Kurt Sauer Email & Phone Number

California, United States

San Francisco, Ca, Us

Responsible for leading the development, implementation, and management of DocuSign's global information security program. Because security is a team sport, an important part of this role is building and maintaining strong relationships with internal and external stakeholders in order to ensure that our information security posture meets or exceeds industry standards and best practices.

Pleasanton, California, Us

Responsible for the delivery of IT enterprise security, production infrastructure security, DevSecOps enablement, and security risk management. Our team’s objectives are to reduce bug introduction rates in software, move aggressively toward Zero Trust architectures everywhere, and ensure that we always have a clear-eyed view of our risk posture.Leads the team that is designing and deploying a modern, converged Identity Governance & Administration (IGA) capability, which is a foundational element of our Zero Trust design. Supported by IGA, the Information Security team is defining a Security Access Service Edge (SASE) architecture to simplify secure user experiences, privileged access management (PAM) to control administrative rights, and improved data loss prevention to cover more surface area.Works to help developers and product owners improve security through Shift Left initiatives that empower developers to move quickly while helping them apply best practices and holding them to a high bar of quality. We use technical standards and blueprints along with tooling to clearly articulate our security vision and to bring Workday’s Secure Software Development Lifecycle to life across the Product and Technology organization.Supervises Workday’s Security Governance, Risk and Compliance team, which manages Workday’s cybersecurity risk through an integrated view of policy, controls, issues, and risks. Drives FedRAMP compliance by running the POA&M, security plan, and continuous monitoring processes. By highlighting risks, issues, and exceptions across the Technology units, we have measurably reduced the duration and size of security exposures in both new deployments and legacy environments.

Pleasanton, California, Us

Led the delivery of security operations services, incident management, and digital risk management for Workday. In this capacity, I was responsible for the company's detection and response capabilities, penetration testing, network security, and risk management.Delivered round-the-clock security operations in Ireland, New Zealand, and the United States. Reskilled and restructured to provide consistent capabilities across geographies, reduce incident response hold times, and improve case resolution speed. In parallel, the incident management team built cross-functional teams to integrate business executives, legal, and corporate communications more closely.Transitioned risk management from being an on-demand service to a proactive one, using Tier 1 and Tier 2 risk assessments as a vehicle to baseline service security. This transition led to a wholesale refactoring of security policy and governance, providing better blueprints and guidance for teams and speeding time to market.

New York, Ny, Us

Led the information security and information technology teams in a healthcare business focused on pharmacy operations. Was responsible for comprehensive delivery of Blink’s information security program, including detection & response, product & infrastructure security, trusted delivery through SecDevOps, and a wide range of compliance controls.Provided executive leadership with security strategy and advice across the pharmacy network, telemedicine, and retail lines of business, including data protection and security requirements of HIPAA, state privacy regulations, and the PCI Data Security Standard. Was responsible for gaining and maintaining certification under the HITRUST Risk Management Framework.Also directed the Information Technology unit, which supported end users and delivered secure infrastructure and data services to pharmacy points of presence across the United States. The team delivered services at a rapid pace as the company's employee base and physical office footprint rapidly expanded.

San Francisco, California, Us

Accountable for ensuring the information security architecture of Salesforce’s products, infrastructure, and supply chains, as well as for driving the security aspects of mergers and acquisitions. Developed a security development lifecycle process to guide product teams to deliver secure systems quickly while maintaining quality. This kind of "shift left" approach reduced security approval turnaround times while measurably reducing bug introduction rates across several teams.Led a security M&A team that evaluated and integrated acquisition targets at a high pace by establishing clear definitions of done, applying risk analysis to identify the real must-haves, and maintaining a close relationship with the integration management office to keep security needs in focus throughout the integration. As part of this effort, I established Salesforce’s Security Governance, Risk and Compliance team which consolidated all technical blueprints under one roof.

San Jose, Ca, Us

Responsible for PayPal’s overall Information Security Risk organization, which consisted of security governance, regulatory obligation management, and audit supervision teams. Through these teams, I managed risk-related activities including associated control testing, deviation reporting, and formulation of remediations. This team also built and maintained an overarching obligations registry, which monitored the complex legal and regulatory environment that impacted information security policies and standards in each country where PayPal operated. Development of the Security Risk function helped foster a culture of accountability and continuous testing concerning key control strength management.

San Jose, Ca, Us

Managed information security services and teams across all of PayPal’s foreign subsidiaries through its international headquarters. Led technical programs to bring operating companies in Europe and Asia into compliance with emerging data residency and personal privacy regulations. Built a strong relationship between Security and the PayPal Boards of Directors – as well as with financial regulators – in the US, the European Union, Australia, Japan, and Singapore.

Studied the Japanese language full-time in anticipation of joining a graduate engineering program in Japan. During this time, I provided part-time independent consulting support to the CISO of the Internet Corporation for Assigned Names and Numbers (ICANN). During this time, I chaired ICANN’s DNS Security, Stability, and Resilience conference in Kyoto, Japan, and joined the Board of Directors of FIRST.Org, Inc. (Forum of Incident Response and Security Teams).

Redmond, Wa, Us

Managed the overall security posture of Skype and ensured customer trust in the brand as the most senior security executive in the company. Built the company’s security structure from scratch, including units focused on cybersecurity, trust & safety, physical security, and security communications.Brought Skype’s security engineers and core architecture team into alignment under an agreed set of security principles, which resulted in documented security standards, better software testing standards, and improved vendor management controls. Using these standards, Skype achieved PCI Tier I certification for the company’s payment processing systems.Built a Trust & Safety function that addressed not only government relations needs in advancing Skype’s business agenda but also addressing the significant national security interests of several governments. By building and maintaining international law enforcement relationships, Skype was able to proactively manage the expectations of important stakeholders.

Palo Alto, Ca, Us

An original member of the team to establish Sun’s first European research lab, focused on studying multilevel secure trusted networking technologies from an applied research perspective

Palo Alto, Ca, Us

Developed custom software solutions for trusted networking systems for customers with demanding security requirements

Responsible for Java application security design and testing for server-based systems supporting human capital management functions

Palo Alto, Ca, Us

Developed trusted operating system components and supported integrations with value-added resellers for customers with demanding security requirements

Provided software maintenance support for IBM’s AIX operating environment, including code merging of key functions from Unix System V and 4.3 BSD Unix

Developed proprietary Geographic Information Systems (GIS) analysis functions to automate manual analysis of overhead imagery on a large scale