Dana Shannon Email & Phone Number

Phoenix, Az, Us

Atlanta, Ga, Us

• Responsible for all information security policies, standards, procedures, security training and risk management program• Planned, developed, implemented, maintained, and managed a cybersecurity risk management framework and security control framework based on industry best practices (including FAIR, NIST CSF/RMF, NIST 800-53, CIS, OWASP, ISO 31000, ISO 27001, and ISO 27005).• Defined and improved risk scoring methodologies and the internal and vendor security risk framework (FAIR, NIST CSF, OWASP, NIST RMF, ISO 31000, and ISO 27005).• Implemented GRC and Risk Management systems, maintaining the Security Risk Register, ensuring data quality, risk calculation, risk acceptance, tooling support, and process improvements.• Worked with Enterprise Risk Management to escalate risks to the enterprise risk register and report relevant metrics to senior leadership and the board.• Regularly collaborated with cross-functional teams such as engineering to implement security control baselines and with legal to ensure compliance with data privacy regulations such as GDPR.• Managed, developed, and implemented global corporate security policies, control standards, and procedures.• Anticipated policy issues related to emerging risks, such as Generative AI and AWS Cloud, and developed internal policies and controls.• Led ISO 27001, SOC 2, FFIEC, SOX, FEDRAMP, and client assurance audits to ensure compliance with industry-leading security frameworks and regulatory requirements.• Played a pivotal role in incident response planning and execution for SEC Materiality Item 1.05 8-K automation and reporting.• Conducted thorough vendor risk assessments to evaluate and enhance the security posture of external partners, and reviewed MSA/DPAs to ensure compliance.

Charlotte, North Carolina, Us

• Executed global IT risk assessments, compliance assessments, and IT consulting engagements.• Managed annual SOX-404 compliance over a global internal team of twelve members while maintaining effective interpersonal relationships with client staff, management, and external auditors.• Led team members in developing project plans, audit programs, evaluating system controls, and reviewing work while making recommendations to the client.• Served as the SAP subject matter expert auditor, conducting audits across aerospace, manufacturing, and technology sectors.• Developed a complex forecast tool for ICFR purposes and use of analytics to reduce the cost of audits while increasing risk coverage and value.• Prepared audit reports to document audit scope, procedures, findings, and recommendations, interpreting the significance of audit findings and making practical recommendations for remediation.• Worked with customers to implement system security measures, assists with cyber security plans and documentation and provides technical guidance and training.

St Petersburg, Florida, Us

• Led analysis of financial and IT data to assist other areas of the audit function, developing repeatable methods to ensure consistent results and building an internal knowledge base.• Designed and executed audit programs, operational process reviews, and reviews of system implementations, applications, and other IT-related risk areas.• Prepared audit reports to document audit scope, procedures, findings, and recommendations, interpreting the significance of audit findings and making practical recommendations for remediation.• Managed and performed individual risk and assurance projects as part of the overall audit plan, determining scope, developing audit programs, and coordinating activities and communication with clients and management.• Tested ITGCs and application controls for compliance with SOX regulations for various systems, including SAP GRC, SAP ECC, SAP MDG, SAP Healthcare, TM1, Workday, and Payroll applications.• Led the PwC task force for implementing Workday Financials targeting the manufacturing sector.• Planned and performed a discretionary Workday Post Implementation Review audit, as well as ITGCs and application controls for Workday.• Tracked issues with Key Risk Indicator (KRI) limits and risk appetite for Technology to ensure operational risks were managed within agreed thresholds, leveraging these metrics to detect significant or concerning rises in emerging problems and escalating concerns accordingly.• Implemented the operational risk framework to enable effective risk management and decision-making in the BU.

Gb

• Met with clients to identify and assess business process controls, risk, process gaps, and workflow inefficiencies • Built tests of details and controls for fixed asset, inventory, other asset additions, interest income/expense and dividends including understanding policies, auditing procedures, and evaluation of qualitative items• Executed SOX controls testing procedures testing for purchasing and payables for multinational conglomerate that specializes in research, development and manufacturing • Performed Risk Assurance ITGCs, key reports testing, code review testing including a combination of tests of controls and terminations testing for the internal audit • Analyzed financial statements to identify trends and anomalies in financial data while effectively resolved accounting issues.• Managed engagement financials by preparing budget-to-actual- analysis, forecasting accruals, and presented these results to the client on a monthly basis