Gideon T. Rasmussen Email & Phone Number

Austin, Tx, Us

• Cybersecurity program design and assessments- Conducts strategic planning- Presents to a cybersecurity committee- Prepares presentations for boards of directors- Leads risk register meetings𝗥𝗲𝗰𝗲𝗻𝘁 𝗣𝗿𝗼𝗷𝗲𝗰𝘁𝘀:• Data actions inventory• Privacy risk management framework- NIST Privacy Framework v1.0- NIST privacy task statements- Consumer rights- Business obligations- Reputable practices to identify and mitigate risk- Assigned RACI designations to controls• 3 days of on-site meetings (March, June and November)- Cybersecurity committee meeting- Working sessions- Strategic planning- Outbrief presentation• Insider risk management program - Phase II.• Incident response playbook- Fraudulent website• Zero trust controls analysis- NSA's seven pillars• TPRM program refresh- Generative AI- NIST Cybersecurity Framework v2.0- Privacy updates- Reputable practices• Data security training deck• Crisis communications training deck• Consolidate logs for insider threat detection• Executive overview deck• Generative AI chatbot testing procedures• Information security survey- Voice of the customer• Privacy risk management controls• Materiality determination process - Cybersecurity incident• Insider threat personas (5)• Suspicious command monitoring• Vendor report analysis procedures• Cyber risk management framework- NIST Cybersecurity Framework v2.0- Implementation examples- NIST Privacy Framework v1.0- Added controls to identify and mitigate risk- Assigned RACI designations to controls• Executive risk summary• Data breach notification matrix• Control risk summaries• Shared responsibilities matrix process• Targeted risk analysis• Vendor contract addendum- Secure software development• Tabletop exercise - Cybersecurity- Two 90-minute sessions- 9 incident response injects- 9 crisis communications injects- Hot wash𝗖𝗼𝗺𝗽𝗹𝗲𝘁𝗲 𝗹𝗶𝘀𝘁 𝗼𝗳 𝗽𝗿𝗼𝗷𝗲𝗰𝘁𝘀: www.gideonrasmussen.com/projects.html

Blue Bell, Pennsylvania, Us

• Established Strategic Plans for two CISOs. Provided program development services• Established a Risk Management process, inclusive of Policy, Risk Register Form, Log, Tollgates and an Executive Forum• Conducted NIST Cybersecurity Framework Assessments, with a focus on insider threat, privacy, fraud prevention, process design, application governance and data management• Established an Information Security Program under NIST 800-53. Leveraged 10 projects to implement supporting processes and technologies. Implemented controls to preserve the integrity of the Presidential election. Traveled 32 weeks in 2016• Conducted 1:1 mentoring and provided Information Supplements

Andover, Massachusetts, Us

Conducted a gap analysis and established a road map to drive the Information Security Program forward. Updated policies and established InfoSec Program documentation. Implemented Advanced Threat Management solution. Established Vulnerability Management and Application Security Programs. Established fraud scenario requirements to improve a company product and increase revenue. Conducted contract red-lines, responded to RFPs and supported the sales team to onboard new customers.

Charlotte, Nc, Us

Established an Information Risk Management program within Consumer Data and Analytics. Sent threat advisories and presented best practices to address residual risk. Established Application Risk Profiles. Risk Hunting activities included risk scenario development, related assessment activity and identification of preventive controls. Tracked issues to closure within a risk registry. Tripled support model coverage due to organizational change.

Charlotte, Nc, Us

Responsible for bankofamerica.com, online banking and mobile banking. Managed a team of 15 application security professionals. Doubled support model coverage due to organizational change. Led Clear and Present Danger response and root cause analysis. Implemented risk reporting. Dramatically accelerated remediation. Established ethical hacking and dynamic application scanning functions. Established a risk model to deploy assessments and scans. Established security certification program for Developers. Established a Governance, Risk and Compliance system of record. Documented high, mid and low-level processes; with control points included.

Charlotte, Nc, Us

Supported five teams within Supplier Resiliency. Responsible for processes, procedures, program alignment to standards, risk model, technology, reporting, assessment initiations and scheduling. Managed a team of nine. Established process design function and standards. Led a project to consolidate data from teams throughout the company, providing one view of assessment findings and scheduling. Team was disbanded due to increased scope and organizational change.

Charlotte, Nc, Us

Established two payment card security programs. The Merchant PCI program evaluates merchant customers' adherence to PCI standards. The Enterprise PCI program evaluates internal compliance with PCI standards. Managed a team of seven, including responsibility for program funding and business cases. Defined processes, procedures, risk ranking methodology, application business requirements document, service level agreements and reporting. Team activities included evaluating PCI assessment documentation, remediation tracking and close integration with BA Merchant Services and LOBs. Conducted program development under Design for Six Sigma, complete with a team of Analysts and a Governance, Risk and Compliance system of record. Represented BAC on an external Security Advisory Committee (2007-2010). Promoted to Tech Manager, Senior Tech Manager and SVP (10/07, 11/08 and 10/10 respectively).

Charlotte, Nc, Us

Conducted on-site security assessments of external IT suppliers. Accomplished risk-based security program assessments including evaluation of firewalls, networking, encryption, application security, system hardening and access control. Remaining test procedures were distributed across the 10 domains of ISO 17799. Mentored new team members. Strong contributor to the complete re-write of the on-line assessment program to align with new baseline controls. Converted to full-time Vice President position.