Fred Nunley Email & Phone Number

San Diego, California, United States

Baltimore, Maryland, United States

Serving as an independent consultant, providing IT consulting and cybersecurity services to client organizations that align with organization policy and industry leading practices. Specific activities include:- IT Risk Management - Assessing the first line risk appetite and current management of IT policies, practices, and frameworks to identify and prioritize uplift against an ideal target state.- IT Application Security - Reviewing and evaluating source code, SQL scripts, algorithms, and formulas for transforming, extracting, and loading relevant source data and creating reports to test the completeness and accuracy of Information Produced by Entity (IPE) and Information Used in the Control (IUC).- Incident Management - Developing and managing phishing campaigns with serial clicking and reporting metrics to better gauge phishing resilience and identify areas of concern.

Served as the Senior IT Audit Manager and Lead IT Specialist responsible for selling, managing, and delivering technology assurance services across Deloitte’s Financial Services practice. Specific activities included:- AICPA and PCAOB Integrated and Non-Integrated Audits - Evaluated the design and operating effectiveness of IT General, Application, IT-Dependent Manual, and Manual Business Process controls and performed ‘test of one(s)’ (where applicable) to assess critical processes within the systems.- SOC1 and SOC2 Audits - Reported on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design and operating effectiveness of the IT general, automated, IT-dependent, and manual process controls to achieve the related control objectives included in the description throughout a specified period.- IT GRC - Provided independent oversight, assessment, and effective challenge of first line of defense cybersecurity and technology activities, risks and controls to ensure accountability and support better enterprise security. - Cyber Threat Analysis - Performed automated vulnerability scans over identified open ports on live hosts that tested the organization’s network security controls and penetration testing over any exploitable vulnerabilities that simulated real-life attacks to highlight cybersecurity exposures.- Risk Control Self-Assessment - Facilitated RCSA workshops with client management to lead the auditees in assessing their environment by providing insight about the objectives of controls based on risk assessment.- PCI-DSS Compliance - Implemented strategies for network segmentation and reduced attack surface across the Cardholder Data Environment (CDE) via PCI-compliant firewalls and demilitarized zones (DMZ) to minimize security and compliance risks associated with a breach of the confidentiality, integrity, or availability of critical data.

Served as the Director responsible for driving risk advisory and IT consulting services across KPMG’s Financial Services Market. Led account planning, strategic capture, proposal development, talent management, and client delivery for a Large Multi-Dollar Loan Making Organization client. Specific activities included:- SOX Internal Controls over Financial Reporting (ICFR) – Performed a risk-based SOX 404 assessment and evaluation over ICFR for the following key Loan Guarantee business processes: Eligibility and Application, Approval Process, Loan Servicing, Monitoring and Reporting.- Cybersecurity Threat Management – Implemented a common cyber threat framework to support the compilation of threat data in common terms and categories, and the presentation of content in a consistent and repeatable manner.- Information Technology General Controls (ITGCs) - Recommended changes to security controls, security control baselines, assignment values, associated implementation guidance, and assessment procedures to the CIO.

Served as the Senior Manager responsible for driving Risk Advisory Services across EY’s Real Estate Finance practice. Led account planning, strategic capture, proposal development, talent management, and client delivery for the Real Estate Finance - Housing accounts. Specific activities included: - SOX Internal Controls over Financial Reporting (ICFR) - Performed a risk-based SOX 404 assessment and evaluation over ICFR for key business processes.- Enterprise Risk Management (ERM) - Implemented a COSO-based ERM framework that incorporated all major risk types i.e., economic, operational, legal, compliance, strategic, reputational, and programmatic risks and utilized common risk vocabulary, categories and definitions, key risk indicators (KRIs), trending reports and other means of risk monitoring.- Corporate Governance - Developed corporate-wide procedures for risk management to ensure organizational compliance with internal, external, and industry standards using the Institute for Internal Auditors (IIA) and the Neel Corporate Governance Center’s Guiding Principles of Corporate Governances.- IT Audit Readiness – Created a continuous monitoring program using NIST standards for reporting on the organization’s progress towards achievement of key IT metrics such as the common security configuration baseline for each hardware asset and mobile device, the type of cloud services used and the vendor for each, the number and percent of privileged and unprivileged users with network accounts, and the number of systems that encrypt sensitive data while at rest.

Mclean Va

Served as MFC’s Senior Manager responsible for driving risk management, performance improvement, and technology enablement services within MFC’s Risk and Compliance Solutions Financial Services Offering. Managed marketing, full life-cycle business development, teaming partner negotiation, subcontractor management, talent acquisition, and cross-functional/team staff development for the strategic capture/execution of business opportunities in the public and private sector. Specific activities included:- Internal Controls over Operations (ICOOP) – Performed a macro-level analysis to assess the entity and transaction level controls for design and operating effectiveness and rationalized unnecessary, insignificant, and redundant controls (i.e. controls over inconsequential general ledger codes, controls over insignificant business processes/transactions, controls addressing out-of-scope objectives) and leveraged “power controls” to mitigate multiple risks. - Enterprise Risk Management - Developed combined risk registers and risk profiles for all risks by functional area i.e. financial, strategic, operational, compliance, and economic. - Information Technology General Controls (ITGC) - Performed ITGC testing over access security, change management, and network operations in compliance with NIST SP 800-53, revision 4 guidance and recommended Corrective Action Plan (CAPs) development based on identified control failures.

Mclean Va

Served as the Project Manager and key conduit for strategic, business, and program-related information to multiple staff members within the Booz Allen Economic and Risk Analytics Community. Led project teams on a sustained basis for a variety of assignments within the Financial Services Sector. Specific client services included the following: Full Scope SOX/A-123 ICFR Assessments; Segregation of Duties (SOD) Analyses; Vulnerability Assessments; Penetration Testing; and Business Process Reengineering.

M.B.A. And M.S. Finance

Bachelor'S Of Science, Business Administration