Carlo P. Casagrande, Cissp, Cism, Crisc, Cisa, Cdpse Email & Phone Number

St. Petersburg, Florida, Us

● Administer, review and update firm-wide information security practices, including IT general controls, CIS controls, and IT, privacy and cybersecurity standards and procedures● Support the IT organization through identification of gaps in the control framework and recommendation of mitigating controls● Create testing program for key controls to mitigate redundant efforts and audit impact on resources● Maintain list of key IT controls to ensure compliance with regulatory requirements, such as SOX and PCI.DSS, and enforce management accountability● Liaise with internal and external auditors to ensure reliability and accuracy of information sharing for SOX, SOC1 and FICCA audits related to IT and InfoSec controls● Review and approve exception requests for deviations to IT security policies● Coordinate with Business Information Security Leads to explore solutions and alternate options to security policy violations● Collaborate with Identity Access Management (IAM) personnel to approve atypical access requests and prevent security violations● Coordinate with cyber security and vulnerability management teams to ensure application patches and updates are applied to remedy vulnerabilities● Track and mitigate issues related to key IT controls, related deficiencies and ensure accountability and effectiveness of management response actions to address control weaknesses● Aggregate significant IT control risks or compliance issues to the for reporting to the CISO, Enterprise IT Risk, ERM and ORM boards

New York, Ny, Us

● Performed and directs operational, compliance and IT risk assessments, including mitigation strategies● Worked independently and with teams to manage projects and provide timely milestones and reporting● Created new risk assessment procedures and reports and led execution of these assessments ● Provided IT best practices recommendations and works closely with technology teams through design, testing and and implementation phases to validate technology and process updates● Reviewed policies and procedures to ensure a confidentiality, integrity and availability of systems ● Analyzed vendor risks related to acquisition of a digital technology company and communicate findings ● Created web pages used to test digital ad transactions, utilizing Wireshark and Charles to certify accurate logging of GET requests and demographic information collected by JavaScript ad tags● Provided control enhancement guidance for incident handling and data quality assurance procedures● Advised Engineering on proper handling of blacklist filtration of robotic and malware traffic data● Worked directly with executive leaders and process owners among Engineering, Data Science and Tech Strategy teams to consult on closing control gaps and roadmapping technology updates ● As Invalid Traffic Compliance Leader, ensures a control environment is in place to safeguard assets

London, Gb

● Led project teams in reviewing change management/SDLC processes (Agile and Waterfall), identity and access management, business continuity and incident handling using a risk-based approach● Managed six to eight engagement teams simultaneously over a book business of 1-2 million USD, from audit planning and execution through presentation of audit reports to clients● Audited media ratings clients on the effectiveness of IT controls and provided SOC2+ reports around compliance with the AICPA Trust Services Principles for Security and Processing Integrity● Provided formal counseling relationship to two individuals, including training, goal setting, mentoring, preparing and presenting annual reviews for the Southeast Advisory round tables● Promoted to senior, then manager during tenure at EY

Us

● Cross-trained in application of Sales and Use Tax and Unemployment Compensation taxation● Directly managed relationships with taxpayers and representatives from CPAs to CEOs● Supervised and trained new staff, including education and field audit direction● Promoted to Tax Auditor III after one year of service

Jersey City, Nj, Us

● Performed operational audits for business units providing trillions of dollars in security transaction settlement and asset services● Mitigated risks by executing risk control assessments, evaluation of internal controls effectiveness, development of audit plans, testing and reporting ● Promoted to Internal Auditor II

Fort Lauderdale, Fl, Us

● Supervised and trained tellers and representatives● Prepared SARs and CTRs in compliance with BSA/AML regulations● Performed audits of internal controls and cash reconciliations for the retail bank location● Promoted to specialist after cross-training as teller and sales representative