Kiston Finney Email & Phone Number

Responsibilities include:• Working to identify new business for the Atredis Risk practice• Scoping and developing proposals and statements of work• Managing client relationships• Oversight, mentoring, and development of members of the Risk practice team• Risk advisory staff augmentation, vCISO, and mentoring client teams• Maintaining all Managing Principal Risk Consultant responsibilities

Greater Salt Lake City Area

• Mature and implement Atredis Partners' HIPAA service offerings and serve as the SME for these offerings • Mature and implement Atredis Partners' Risk Management Methodology service offerings and serve as the SME for these offerings• Develop Risk Management Methodology programs and execute Risk Assessments that are founded on industry-regarded best practices including ISO 27001/27002 and NIST Special Publications, and tailor the control sets to incorporate global and federal regulatory compliance requirements• Conduct HIPAA Security and Privacy Program Reviews for clients, and provide an actionable score card for the remediation of safeguards and requirements gaps, with NIST guidance• Conduct Security Program Reviews for clients and align recommendations with regulatory compliance drivers and industry-regarded best practices • Review, develop and implement Policies, Standards, and Procedures for organizations in all verticals, incorporating industry-regarded best practice frameworks and global and federal regulatory compliance requirements• Create client executive summaries and in-depth remediation report deliverables, identify security risks, and create a roadmap for each client’s information security program

Greater Salt Lake City Area

Responsibilities:• Management and direct oversight of 2-3 senior staff, and 1-2 students. • Coordination with peer managers within the department and University to effectively manage the GRC aspects of the security program Essential Functions :• Working with the appropriate key University stakeholders to protect the confidentiality, integrity, and availability of the University's electronic data• Work with the University technology governance groups and leadership committees representing the status of the information security program and representing the office of the CISO as needed• Manage the development and implementation of institution-wide security Policies, Rules, Procedures, and Guidelines• Lead efforts in industry-regarded best practice standards and regulatory compliance with ISO 27001/27002, FISMA, PCI DSS, HIPAA, FERPA, etc.• Review risks, threats, vulnerabilities and oversee the development of corrective action plans in partnership with executive management, the office of general council, IT personnel, and other relevant groups.• Maintain ongoing diligence, updating and adapting to changing risks, to proactively guard against evolving and emerging threats.• Communication of the University’s security stance and risk tolerance, including compliance issues, risks, and incidents to key stakeholders to enable those key stakeholders to make informed decisions about risk and risk management• Consult on other types of security (e.g., security architecture, secure development lifecycle, physical security issues) as needed. • Collaborate with appropriate IT teams, the Compliance Office, and the Office of General Counsel to mature the University’s information security incident response plan and practicing execution of the plan• Develop and conduct information security training and awareness activities

• Mature and implement FishNet Security’s HIPAA, HITECH, Omnibus, and Meaningful Use service offerings and serve as the Subject Matter Expert for these offerings within the organization• Mature and implement FishNet Security’s Risk Management Methodology service offerings• Develop Risk Management Methodology programs and execute Risk Assessments that are founded on industry-regarded best practices including ISO 27001/27002 and NIST Special Publications, and tailor the control sets to incorporate global and federal regulatory compliance requirements• Conduct HIPAA Security and Privacy Program Reviews for clients, and provide an actionable score card for the remediation of safeguards and requirements gaps, with NIST guidance• Conduct Security Program Reviews for clients and align recommendations with industry-regarded best practices including ISO 27001/27002 and NIST Special Publications• Review, develop and implement Policies, Standards and Procedures for organizations in all verticals, incorporating industry-regarded best practice frameworks and global and federal regulatory compliance requirements• Create client executive summaries and in-depth remediation report deliverables, identify security risks and create a roadmap for each client’s information security program

• Developed and published a comprehensive information security policy and associated standards, guidelines and procedures based on ISO 2700x series, NIST 800 special publications, and industry-regarded best practices• Developed and implemented the data classification model that incorporates security and privacy requirements for both campus and hospital institutions• Developed and implemented the risk assessment program based on ISO 2700x series and NIST 800 guidelines for campus and hospital systems that reports both inherent and residual risk to appropriate stakeholders• Ensured all applicable regulatory compliance (HIPAA, GLBA, GRAMA, FERPA, PCI) control criteria is incorporated in assessments• Developed and implemented the risk remediation program

Information Security Architecture:• Developed and executed the recurring risk assessment program • Performed periodic risk assessment of applications and infrastructures within the program• Analyzed and reported the residual risk of each application to technical and business personnel• Interfaced directly with business, system and compliance owners for control failure remediation• Worked in cooperation with the Information Security Compliance and Testing group for control assessments, security architecture reviews, and policy reviews and revisions• Worked in cooperation with the Corporate Compliance group for reporting risk to the Executive Board• Ensured all applicable regulatory compliance (SOX, PCI, GLBA, HIPAA, FDIC, OCC) control criteria was incorporated in assessmentsInformation Security Compliance and Assurance:• Coordinated application, infrastructure, and network security reviews between the testing teams (both internal and outsourced) and the business/system owners• Participated in annual reviews of controls tested based on inherent risk score and policy revision• Facilitated and participated in security review meetings between the testing teams and the business/system owners to review security findings, with an emphasis on correlating the test findings with actual risk to the business/systems and overall security awareness and education• Briefed security review findings to executive management, followed up on all required findings with the business/system owners, and reported these metrics to executive management• Assisted business/system owners with drafting Exception to Policy requests, reviewed those requests, and met with executive management and the audit department to approve or deny as appropriate

• Exchange Server Administration - Building servers, creating and managing all distribution lists, recipients and connectors, monitoring Norton Antivirus for the Enterprise updates and logs, creating and enforcing all policies, training and supporting all clients• Windows 2000 Server administration - Building servers, creating policies, establishing security, building and maintaining Active Directory• Active Directory Migration from Novell - Meeting with department heads to discuss workflow and security issues, serving on the Windows 2000 steering committee for Physiotherapy Associates’ parent company, designing Active Directory structure, proposing new structure to CFO and CEO, building a test network, building live servers, performing the migration, documenting the migration, supporting all migration issues, presenting the migration success to the parent company and to the CFO and CEO• Network Administration - Establishing and enforcing network policies relating to user and group security for Novell, Windows NT 4.0 Server, Windows 2000 Server and Active Directory• LAN/WAN Administration - Troubleshooting connection issues and TCP/IP, supporting frame network, opening trouble tickets with appropriate telecoms• Cisco VPN 3000 Series Administration - Installing and maintaining software clients, maintaining 3002 hardware devices, monitoring 3030 concentrator• Level 3 Support - Training and mentoring help desk analysts, co-writing the IT Desk Reference Manual, solving third tier support issues for remote users utilizing pcAnywhere, troubleshooting and repairing Compaq and Dell servers, desktops, and laptops