Karen C. Email & Phone Number

New York, Ny, Us

I am responsible for transforming the cyber governance and cyber risk management program, making sure our policies address emerging threats and technologies, and maturing our global security awareness and education program. I lead our global Business Information Security Officer (BISO) function which is critical to building strong, two-way relationships with the business focused on driving accountability and awareness, communicating threats and risks, promoting security best practices, and ensuring compliance with FIS policies and requirements. My responsibilities also include central patching, IT asset management, technology and software/SaaS governance, end-of-life, and leading a team of ~200 onshore and offshore resources. I also work closely with the CISO on strategic security initiatives and Board and executive reporting.

As an Advisor (CISO-in-Residence) with the Ballistic Ventures teams, I provide support to the founders of Ballistic's portfolio companies by sharing industry insights and a practitioner's point-of-view, providing feedback on product and marketing strategies, and making connections/bringing visibility to the portfolio companies. Any activity, opinion or post made in the capacity of the Advisor (CISO-in-Residence) role does not reflect the opinion of FIS, and does not constitute a personal endorsement.

Alpha Level is an AI powered solution that aims to detect and remove false positives in the SOC by up to 90%, reducing alert fatigue and noise, and allowing analysts to focus on the alerts and evidence that matter. Alpha Level is pre-seed.

New York

During my most recent role at EY, I served as a Principal and Information Security Executive, leading transformative information security initiatives that elevated the security posture of numerous multi-billion-dollar organizations. I collaborated closely with CISOs and security leaders to develop and enhance information security programs, focusing on strong foundational security capabilities that can scale and mature, as well as innovative solutions that address emerging threats. My expertise in evaluating risk, communicating impact, and securing investment approvals was instrumental in driving strategic initiatives, including but not limited to data protection, cloud, software and product security, automation, and Identity and Access Management (IAM). I transformed information security programs, elevating program maturity by >60% in 18 months, and established and ran a managed SOC, overseeing cyber threat intelligence, digital risk protection, threat hunting, detection, and incident response. I played a key role in establishing information security organizations at two spin-offs, defining organization structure, outlining capabilities, determining budget, and developing metrics.

I played a pivotal role in Ernst & Young's cybersecurity consulting practice, serving in various capacities from Staff to Senior Manager. I conducted numerous NIST-CSF and EY proprietary risk assessments for clients across industries, focusing on automotive, consumer products, manufacturing, media, advertising, health, and life sciences. My expertise also extended to delivering regulatory and compliance-based risk assessments (HIPAA, SOX, SOC 2, PCI, GDPR, CPRA), as well as industry framework readiness evaluations, such as ISO-27001. My contributions to talent development through on-campus and experienced hire recruiting highlighted my commitment to shaping the future of cybersecurity leadership. I also co-architected and developed EY’s Cyber Program Assessment (CPA) framework, a foundational tool for client risk assessments (>100/year), based on industry-standard security frameworks, directed a global Tiger Team in infrastructure and application recovery from a large, worldwide cybersecurity attack, and assessed and enhanced the third-party security program for one of the largest global food and beverage companies.

Master Of Science - Ms, Management Information Systems, General

Harvard Leadership Program, Purpose-Driven Leadership

Bachelor Of Science, Management In Information Systems