Mark Steger Email & Phone Number

Driving Technology deployment and executing the delivery of global IT and security solutions Develop appropriate Framework and Governance process for initiation and execution of global projectsManage project migration activities across the IT and security portfolio including status, escalations, finance, procurement, and resource managementDeveloped Technology Migration Roadmap and Deployment Planning for Member Firms adoptionTransition technologies and services from deployments to Operations

Managing large highly complex concurrent multimillion-pound security transformation programs across 96 countries in EMEA.Engaging with all levels of senior management to ensure commitment to projects at the outset and through the whole project lifecycle .Working with 3rd party vendors for procurement of products and servicesProducing regular senior management reporting across all aspects of programme management governance

Cheltenham, United Kingdom

Manage all security changes to ensure Group processes consistently followed and optimize quality of changes to reduce issues as a result of change.Lead the operational security response on major incidents globally and manage the security incident response process to reduce repeat incidents.Ensure compliance for security operations globally to audit & risk requirements, acting as stakeholder lead for Audit and Compliance functions, with a focus on compliance improvements and consolidated reporting and tracking.Lead problem reviews across the Group to identify any security related issues and manage improvement actions.Responsible for financial performance & management for all aspects of global Operational Security contracts and budgets, with a portfolio in excess of $34m, including contract renewals and regular supplier reviews.Provide management control and oversight across operational security services covering; stakeholder engagement, communications & service awareness, SLA and KPI management and reporting, project management, resource management, management information.Facilitate and lead Operational Security engagements in major Group IT programs such as data centre migrations.

Manage all security changes across the Group and lead the information security response on major incidents globally.Maintain information security requirements for new projects globally and enforce compliance Sign-off Information Security projects, ensuring governance processes are followed for production implementation.Report on all aspects of information security delivery across the Group.Global single point of contact into Information Security for all business units.

Cheltenham, Uk

Accountable for ensuring governance procedures are implemented within IT in accordance to Group information security requirements. Ensure the information security policies and standards are complied with, both by Zurich and 3rd parties. Assess and manage risks to Zurich’s data held on information systems. Act as deputy ITGRC lead globally.Manage all global outsourcing providers of information security services to Zurich. Ensure they are delivering operational security services according to the contracts and in compliance to Zurich security policies.

Managing the governance elements of all security aspects of global outsourcing deals, both IT and business outsourcing. Leading the SOX and ISAE3402 audit requirements of the IT outsourcing deals.Manage all aspects of the security elements of the major IT outsourcing deals including governance meetings, compliance to contract, insourcing, contract changes, operational security services and KPI monitoring.Lead contractual security requirements for new or renewed global IT contracts and supplier selection process.Implemented and led quarterly supplier review meetings with all key security suppliers, utilising scorecards to drive improvements.

Member of the Group IT Risk leadership team, responsible for global strategic planning and direction, implementing key global initiatives, leading global security projects and management support for the leadership team. Accountable for the information technology risks and security of the business units within the EMEA region, and setting policy, risk analysis and reporting, strategic planning, regular risk and security assessments, investigations, security architecture, systems and application security controls and operational security. Interface into the country CIOs and business assurance functions, providing consultancy, support and direction on IT Risk, compliance and Security.Established governance and assurance processes and the formation and chairmanship of a Global Information Security Committee.Carrying out annual security risk assessments for business units, identifying and costing mitigating actions and implementing those actions while involving all levels of management in the process. Define and implement an education and awareness campaign in cooperation with corporate communications, utilising various communication channels. Represent Zurich at external organisations and bodies including the Association of British Insurers and presenting at the annual international Information Security Forum (ISF) congress.

Management of the corporate security department which had two primary roles, the first being technical consultancy for the strategy, development and maintenance of security aspects for all multi-client IT infrastructure. The second was a support area responsible for monitoring security and the administration of over 11,000 users and 150 local security administrators. Overall corporate responsibility for the implementation and compliance monitoring of the Information Security Policy. This included the definition and maintenance of a comprehensive Information Security Management system produced in line with BS7799. Liased with and reported to internal business units and directors, external clients, auditors and regulators on compliance to security policy.Management of all security aspects of new outsourcing business opportunities from initial proposals and costs, security reviews using CRAMM, reporting, through to implementation and support. Supervision and investigation of security breaches including police involvement. Project management of a number of high profile projects including the security aspects of deregulation in the electricity market.Project managed the implementation and delivery of disaster recovery for a client to meet the requirements of the electricity regulators in very aggressive timescales and costs. Consultancy role in the feasibility stage of a Group wide disaster recovery plan.

Building the security team from scratch, it developed and was accepted in the organisation, as the focal point for IS Security. Produced from new the IT Security policy and supporting documentation, including Logical Access Control standards and the definition of security responsibilities for senior management based on BS7799. The management of many projects addressing corporate security policy and strategy. Initiation and progression of regular user and system reviews. Responsibility for all mainframe, financial payment and image systems security, utilising both internal and external security products.

Define the Corporate anti-virus policy, which meant analysing the requirements, implementing the policy and training and educating users. The final solution was installed on over 7,000 PCs. Chair the Remote Access Working Group, which approved all remote connections. Review PC security products; install and support security products on laptops and sensitive PCs. Assess security for a major new mainframe system. Carry out mainframe security administration on Unisys, IBM and Tandem mainframes as well as encryption key management. Set-up and chaired the National Building Society Anti-Virus workgroup.

Working on the mortgage system analysing business requirements and converted these into production programs covering all aspects of the mortgage process. This included ongoing maintenance and enhancements to the system.