John Whiting Email & Phone Number

New York, Ny, Us

I was recruited by the newly appointed Chief IT Risk Officer to spearhead the global cyber risk management initiative for the Omnicom enterprise. In this role, I was tasked with developing and maturing the risk program, which involved working closely with various stakeholders across the organization to identify, assess and prioritize cyber risk, and implement effective risk mitigation strategies. With my expertise in cyber security and risk management, I was able to build a robust program that helped the Omnicom enterprise stay ahead of emerging cyber threats and maintain its reputation as a trusted and secure organization. As a co-author of the Omnicom Risk Management Framework, I align the comprehensive risk lifecycle framework with ISO 31000 risk methodology to provide a systematic and flexible approach to managing risk. This framework helps Omnicom identify, assess, and prioritize risks, and develop and execute effective risk management strategies. It also provides guidelines and general principles for risk management processes, including risk identification, analysis, evaluation, treatment, and monitoring. I keep up-to-date with emerging cyber threats and regulatory requirements, seamlessly incorporating this knowledge into Omnicom's cyber risk program. I work closely with the incident response team to provide intelligence on increased emerging threats, which are added to the risk register and presented to the risk committee. As the owner of Omnicom's integrated risk management system, I design and integrate a holistic and automated approach to risk assessment and management across the enterprise, including numerous certification frameworks and risk acceptances. I manage risk and assessments for Omnicom's Corporate ISO 27001 and ISMS and effectively manage risk findings, corrective actions, and non-conformities. I also collaborate with internal stakeholders to manage ISO risk.

New York, Ny, Us

Responsible for overseeing Governance, Risk, and Compliance (GRC), Enterprise Security Services, Strategy, Reporting and Architecture, and Security Operations. I managed industry standards certification programs for ISO 27001 and TISAX.I successfully developed and implemented a comprehensive Global Cyber Program at DDB Worldwide, using a consistent methodology and processes for handling confidentiality, integrity, and availability that aligned with the corporate strategy. I collaborated with legal, the technology organization, agency operations, affiliates, partners, third parties, auditors, and CFOs to ensure corporate and contractual/regulatory Cyber and Privacy standards were represented and compliant. I was responsible for managing all incident response activities, leading investigations of events, and coordinating internal and external resources for containment and mitigation of attacks.I scheduled quarterly calls with regional executive management teams to address any cyber or privacy related questions and issues. I also consulted on new client and third-party contractual requirements, incidents in their region, and new cyber and risk trends to keep them informed.I advised DevOps teams on creating new pipelines and runbooks that were compliant with corporate security standards to support a cloud native environment. I refactored their processes, guidelines, and IAM to address Dev-SecOps challenges.As part of my continuous improvement strategy, I reduced risk significantly in business processes by requiring business operational runbooks that documented business processes and nomenclatures, and aligned them with security standards, contractual, policy, and regulatory requirements.Developed a global Business Continuity and Crisis Management Program in the first year, and matured the program by executing Business Impact Analyses, Security Impact Analyses, and annual tabletop exercises.Regenerate response

New York, Ny, Us

AIG is a Fortune 500 insurance company with more than 88 million customers in 130 countries.As a seasoned executive with a proven track record, I was handpicked to serve as the inaugural BISO for AIG Corporate, following the directive of the federal oversight monitor. As a dynamic and contributing member of the AIG BISO Council, I played a crucial role in governing the company's Policy & Standards. I brought my expertise in global information security and consultancy to the corporate management team, offering strategic leadership and direction. I effectively managed a diverse team, including direct reports, offshore consultants, and a shared services infrastructure, to support the implementation of AIG's Information Security program across multiple corporate business units. Additionally, I served as the security representative on AIG's Privacy Board, headed by the Chief Privacy Counsel, demonstrating my expertise in data protection and privacy. I managed over thirty thousand vendors in the corporate Third Party Risk Management program, implementing cutting-edge network, device, and unstructured DLP technologies for maximum data security. I also led the internal application security program, with a focus on lifecycle management and ensuring BISO approval for all implementations, purchases, and developments. I infused InfoSec governance, consulting, and approvals into all internal and third-party projects, mitigating risks and securing risk acceptance from the appropriate level of management

Menlo Park, California, Us

As a seasoned and proficient consultant, I efficiently performed independent assessments and risk mitigation for renowned multinational financial and pharmaceutical organizations. I actively engaged with esteemed client executives and contract signatories to clearly define the scope of their contracts and interactions with third parties and relevant data. Through diligent assessments, I accurately determined the data classification levels and evaluated the controls in place to safeguard the data. I meticulously reviewed all relevant policies and processes to guarantee adherence to industry standards and thoroughly audited vendor compliance. I expertly presented comprehensive assessment and remediation reports, detailing findings and risk levels to executives, and provided actionable third-party risk management reports aligned with ISO controls. These reports enabled executives to make informed decisions on whether to utilize the vendor or necessitate remediation of controls or corrective actions in contracts.

New York, New York, Us

New York Life Insurance Company (NYLIC) is the largest mutual life-insurance company in the United States, and one of the largest life insurers in the world.Recruited by New York Life's Group Administration Members Department to lead and oversee Third-Party Vendor Assessments for Third Party Administrators and Vendors. My role involved representing the group as an independent expert on all matters related to Information Security to the NYLIC's Security Review Board. I successfully implemented controls to protect PII and PHI data, ensuring compliance with HIPAA Business Associate agreements and verified URAC and PCI certifications where applicable.

As a technology and security executive with a proven track record of success, I provided visionary executive guidance and strategic direction to a complex SAS web services environment with over 2,000 physical nodes. I expertly navigated multiple colocation and managed service facilities to ensure seamless operations, and my innovative risk management, IT governance, and resiliency planning programs were instrumental in achieving and exceeding our contractual 99.999% uptime commitment and ensuring secure resiliency. My exceptional leadership skills were demonstrated by my effective management of a talented internal team of 8 staff members and the successful management of an annual operations budget of $25 million, while also negotiating contracts and managing relationships with all data centers. I was responsible for ensuring IT and security resiliency and created an overarching security program to align with client requirements and audits. My innovative approach to cost management resulted in a 60% reduction in storage Opex costs annually by leveraging new-to-market virtual storage appliances over costly monolithic and extensive storage providers. This achievement highlights my exceptional ability to drive results, make a tangible impact on the bottom line, and demonstrate strong competencies in areas such as strategic planning, risk management, team leadership, vendor management, and IT resiliency.

Jericho, Ny, Us

As the Director of IT & Security at PCH.com, I made a significant impact in ensuring the company's web infrastructure was secure and modernized. My expertise in infrastructure design resulted in the creation of a highly redundant and resilient system, with a focus on continuous improvement through standard operating procedures. During peak times, PCH.com, a result of its highly successful TV campaigns, faced the challenge of maintaining 100% uptime, as mandated by a US Attorney General order, arising from a gaming lawsuit settlement.I displayed exceptional leadership skills while managing both internal employees and augmented staffing, resulting in a well-functioning IT department. My expertise in security was demonstrated by my successful implementation of secure web proxying and regional load balancing, ensuring the security of the largest Microsoft ASP web farm at the time, as well as streamlining content management processes.

In

As a Senior Windows Security Consultant for NYC Board of Education's Project Connect, I played a crucial role in securing the largest Microsoft NT domain in the world at the time. My responsibilities included implementing web filtering and multilevel policies for internet access across all schools. I established and managed the organization's Windows Security practice, taking full responsibility for analyzing, designing and deploying security tools, including security monitoring and alerting, to minimize risks and vulnerabilities. I provided expert consultation on a wide range of security solutions, including web filtering, auditing, vulnerability assessments, and forensics to clients. My scope of work encompassed team building and leadership, staffing and training, project and engagement management, business development, product development and rollout, and building and maintaining strong relationships with clients and partners. I successfully led a team of five engineers, recruiting and training them to achieve our security objectives

New York City, Us

Brooklyn, New York, Us

Armonk, New York, Ny, Us