Frank Lodestro Email & Phone Number

300 W 57Th St, New York, Ny 10019

The Director, Compliance Management is responsible for the development, implementation, and management of information security compliance processes and programs for the organization. This position will collaborate with cross-functional teams to ensure the organization and key business units comply with all applicable regulatory requirements, industry standards/frameworks, and best practices. A key member of the Governance, Risk, and Compliance (GRC) Team which focuses on driving business value and establishing an integrated program to ensure the overall effectiveness of capabilities that impact information security across business units globally. • Provide guidance and support to cross-functional teams to ensure compliance-related risks and issues are appropriately addressed, strategically managed, and remediated timely. • Provide strategic direction and guidance on regulatory and compliance matters, and keep the business up-to-date on changes to regulations, industry standards/frameworks, and best practices. • Perform gap assessments, audits and quality assurance checks on key business processes and new and existing technologies; collaborate with various business units, as needed, to ensure controls are adequate, appropriate, and effective. • Maintain the issues/findings tracker and risk register related to regulatory and compliance areas. • Work closely with Senior Management and global business leaders to prepare compliance reports, visual dashboards, and relevant metrics to drive Compliance. • Lead through an agile approach to help team effectively complete tasks timely, and provide feedback and coaching to professional develop staff

Greater New York City Area

As a Technology Risk Management subject matter expert with strong communication, collaborative and analytical skills, designed a successful proactive risk management program which created a substantial reduction in the number of overdue vulnerabilities. Represent multiple franchise critical messaging, payment, liquidity, trade, receivables, AML and OFAC applications in successful audits and ISO27001 certification reviews. Craft audit, regulatory (i.e. CHAPS), BRCC and high level assessment responses. Represent Application and Infrastructure applications on audit calls; review Cloud projects for control gaps. Ensure Cyber Scanning for Financial Messaging Global Payments, SWIFT CSP, Chaps, and OFAC applications; ensure annual SWIFT CSP Attestation Reviews. Create priority 1 incident Technology Framework mapping and control break tracking process and track action plans and risk rating updates.Complete OS, DB and File Permission Manual Access Reviews for UNIX, Linux, AIX, Oracle, MSQL and manage Records Management Inventory and controls. Identify control gaps, present to management, create exceptions, and ensure alignment with regulations. Ensure Technology controls are actively monitored and root cause and remediation are accurately reported.Key Accomplishments:● Designed successful proactive risk management program, which created a substantial reduction in number of overdue vulnerabilities● Achieved ISO27001 recertification (2018, 2021) by obtaining all of the evidence, reviewing responses, and addressing questions on audit calls; successfully passed two audits, working closely with external auditors ● Reduced coding vulnerabilities by 90% by implementing mandatory OWASP secure developer foundational code training; achieved 100% compliance by team required to complete training● Earned KPMG satisfactory ratings for SWIFT CSP five years in a row (2018—2022) as a key member; employed proactive evidence collection, monitoring, and repository location strategies

New York, Ny

Manage four Financial Crimes Technology projects on a monthly basis for Sanctions and OFAC applications with $4M in enhancements, including artificial intelligence upgrades and version updates. Manage 50+ applications, lead compliance, and compile metrics and decks for the Treasury business CEO and CIO. Provide high level assessments of risk from vulnerability management for data privacy. Monitor and follow up on security breaches, working with vendors to provide solutions. Lead daily Scrum meetings and bi-weekly sprint, backlog, retrospective, and release meetings to align team goals. Serve as key member in creating Quarterly High Level Assessment (HLA) documentation to access control effectiveness for seven information security domains. Key Accomplishments:● Built secure vulnerability program to assess vulnerabilities and data privacy; critical vulnerabilities have not been breached in 6+ months (a 100% reduction in number of critical and high breached vendor application vulnerabilities) ● Centralized scanning in the US, moving 26 European Sanction divisions to central location to provide cohesive support; led daily Scrum and planning calls; created roadmaps and GANT charts; led stakeholder preparation ● Reduced alerts by moving OFAC scanning machine learning rules to production● Boosted completed stories by 50% by creating PTOs and PTBs for software deployments and managing JIRA sprints

New York, New York, United States

Served as Global AML Monitoring SME for the Global Consumer Bank with strong communication and collaborative skills as well as a good understanding of the products and services provided by the business and strong analytical skills. Able to quickly develop an understanding of core GCB related policies and programs and identify current and emerging compliance and regulatory risks.Key Responsibilities and Accomplishments:● Designed and communicated quarterly Federal Reserve Board monitoring scenario metrics● Created global alert generation metric monitoring process● Created SharePoint site for Monitoring Risk Management workflow and metrics● Global AML MRM governance documentation and support ● Managed Records Management Inventory and controls● Identified control gaps, presented to management, and ensured alignment with regulations● Ensured issue management identification and remediation was accurately completed. ● Ensured Technology controls were actively monitored and root cause and remediation were accurately reported

Jersey City, New Jersey

Presented control and governance status to Sr. Management and directs regarding Information Security and any regulatory control issues. Designed risk mitigation and enhancement opportunities. Responsible for tracking and advising Audit issues for the Trade Treasury Solutions and Securities and Funds Services Businesses. Advised Senior Management on any Control and Security Standard implementation issues and proposed solutions. Key Responsibilities and Accomplishments:● Enhanced the Risk, Control and Security programs● Developed and facilitated the Personally Identifiable Information governance and requirements.● Governed the migration of the Global Security Framework. ● Managed production access control, which lead to significant reductions in access● Created Tivoli Alert email Access data mining process enhanced reporting● Developed and facilitated the Source Code Entitlement Reviews for 15 applications● Designed and implemented the Architecture Design Review SharePoint Site for request/issues workflow● Liaised and led governance for Audit, Compliance, Security and Data Privacy initiatives as well as source and Change Control best practices and training ● Successfully implemented the Architecture Design Review process, which has a 20% reduction in the number of required reviews. The process elevated the design maturity level by incorporating shared components from the Architecture and the Service Delivery teams; it established a consistent end to end solution for handling Design Review● Served as a key member of the Release team, which had a significant reduction in outages implemented by releases

Long Island City, Ny

Key Responsibilities and Accomplishments:● Advised Control Managers and Information Security Officers of control design issues and presented solutions for risk mitigation and enhancement; responsible for tracking and advising Security and Audit issues for the Smith Barney and the Client Private Bank businesses. ● Advised Senior Management on Sarbanes Oxley and Security Standards implementation issues and proposed solutions● Represented CCU Compliance in internal/external technology audits● Designed and implemented technology risk-testing procedures● Designed corrective action plan scorecard for senior management tracking● Designed and implemented technology risk control testing program for Windows applications● Designed and implemented unauthorized software process● Designed and implemented manual entitlement process; migrated access information into entitlement system● As Security Officer, conducted secure workspace reviews● Served as Sarbanes Oxley Coordinator/Sarbanes Oxley Steering Committee Member, Export Licensing Coordinator (reported and managed application updates), and Key Member of One-Citi streamlining effort; creatively designed production workarounds to ensure smooth implementation● Key Member of Business Requirements Direct Committee for control testing and corrective action applications● Performed and reviewed MIFT and AML testing for Preferred Custody and CAI ● Designed corrective action plan scorecard for senior management tracking● Key member of risk testing consolidation, and reduction initiative, which achieved major reduction in self-assessment testing● Designed and implemented banking risk-testing procedures● Designed efficiencies and tested the CAI Multi-Advisor Hedge Fund Portfolios LLC controls (Investment Co. Act 1940 and Securities Exchange act of 1934)● Key Member in the Catalyst and ICAPS UAT project; managed and organized Catalyst and ICAPS UAT completion for management presentation and signoff

111 Wall Street

Represented CMBIS business for internal/external operations audits, including SAS70 contractual matters. Duties included: managing and supporting compliance self-assessment reviews, risk mitigation, and outage reduction initiatives to design more efficient business processes; improving security controls and report automation for UNIX and Microsoft servers; overseeing development of security configuration; monitoring processes; providing information security support to systems administrators and developers.Key Accomplishments:● Managed North America SSH Key Encryption Administrators, which consisted of designing and implementing key administration for the North America open system platforms● Project Leader of the NA UNIX Security Key Management Major Business issue downgrade initiative● Designed and implemented Infrastructure Risk Analysis and Audit Programs for UNIX and Wintel● Created Global UNIX Entitlement review data feed process● Performed outage analysis and design of corrective controls● Designed SSH Key Access control violation reporting process● Key Member of Major Business Security Issue/Senior Management Task Force that culminated in a reduction of corporate risks; negotiated cross business risks and information security issues with Global Information security officers and presented unresolved issues to senior management stakeholders● Main Architect of open systems; change management, information security and entitlement processes

Mis, Information Systems

Associate Of Arts And Sciences (A.A.S.), Legal Assistant/Paralegal

Bachelor Of Applied Science (Basc), Criminal Justice/Police Science