Jason Hoffman Email & Phone Number

Deliver the following advisory services for SaaS (Cloud), banking and healthcare clients:• Executive technology and security advisor for early-stage SaaS (Cloud) companies and non-profits.• CISO/CSO for companies requiring temporary or part-time security leadership.• Security and technical advisor to venture capital (VC) and value added reseller (VAR) firms.• Serve as information security subject matter expert for executive leadership.• Develop annual strategic plans and supporting project roadmaps.• Collaborate and coordinate with internal resources to execute the security plan.Perform assessments with clients in the following areas: • Information security strategy• Information security governance• Information security program development and management• Information security risk management

Dublin, California, Us

Responsibilities included: cloud security architecture; customer engagement; security operations and monitoring; incident management and response; application and product security; quality management; audit and compliance; vendor management; and managing a global team in US, Canada and India.• Implemented go-to-market security and compliance intake process via Salesforce which enabled dashboard measurement of SLAs and highlighted 60% reduction in turnaround time for customer/sales requests.• Integrated global information security functions of two acquired companies within 6 months to eliminate redundancies, streamline responsibilities and improve efficiencies in delivery of information security services without impacting both business and cloud customers.• Delivered web-based security awareness training to all global employees, leveraging Saba’s LMS and achieved 95% compliance within 30 days.• Revamped application security program by implementing static and dynamic application testing as part of SDLC, leveraging different third-party penetration testing partners and delivering developer training that helped improve overall quality of security testing efforts via reduced repeat vulnerabilities.• Built out new global security operations team (SOC) in Canada and India within 6 months, that is responsible for expanding and optimizing the vulnerability management program, automating application security scanning, tuning global SIEM to reduce false positives and producing regular security metrics reports highlighting effectiveness of Saba’s security programs.• Consolidated three separate SOC 2 audit engagements with different audit periods into a single audit engagement with no findings and achieved the publication of three separate audit reports within 30 days of the end of the audit period with no exceptions.• Revamped quality management program to comply with 21 CFR Part 11 requirements within 6 months resulting in 100% customer audit satisfaction.

San Jose, California, Us

Responsibilities included: leading global information security, governance, application security, risk management, and compliance teams; partnering with cloud operations, IT, product engineering, HR, and legal to influence decision-making, reduce risk, and effect change; and effecting governance with senior management, audit committee, and board.• Completed enterprise security risk assessment based on NIST cybersecurity framework within four weeks to help shape security strategy and roadmap.• Launched vulnerability management program that resulted in 60% reduction of vulnerabilities in less than three months.• Expanded coverage of SSAE 16/SOC 2 audit to include AICPA Trust Services confidentiality and availability principles to provide additional assurances to customers while adding only a trivial number of new controls.

San Jose, California, Us

Responsibilities included: leading global information security, application security, risk management, compliance, privacy, and internal audit teams; partnering with cloud operations, IT, product engineering, HR, and legal to influence decision-making, reduce risk and effect change; effecting governance with senior management, audit committee and board; managing call center fraud; and interface with global Fortune 500 enterprises before and after they become a client.• Reorganized separate teams under single organization to eliminate redundancies, streamline responsibilities and improve efficiencies in delivery of services.• Established dedicated budget and cost center for information security and justified augmentation of staff from 13 to 26 in 15 months, to address and effectively manage newly identified security risks.• Increased effectiveness of security governance through continuous communication and guidance via newly created cross functional security risk council.• Completed 92% more internal audits within 12 months of taking over function compared with audits in previous year with same number of headcount.• Developed application security dashboard that resulted in more senior management visibility and reduction of security related vulnerabilities, additional budget for third-party penetration tests, and stronger commitment to application security as part of SDLC.

Cambridge, Cambridgeshire, Gb

Responsibilities included: leading Autonomy’s internal security program (physical, logical, and product); leading compliance program; interfacing with global enterprises before and after they become a customer; partnering with cloud operations, IT, networking, engineering, HR, and legal to influence decision-making, reducing risk and effecting change; reviewing RFPs; and negotiating customer agreements.• Rebuilt neglected security program in nine months and developed cohesive security strategy resulting in unqualified SAS 70 Type 2 audit opinion with no exceptions.• Improved identity access management system through several innovative recommendations achieving over 3,000 hours of productivity improvement in first year.• Streamlined customer assessment process improving efficiency of completion time by 33%.• Implemented vulnerability management solution which provided immediate visibility of security vulnerabilities and achieved corrective action for 100% of the identified external vulnerabilities within four months.• Refined and aligned security policies and standards with ISO 27001 and PCI to facilitate more efficient audits and ensure compliance with best practices.

Jackson, Wy, Us

Responsibilities included providing technical strategic direction, web site content delivery, social media management, and conference support.

Oakland, California, Us

Responsibilities included development and delivery of Kaiser’s Enterprise Information Security Risk Management Program and managing Kaiser's enterprise-wide awareness and training programs related to information security.Promoted to drive the development, implementation and maintenance of an effective enterprise risk management program; established enterprise-wide security/risk awareness and training programs related to information security; key leader in identifying opportunities to integrate risk management principles into the information security strategy which included policy and standards framework and compliance related activities; provided thought leadership to executive management and business leaders throughout the company, as well as to security vendors and peers throughout the healthcare industry and security profession.• Established foundation for a sustainable risk management program by developing and publishing the first security risk management strategy and roadmap, security risk management framework, security risk management standard and security risk assessment methodology.• Created a culture of risk awareness by developing and delivering a professional web-based training course to executives, project managers and supervisors on the principles of risk management.• Assessed HIPAA security risk for all eight regions in less than six months, saving over $200,000.• Developed and delivered web based security/risk awareness training content to over 60,000 employees in one year.

Us

Responsibilities focused on the overall coordination, management and oversight of all security activities within the Bank.Led all security activities within the Bank; developed, recommended, implemented and enforced enterprise-wide security policies, standards, guidelines and procedures including Sarbanes Oxley (SOX) compliance; managed Bank’s security program by providing leadership to the security team and influencing lines of business; identified, evaluated, procured and deployed new technologies to reduce risk and improve effectiveness of security; led the development and implementation of incident response process, electronic investigations and risk assessments. • Established first dedicated budget and cost center for information security and justified augmentation of security staff in order to address newly identified security risks.• Increased effectiveness of security awareness through continuous communication and guidance via newly created security council in order to partner with all business units.• Developed comprehensive security risk assessment to address regulatory compliance, best practices and emerging threats which resulted in the approval of several capital projects to deploy needed security solutions.• Implemented vulnerability management solution which provided immediate visibility of existing security vulnerabilities and achieved corrective action for over 50% of the identified vulnerabilities within six months.• Deployed Internet content filtering and monitoring solution which resulted in increased employee productivity and security, and decreased potential risk and liability (100% of web sites violating company policy were blocked).

Reston, Virginia (Va), Us

Managed department of highly skilled professionals responsible for all disciplines of security including audit, information, network, physical and personnel security audit; drove policy, audit and assessment programs; created and enhanced various corporate security and privacy policies, standards, guidelines, procedures and best practices based on various industry security, audit and privacy standards including but not limited to ISO 17799, WebTrust, SysTrust, PCI-DSS, HIPAA, SOX, Gramm-Leach-Bliley Act (GLBA) and California Privacy SB 1386; simultaneously managed and coordinated multiple SAS 70, WebTrust, SysTrust, PCI and ISO 17799 audits, and assisted with SOX audit; led presentations to customers, media, investors and politicians describing the company’s security practices; regularly assessed and remediated security risks in the software development lifecycle (SDLC) and quarterly disaster recovery (DR) exercises; designed, implemented and maintained 24/7 management of security that mitigated threats to personnel, property and information of the main campus and remote offices.• Instrumental in VeriSign receiving unqualified SAS70 Type II audit opinion and WebTrust Seal for five successive years and SunTone Certification, demonstrating to VeriSign’s customers its commitment to security.• Designed and implemented all physical security elements of VeriSign’s new headquarters, world-class data center and several remote offices, including iris scan biometrics, digital DVRs and 24/7 guards.• Thwarted a career criminal which resulted in a felony conviction.• Managed the security implementation, build-out and facility security assessments of world-class data centers for VeriSign’s international affiliates in Rio de Janeiro, Berlin and Toronto to ensure adherence to VeriSign’s Security and Audit Requirements.• Completed RFP for new contract security force achieving an annual savings of $120,000.

San Francisco, California, Us

Responsibilities included consulting with business units to identify and remediate security risks, analyze root causes of audit findings, support enterprise-wide business resumption program and develop companywide information security standards.With the goal of reducing risk, responsibilities included consulting with business units to identify and remediate security risks; analyzed root causes of audit findings, developed a plan of action and tracked findings to final resolution; supported enterprise-wide business continuity program (BCP); developed companywide information security standards.• Created and facilitated company-wide security risk assessment methodology and process, allowing management to self assess security risk for every application.• Developed and administered database application to track audit findings, management responses and final resolution, and provide automated reporting for senior management resulting in significant annual cost savings and improvement in productivity.• Designed and maintained departmental intranet web site promoting security and risk management company-wide.

B.A., Economics And Legal Studies

Graduate Studies In Business Administration