Kenneth Drah Email & Phone Number

United States

Ensure all new vendor engagements that involve the vendor handling, processing, storing, or accessing sensitive information are reviewed to provide assurance the vendor has appropriate controls in place to protect information prior to the business signing a contract.• Perform periodic reviews of all existing active vendor engagements.• Ensure accurate vendor risk ratings are completed, validated and all required vendor artifacts and documentation is collected appropriately.• Maintain a vendor repository for all vendor engagements that handle, process, store, or access sensitive information.• Recommend systems and process enhancements to reduce processing times and improve accuracy.• Provides oversight of compliance, audit and regulatory reviews and acts as the primary point of contact for management, responsible for providing regulatory and information security expertise.• Ensure that appropriate security controls are in place and that key regulatory timelines and required documents are tested• Document and report audit findings to management of affected areas• Perform risk analysis to determine level of risk and recommend action(s) to mitigate along with contract and Third Party Risk reviews, including SSAE16 and vendor assessment

United States

Performed risk assessments by analyzing questionnaires such as third-party engagement and due diligence evaluations.• Maintained Third Party Inventory working with required stakeholders (e.g., Legal/Compliance, Procurement, IT, Business Owners) to maintain TPRM related data at entity level.• Developed and maintain an active third-party assessment program to validate compliance against applicable security/privacy regulations or guidelines• Reviewed SOC1, SOC2, ISO and other industry standard reports from third party vendors• Ensured vendor compliance and track remediation status• Prepared customized third-party assessment questionnaires & help maintain current compliance documents.• Tracked agreed risk mitigation measures for compliance/completion.• Tracked and reported on TPRM activities in alignment with TPRM Life Cycle for the entity inclusive of analysis of key metrics, reporting of risk data and management reporting.• Contribute to the Third-Party Risk & Oversight program execution and adherence, including process enhancements and remediation efforts, as applicable.• Implement applicable regulations related to managing Third Party risk.• Maintain the TPRM Program policies, work instructions and controls.• Evaluate third party control effectiveness and review evidence of controls by applying audit, compliance, security, and regulatory framework knowledge and experience, including, but not limited to: ISO 27001, SIG, SOC reports, as well as Privacy, Business Resiliency and other risk domains.