Michael Krakaur Email & Phone Number

Led Information Technology through two annual Sarbanes-Oxley (SOX) audits. Partner with Internal Audit to rationalize audit cycles to focus on Key Risks and Controls. Enhanced User Access request and approval process. • Focus on key Information Technology General Controls (ITGC) for Sarbanes-Oxley (SOX) audits reviews• Identify key controls, assess controls for design or operational deficiencies, and develop remediation plans to reduce control failures• Serve as a subject matter resource to assess compliance implications related to technical implementations or operational processes• Lead Change Management process enhancements and Change Advisory Board meetings

Executed a variety of risk management activities to identify and assess controls maturity; identify control gaps; ineffective controls or inefficient processes. Identified Key Control Indicators and Key Risk Indicators to assist technology process owners to detect potential gaps, controls operating effectively or ineffectively. Developed Process Risk Control Matrices or Risk Assessments for cloud engineering, patch management, logging and monitoring, job scheduling and data management.• Developed control dashboards to monitor metrics for early notification of risk trends to alert potential control failures• Served as an advisor to multiple technology process or control owners providing guidance on process design or control documentation, tool or process risk reviews• Reported current risk profile and highlighted emerging issues via annual Risk Assessments, Process Risk Control Matrices or targeted software assets at monthly stakeholder meetings or ad hoc risk reviews. Developed and issued risk dashboards and reports for internal stakeholders. Provided analysis of data to assess program effectiveness for stakeholder strategy decisions• Performed technical risk assessments of security, operational controls and processes, and Systems based of NIST Cybersecurity Framework and Publications, SOX and COBIT5• Risk Lead for several high-profile vulnerability management projects. Used reports generated from Nessus and Kenna Security vulnerability management scanning tools to review and assess• Led the enterprise patch management project. Assessed patch management processes and results to advise on gaps and recommend program or process enhancements• Coordinated with Issue Owners developing remediation plans and milestones to address issues identified by the Regulator Agency, Internal Audit or self-identified and tracked projects to completion• Directed a cross-functional response to a Regulatory Agency inquiry for a cyber-risk management gap analysis

Rockville, Md

Managed enterprise security to provide assurance to the IT organization’s system of governance, risk management and compliance. Led information technology resource during implementation of a global Information Security Management System using ISO 27000/27001.

Rockville, Md 20906

Managed IT security and compliance to provide services to help accomplish assurance objectives. Instituted a systematic, disciplined approach to the evaluation, improvement, and effectiveness of risk management, control, and governance processes. Provided timely budget, results, forecast figures and financial information for 12 million dollar IT budget. Assisted IT organization through optimizing cost performance. Partnered with procurement to obtain better pricing and terms. Ensured compliance with software licensing agreements and vendor contracts. Reported IT monthly metrics to CIO

Rockville, Md

Provided the IT organization with effective and efficient delivery of a project. Communicated timely, accurate and meaningful information to key stakeholders. Brought value to the company by managing business projects: major ERP system upgrade; automated time collection and daily job reporting for contracting division; developed key daily metrics for business extracting data from multiple systems into Cognos data cubes; documented detailed narrative and Visio documents for order to cash business processes; managed several invoice systems upgrades. Adopted and delivered training on the Project Management Approach methodology. Promoted the value of standardized project management practices internally and with business partners. Communicated to Corporate IT and regional management on current and proposed CAPEX projects, identified root cause, defined product or services, and return on investment estimates. Developed scoping and requirements document for new initiatives