Consultancy providing cost/resource/time efficient compliance achievement and maintenance:- Compliance Achievement: HIPAA, SOC 2, ISO 27001, FedRAMP, HITRUST, CMS, GDPR- Compliance as a Service: compliance required services such as internal audit, annual risk assessment, policy and procedure updates

First Security, Compliance, and Privacy Officer building programs from policies to technical implementations:- improve SOC 2 Type II compliance- achieved ISO 27001:2022 and FedRAMP Moderate

Developed and implemented Quantitative Risk Model for govern all Kaiser Edge DevicesDeveloped CMMI based risk maturity for business groupsDeveloped risk prioritization based on risk reduction

Built Security and Compliance programs from ground up to a HITRUST (CSF v9.1 with 564 controls) certifiable entity - efforts including building teams, planning a budget, leading next generation security technology research and implementations (Redock/Prisma Cloud, CloudKnox, Fortinet, CrowdStrike, KnowBe4, and Integris), building security and compliance roadmaps, and presenting status to the Board and the Executive Counsel. - Built roadmaps for Security and Compliance for HITRUST, ISO 27001 and beyond.- Authored required 75 policies and 114 procedures.- Built strategic partnerships with vendors, VAR's, and various 3rd party assessors.- Built Security and Compliance teams and mentored personnel.

Led Security Programs/initiatives:- Guided a genomics startup (23andMe) through GDPR/HiTrust (CSF 9.1) compliance via gap analysis and building a roadmap- NIST Cybersecurity Framework, Incident Response, Policies/Procedures, Security Controls- Built GDPR/HiTrust Compliance Starter Kit for small/medium companies- SSL Solutions (Symantec) for a large biotech (Gilead)- Vulnerability Management Program (Tenable, Brinqa)

Provided leadership and technical expertise to deliver over 100 IT, Security and Compliance projects and initiatives. Build strategic partnerships with contractors and vendors, typically slashing contracts by 40-60% and manage $20M+ budget.- Developed Security & IT roadmaps, including internal HiTrust Certification Process (HIPAA, SOC2, NIST 800-53, ISO 27001).- Oversaw delivery of complex technology programs, including more than 15 different enterprise security, compliance, and IT applications including TripWire, Ssh.com, FireEye, Imperva, Splunk, HRIS Solution, Salesforce, NetSuite, and Confluence/JIRA.- Cultivated strategic partnership with VAR's and vendors to meet rapidly growing needs.