responded to alerts by contacting the system/asset owners, and scheduled follow-up meetings todocumentation, investigation, containment, and remediation plans, escalating issues if necessary.• Created, updated, and reviewed general security documentation, including Standard OperatingProcedures (SOPs), Business Impact Analyses (BIAs), Incident Response Plans (IRPs), and DisasterRecovery Plans (DRPs).• Performed real-time cyber defence incident handling, including artifact collection, intrusion correlation,tracking, threat analysis, and containment, which supported the Cyber Incident Response Team(CIRT).• Reviewed and documented log files from engineering analyses, such as individual host logs, networktraffic logs, firewall logs, and intrusion detection system (IDS) logs, to identify potential threats tonetwork security.• Engaged and participated in team projects, including building processes and procedures for documenting work in the form of SOPs, supporting problem resolution, and identifying process improvements.• Use SIEM tools such as Splunk and EDR tools to enhance monitoring by generating logs andevents, which were interpreted by engineers to perform monitoring duties

United States

• Utilized Nessus and Qualys to conduct routine vulnerability assessments, identifying security flaws in thecompany's IT infrastructure.• Examined and assessed data management, information security, and IT control frameworks to pinpointweaknesses and potential threats.• Collaborated with cybersecurity engineers to troubleshoot performance and connectivity issues related tonetwork scanning and security assessment tools.• Generated reports, analysed scan results, and provided technical guidance to engineering teams on the impactof security issues. Initiated remediation efforts to resolve identified vulnerabilities, documented exceptions, andaddressed false positives.• Conducted risk analyses to prioritize vulnerability management, assessing risks associated with detectedvulnerabilities based on exploit likelihood, impact, and exposure. Documented strategies for mitigating risks toenhance overall IT security posture.• Tested networks, applications, and IT systems to uncover vulnerabilities and recommended necessary fixes.• Supported compliance activities by ensuring vulnerability management procedures aligned with relevant laws,regulations, and standards such as ISO 27001, HIPAA, and PCI-DSS.• Collaborated with IT teams to ensure timely application of security patches and upgrades, minimizing the riskof exploitation. Maintained comprehensive documentation of security events, remediation efforts, andvulnerability findings.• Conducted studies on emerging risks and vulnerabilities, keeping the team updated weekly on cybersecuritydevelopments.• Monitored progress of vulnerability remediation activities, ensuring prompt resolution and adherence tosecurity policies.• Assisted in reviewing and updating documentation for the organization in preparation for external audits,supporting compliance audits including SOC 2, CIS, and PII, and ensuring alignment with internal policies.Followed up with engineers on remediation plans based on identified findings.