Keith May, Cissp, Iso/Iec Security Risk Management Email & Phone Number

New York, New York, Us

Drive Risk and Control Agenda including policy dissemination, process reviews, risk/control identification, KRI assignments, and developing, enhancing and documenting processes to improve efficiency and strengthening the control environment.Identify and assign key metrics (KPI/KRI) to support effective monitoring and management of operational risks including control assurance and ensuring corrective action plans are raised to address identified gaps.Provide strong oversight of CAP remediation activities both for Audit and control issues including quality completion of Risk Exception documentation and annual renewals.Supporting assigned technology platforms ensuring the timely remediation of corrective action plans relating to both self-identified and and Audit issues.Supporting assigned technology platforms during internal and external audits.Assist with all interactions including deliverables management, audit fieldwork, business monitoring and meetings.

San Francisco, Ca, Us

Assess, Document, and Improve WSI Cybersecurity Risk Posture

Southlake, Texas, Us

Ensured ISO compliant implementation, integration, and coordination of information security risk management activities. Managed policy and exception management program team consisting of 3 FTEs and 1 indirect FTE. Performed iterative security risk assessments to identify, analyze, and evaluate emerging risks in dynamic global environment. • Led diverse cross-functional teams in ISO 27001 Certification Readiness project, achieving 93% compliance rating (0 gaps, 8 Opportunities for Improvement) in an independently performed gap analysis.• Authored and maintained global information security policies and standards covering 100% of the ISO 27001 control requirements.• Implemented cost-efficient structured content management system (SharePoint + Power Automate), improving user experience, advancing the information security communication strategy, and automating management of all ISMS documents.• Established risk acceptance criteria and standard risk assessment and treatment methodology in company GRC system (Archer), achieving consistent repeatable assessment results while eliminating process inefficiencies associated with manual collaboration and monitoring activities. • Developed risk hierarchy and risk register in GRC platform, tying into specific portfolios to better inform key decision makers on types of risk incurred.• Decreased quarterly metric reporting cycles and eliminated need to manually produce functional dashboards and scorecards by developing and implementing key indicator management (KRIs / KPIs) in the Archer GRC system, providing near real-time metric view of risk.• Improved policy exception requests processing, lowering rejection rates 90% and reducing processing times from 10 days to 2.1 days by redesigning Archer advance workflows.

New York, Ny, Us

Directed Group Information Security for Access Management for Solomon Smith Barney and Private Bank. Managed Level III Entitlement Support consisting of 6 FTEs tasked with initiating role-based access controls (RBAC). Oversaw third-party information security assessments on high-risk providers to identify, document, and mitigate information security issues.• Developed role-based access controls (RBAC) for Morgan Stanley Solomon Smith Barney retail business processes and applications, placing 86% of users under role management, eliminating separation of duties issues and ensuring principle of least privilege.• Reduced provisioning times from an average of 10 days to 0 days.• Initiated governance practices for enterprise roles by identifying role owners, creating change request mechanisms, and hosting change advisory board for stakeholders, ensuring only reviewed and approved access was provided to business systems. • Achieved 100% on time completion rate of semi-annual role certifications and entitlement reviews. • Implemented Global Wealth Management role certification process to enable delta entitlement reviews (entitlements outside user’s functional role), eliminating 1.7M required semi-annual reviews.

New York, New York, Us

Acquired by Morgan Stanley

New York, New York, Us

Business Information Security Officer (BISO) aligned with Citigroup Private Label Credit Card line of business to provide leadership on all aspects of corporate information security initiatives. • Acted as primary liaison between Executive Business Leadership and Corporate Risk and Security function. • Led Risk Control Self-Assessments (RCSA) to ensure that information risk was identified, developed mitigating controls, tracked and reported mitigation efforts, and managed risk acceptance process. • Primary Information Security point of contact for internal and external audits completed 41/41 internal and external reviews with 0 information security findings issued. As a result, LOB qualitative inherent risk rating for information security improved from Med-High to Low.• Led Business Security Incident Response Team (BSIRT) ensured security events were properly identified, evaluated and responded to.• Conducted thorough in-depth postmortem activities ensuring lessons learned were incorporated in operating procedures.• Conducted third-party information security assessments (TPISA) for critical suppliers.