Marv Chen Email & Phone Number

Los Angeles, California, United States

Texas, United States

Boulder, Colorado, United States

Burbank, Ca

Developed common standards for security architecture across Technicolor Production Services brands worldwide (MPC Film, Mill Film, Mr. X, MPC Advertising, The Mill, MrX, Technicolor Post, Mikros Animation). Assessed content security risks of sites globally to industry best practices and facilitated customer requested content security audits and assessments. Developed onboarding processes for cloud-based projects and conducted internal security risk assessments of new technologies, platforms, and services. Architected solutions along side project teams to mitigate identified risks. Worked with content security peers at major studios in areas of shared interest (e.g., development of industry content protection standards, assessing vendors' applications security posture). Investigated security incidents ( working with the SOC, gathering evidence, assessing impact, and reporting back to stakeholders.) Challenges to the role include the following: 1) finding creative solutions to securely access or move data through logically isolated restricted security zones - balancing productivity vs security; 2) developing working from home technical standards for remote access and remote endpoints for an industry that traditionally relied an on-premise castle model; 3) creating unified standards for brands with unique cultures and heterogeneous technology environments.

Greater Los Angeles Area

Conducted content security assessments of production and post-production facilities. Assisted facilities in developing creative solutions to meet TPN (Trusted Partner Network) / MPAA content security best practices and content owner requirements. Developed internal toolsets to increase quality and speed of the assessment work.Led the network vulnerability and penetrating testing practice. Performed network penetration testing including exploitation phase activities on media/entertainment industry vendors. Developed an automated system to conduct network port and vulnerability scans and produce monthly reports that could scale to hundreds of clients.TPN Qualified AssessorGIAC GPEN (Penetration Tester Certification) PENDING

Sherman Oaks

Led a subcommittee of the MPAA Content Security Working Group for the maintenance of MPAA Best Practices Common Guidelines. Proposed new or refined existing controls with MPAA member studios and built consensus for updates to Best Practices. Released a major revision of the Best Practices in December 2017 and instituted a quarterly update process to ensure that Best Practices would not remain stale.Major contributor in the development of the Trusted Partner Network (TPN): developed TPN assessor qualification criteria and written examination materials; led a team consisting of MPAA member studios and CDSA to determine requirements for a common electronic delivery platform for vendor security audits; served in a dual role as scrum master and development team member for the TPN platform; developed audit workflow and quality criteria for audit engagements and related training materials. Conducted (two-person audit team) over 120 vendor site surveys and security assessments according to MPAA Best Practices, including network vulnerability and penetration testing. Developed internal guidelines, tools, work programs, and workflow processes for the vendor site assessments. Trained MPAA staff members in technical audit and vulnerability test techniques. Collaborated with member studios to understand industry concerns, build trust, and improve quality of deliverables

Led IT and information security consulting and audit teams. Developed clients’ information security and vendor management programs including risk assessments, and business continuity plans (including business impact analyses and disaster recovery testing). Performed audits in the following areas: IT, information security, vendor management, BCP, GLBA, ACH, and electronic banking. Developed SOX narratives and performed SOX controls testing. Mentored junior staff and responsible for final review of all engagement deliverables from the engagement teams.Optimized internal workflow processes for managing simultaneous client engagement teams while ensuring quality and consistency of deliverables. Instilled a culture of continuous improvement by identifying internally weaknesses, comparing deliverables with that of competition, and implementing incremental improvements. Kept abreast of the latest government mandated regulatory requirements. Enhanced internal audit work programs and report formats. Developed customized audit work programs for clients based on FFIEC IT Handbooks, ISO27002, COBIT, PCI-DSS standards, risk assessments.Increased employee productivity and addressed increased regulatory and industry security requirements by implementing secure cloud applications: real-time Internet-based collaboration software; secure document storage and transfer; knowledge databases; encryption of e-mail and data on mobile computing devices. Developed computer-assisted audit tools for data mining and task automation.Performed the following audits and assessments for bank clients and service providers: information technology and information security; Gramm-Leach-Bliley Act (GLBA); SAS70 and SSAE16; network penetration tests and vulnerability assessments; SOX Section 404 Compliance; electronic banking; Bank Secrecy Act, Patriot Act, and Anti-Money Laundering; ACH rules and wire transfers.

Implemented an Information Security Program: assessing risks, writing policies, scheduling audits, remediating findings, adjusting the program, implementing secure technologies, and reporting to senior management and the board of directors. Implemented risk based Vendor Management Program for due diligence and monitoring of the bank’s third-party service providers. Developed risk scoring system and vendor questionnaires. Reviewed vendor contracts and audit reports to ensure compliance with regulations and risks were acceptable to management.Oversaw technology operations and maintained a service oriented IT support environment with a small staff augmented by several technology service providers. Implemented intranet applications to prioritize, track status, and measure costs of IT tasks, projects, ongoing operational procedures. Managed the regulatory, compliance, and SOX financial reporting aspects of information security, IT, vendor management, and BCP. Tracked open issues and implemented corrective actions to avoid repeat findings or weaknesses noted by regulatory examiners, auditors, or accountants. Sought cost effective solutions that not only remediated findings but increased efficiency of operations. Designed and implemented an “active-active” disaster recovery environment to ensure minimal downtime in accordance with management’s desire to serve a highly demanding customer base. Implemented dual electronic backup vaults, replicated servers, and dual connections (with load sharing) to the Internet and core service provider with automatic failover via a ring WAN topology. Implemented firewall, IDS, content filtering, malicious code filtering, and other information security controls. Supervised the design and installation of electrical, data, and phone facilities of the new headquarters building. Oversaw a transition plan to move personnel and equipment from two existing locations to the new building without adversely affecting day-to-day operations.

Appnet / Commerce One / Connective Commerce CorporationDeveloped detailed implementation plans for a large-scale B2B and B2C ecommerce Web Marketplace design for a large multinational agrochemical corporation. Designed detailed network and server infrastructure. Budgeted five-year costs for staff, software engineering, and infrastructure construction. Analyzed and recommendations for e-commerce marketplace platforms. This effort was performed in partnership with Appnet Business Strategy group.Designed an Enterprise Directory Services (iPlanet LDAP) architecture for a national grocery manufacturing and processing conglomerate to provide centralized security administration through an authoritative global directory database. Designed distributed directory services replication architecture and directory namespace and schemas to specific application requirements. Identified integration issues with Lotus Notes Workflow, IBM Web Sphere applications, and Microsoft Active Directory.Assessed web security for a midsized city in the USA. Produced a web security gap analysis, recommendations, and high-level roadmap, for the city’s e-Government initiative. Deliverables included logical network designs (perimeter security, firewalls, VPN, IDS), network penetration test results, baseline security assessment, and enhancements to policies and procedures.Consulted for an automobile liability insurance motor club as an IT technical architecture and security expert. Evaluated solutions for network vulnerability scanning, firewall, VPN remote access, and intrusion detection systems. Implemented Internet connectivity with content filtering, malicious code scanning, and usage metering for five thousand users. Wrote distributed computing security and Internet-use policies. Performed formal security risk analysis, security vulnerability assessments, and penetration tests.