Jill E. Thomas Email & Phone Number

Portland, Or, Us

Portland, Oregon, United States

Information and Cyber Security - Division of Wells Fargo Technology dedicated to protecting the company from cyber threats, engaging with company businesses, assessing information security risk, providing identity services, performing security engineering, and operating the ICS function. Executes Policy Governance Office strategic initiatives

Portland, Or

Information and Cyber Security - Division of Wells Fargo Technology dedicated to protecting the company from cyber threats, engaging with company businesses, assessing information security risk, providing identity services, performing security engineering, and operating the ICS function. Led Infrastructure domain team in executing strategic objectives and initiatives, without direct managerial responsibilityEvaluated policies and security requirement compliance to accepted regulatory, compliance, and industry frameworks, including GLBA, GDPR, PCI-DSS, FFIEC, NIST, ISO, COSO, and OCC Heightened Standards Completed internal and external security assessments relating to IS Infrastructure policy and security requirementsExecuted strategic initiatives for the Information & Cyber Security programImplemented Policy Exception and Security Deviation program for Infrastructure security domain, delivering enhanced risk-based criteria and business-enabled platformLed Policy Governance Office initiative establishing risk-based process for governing business group and enterprise function adherence to information security policy Developed and launched infrastructure security domain metric governance program for key risk identification and monitoring

Information Security Risk Management Oversight, Division of Wells Fargo Corporate Risk Administered and executed monthly initiatives of Information Security Risk Management Governance CommitteeCreated Information Security Risk Management governance documentation for Information and Cyber Security ProgramDrove adoption of the Risk Management Framework across Information and Cyber Security domains organization-wideSupported authoritative source compliance oversight for Information and Cyber Security governance program, as well as risk management policy assessment and oversight for the Information and Cyber Security front line organization

Technology Risk Management Oversight, Division of Wells Fargo Corporate RiskDefined, developed, and deployed a new Technology Governance, Risk, and Control process and platform in support of Technology Risk Functional Framework:Defined and documented current state inventory of 33 assessable technology processes, risk, and controlsMapped technology processes, risk, and controls against COBIT 5 control expectations, as well as FFIEC, GLBA, and PCI-DSS authoritative sourcesImplemented foundational GRC Archer platform that retired five systems of recordDeveloped, implemented, and executed partner training for the Technology GRC Archer platformEvaluated technology processes and application systems to identify inherent and residual risk exposuresAssessed technology risk against 55 Enterprise New Business Product and Services program initiatives; >1% required management escalation for public launch Go/No Go decision

Operational Risk Management Reporting Team, Division of Wells Fargo Enterprise Information Technology Responsible for Manage by Objective program including planning, tracking, and reporting to IT Risk executive management. Supported data collection, analysis, and aggregation for executive risk reports

Regulatory Compliance and Control Validation, Division of Wells Fargo Technology Operations GroupPlanned, documented, and implemented foundational framework for the Technology Non-SOX Control Testing MethodologyPerformed research and identification of application-level control processes related to Regulatory reportingResearched key interfaces and application processes that generate transactions to the general ledger, facilitated and documented walkthroughs of controls, designed Sarbanes-Oxley (SOX) processes and identified appropriate controls, processed change control requests, designed test plans, consulted with business partners, participated in control discussions with Technology and Line of Business group controllers