Gavin Duffy Email & Phone Number

Pleasanton, California, Us

Pleasanton, California, Us

Pleasanton, California, Us

Currently leading Workday's Operational Technology Security function, providing strategic, tactical and operational support for IT applications and services that are security focused. This includes critical security services such as Email Gateway Security & Authentication; Enterprise Data Loss Prevention; Insider Threat Management; Privileged Access Management; and Multi-factor Authentication.

Pleasanton, California, Us

Responsible for managing and maturing the Data Protection and Security Incident teams, respective programs and procedures at Workday. • Defining strategic and tactical objectives for both programs and respective the teams, course correcting where appropriate to make improvements in process.• Establishing revised and consistent governance of both programs, including procedure reviews, metric definitions and cadences, auditing and compliance, training and development.• Getting buy-in from various stakeholders and upper management when changes are warranted in the programs.• Ensuring all IM & DLP remediation activities are conducted post-investigation (e.g. policy updates, patching, etc.).• Identifying and triaging sensitive information security events and alerts with the appropriate procedural urgency.• Leading internal/external audit interviews and working sessions.• Acting as an escalation point for the DLP and Incident Management analysts.• Translating business requirements into practical solutions.• Gathering critical data, analysing and drafting reports, including department, project, key indicators, OKRs and dashboards.• Acting as the primary contact for DLP/Security Incident events escalations.• Develop excellent working relationships with peers and key stakeholders such as business partners, legal, privacy, internal audit, risk, and technology specialists.• Working with the Security Training & Awareness team to help employees and contractors understand their role in safeguarding information.• Recognize opportunities for improvement in areas of responsibility and either take initiative to implement changes or clearly communicate their findings, suggested solutions, and other relevant information to management. • Devising a practical process, via document register, to ensure information security incident contacts, DLP stakeholders and runbooks are kept up to date at all times.

Pleasanton, California, Us

Security Awareness and TrainingResponsible for the implementation of several cross functional key initiatives (with C-level visibility) contributing to our security maturity. These included launching a global security advocates network, developing a security metrics framework, and consistently delivering innovative and engaging security awareness initiatives.Highlights: • Workday Beacons "A positive force, unique to Workday, shining a light on information security."The primary objective of Workday Beacons program was put in a place a long-term structure that would support a positive and proactive security culture, throughout the business, where all relevant individuals (employees, interns, contractors etc.) make effective risk based decisions and protect sensitive information from being compromised.Workday Beacons are at the forefront of creating a bridge between the Information Security team, respective policies and standards, and the rest of the organization. Beacons are the catalysts in helping close the divide in the company-wide understanding of how security and business objectives intersect and knowing why security is everyone’s responsibility at Workday.• Malware CafeAs part of Security Awareness Month 2019, we brought a pop-up cafe with a difference to several Workday office locations globally. Serving coffee, pastries, free Wi-Fi and…….hackers with motives. This was an opportunity for employees to experience, at first-hand, the very real dangers of connecting devices to unsecured Wi-Fi and leaving laptops unlocked in public places. The objective being that they gain an improved understanding of the prevalent risks and numerous attack vectors associated with insecure networks and public domains in general.

London, Gb

Accountable for: - Spearheading a shift in information security awareness & behaviour at Diageo. - Effective engagement with key stakeholders to ensure that key business requirements are the basis of the security awareness program and so activities are prioritized and fit-for-purpose.- Continuous improvement of the cyber security awareness program through measurement & reporting of key activities.

London, Gb

Key activities:- Delivery of an effective annual Cyber Outreach Plan - Accurate measurement of Security Awareness activities to drive continuous improvement.- Design, management and delivery of annual mandatory Information Security eLearning for 20,000+ personnel across the business. Regular positive feedback received by the team from a wide range of senior stakeholders.- Management of global simulated phishing campaign from pilot phase (1,000 personnel) to BAU for all employees (inc. business partners with privileged access).

London, Gb

Working as part of the Governance, Risk and Compliance team my key role responsibilities were: - Outreach awarenessEnsuring continuous development of, and embedding of global security policy, across 21 markets. Sustaining and driving a network of 40+ Regional & In-market Security Policy Champions globally. Monthly meetings, feedback initiatives, training and in-market control reporting all formed part of the regular engagement undertaken in this area.- Targeted trainingDeveloped and hosted training sessions for targeted groups and high-risk markets within Diageo including Payroll, Compliance & Ethics, Shared Services, senior management etc. The outcome of this training was that risk was mitigated in accordance with Security Policy. Awareness and effectiveness metrics were collated via post-training surveys to support continuous improvement in this area. - Control testing & reportingCompletion of semi-annual key internal and partner control testing to ensure compliance with Governance requirements, including Privileged Access, Continuous Business Need and Incident Management. This testing was undertaken on a regular basis to provide accurate reporting on individual controls, their scope and the value of their resulting metrics.

London, Gb

Service Delivery Lead for International Supply Centre (RoI)

London, Gb

As part of the Global Diageo Business Services (GDBS) team, I worked closely with Diageo users and service partners (IBM, Accenture, CSC, Verizon) to ensure delivery and availability of IS Services into the business within the agreed SLAs. Some of these services include: Working as an integral part of the existing Service Delivery Team ensuring the successful delivery of the Windows 7/VDI/PC refresh program.Ensuring reliability of services & infrastructure, in line with agreed service levelsEnsuring user requests to the Service Desk are correctly processed and that the proper PDPs are implementedRollout and user configuration of IPT/VoIP for St. James’s Gate site

Dublin 2, Ie

Managing the PR and Marketing needs for multiple private and semi- state clients on a day-to-day basis.Coordinating the rebranding, official launches and marketing campaigns for educational institutions and major companies (e.g. Eaga / Carillion / FÁS / Bord na Mona / NUI Maynooth / Aervent / AirCon Mech).Liaising with Government departments on behalf of clients regarding potential support and development – meetings with Ministers and senior officials.Negotiating with media outlets for client advertising campaigns. Budget management for client PR events.Team management for company and client tender applications.

B.Sc. (Hons), Information Systems

Certificate, Desktop Publishing – Quark Express

Certificate, Digital Animation - Macromedia Flash

Certificate, Foundation In Web Site Construction

City & Guilds Sound Engineering Part 1, Sound Engineering

Leaving Certificate