Heather Ostrander Email and Phone Number

For the last 8 years, working as a Business Analyst, I have been the liaison between the technical teams, CISO auditors, leadership and vendors. I would work to find and remediate security gaps by updating existing processes and procedures, finding new tools or best practices which could be leveraged to close the gap. I would document and implement this new solution across the LOB to eliminate the non-compliance. I used SQL and Excel Pivot table when analyzing large data set. • Mapped process activities to identify shortfalls by proposing options to rectify operational inefficiencies.• Created and maintained Audit Evidences such as project artifacts, procedures and reports for SQA audits, TTM phase gates audit, ISO 27000-series, PCI-DSS, ISO, HIPAA, HITRUST, FISMA, FedRAMP, CCM Level and various federal and state privacy laws self-assessments• Acted as Business unit’s point of contact by facilitating meetings for security risk requirements management, policy development, and technical investigations of compliance controls for industry regulatory issues resulting in root cause analysis of intrusions, real-time decisions about incidents as they occur and communication of said solutions to external parties and internal business stakeholders as well as leadership status dashboards.• Analyzed, collected, summarized information and produced accurate reliable data for decision making to support audit compliance in areas such as: - Access, Authentication, Authorization management - Logging, monitoring & security event management - Vulnerability management - COTS 3rd party software compliance - Disk, file, device & database encryption - Data classification, data tagging, data labeling & privacy policies - Secure information storage

• Defined and documented business requirements & testing artifacts for 4 different Change Management Tracking Tool, the most recent being JIRA & Service Now (SNOW) from an end user and service desk perspective• Created test plans, test cases, test data, training documents to train resources on System and Business Requirement for IT and business users on application solutions.• Subject Matter Expert for many Xerox managed tools • Created Brainshark, Computer based training modules to train domestic and international resources • Managed numerous server and software migrations/consolidations cost saving initiatives• Coordinated scheduled releases, Change Controls, testing, defects ratifications through deployments across multiple projects and multiple teams• Authored, streamlined, maintained and trained teams on standard procedure documentations to comply with Security/PCI requirements• Knowledgeable in Networking, routing, firewalls, Active Directory, operating system fundamentals (Windows, UNIX, or mainframe), application programming/scripting languages, technical architecture, relational database management systems, and COTs software levels• Facilitated numerous disaster recovery simulations, Iron Mountain Escrow deposits, Vulnerability scans, archiving solutions/restores, data migrations, Monitoring/Logging reviews and security compliance assessments.• Collected, modeled and analyzed data in order to make proactive adjustments to plans to meet all milestones.

• Developed and initiated projects, managed costs, and monitored performance.• Simultaneously managed multiple cross functional projects using exceptional organizational skills ensuring all members on a project team were aware of current status and tasks to bring to closure actions.• Performed impact analysis on any risk, issue or audit finding which affect the project deliverables and scope creep• Tracked status on any change controls, requirements and defects for the release implementation per project planning package• Determined information and communication needs to effectively distribute proper information for internal and external stakeholders• Identified, reviewed and applied policies and procedures.• Experienced in Project Management- project scheduling & tracking, metrics collection & validation, data analysis and process improvements, meeting facilitation, change control, documentation & training• Chaired project meetings and distributed proper information using PM methodologies such as TTM (Time to Market), CMM Level 2 (Capability Maturity Model), LSS (Lean Six Sigma), QMS,(Quality management System) Agile Planning, & ITIL (Information Technology Infrastructure Library) & SDLC (Software Development Lifecycle) along with Agile software development methodology

After 9 years of Cobol programing, I switched job families to become a a project manager

I have worked solely on the Xerox account since 1997.