Michael Swindler Email & Phone Number

Phoenix, Az, Us

Irvine, California, Us

Irvine, California, Us

▪ Built, managed, and educated a team of security engineers on all product and service offerings within the Security Governance, Risk, and Compliance business unit such as: - Development of policies, procedures, standards, and continuity planning (e.g., BIA, BCP, DR, or IRP) documents - Security control development, validation, and testing (utilizing a variety of frameworks and standards including PCI, NIST CSF, NIST 800-53, ISO 27002, or AICPA SOC2) - GRC tool implementation and program creation - Vulnerability management implementation and remediation - Ransomware risk assessment and response planning - Compliance and audit assessment support (e.g., PCI, SOC2, or SOX) o IR, BC, and DR tabletop testing - 3rd party risk management program development▪ Developed collateral, deliverables, and testing/assessment methodologies for all product offerings within the security governance, risk, and compliance practice▪ Managed communication with senior management/C-Suite executives on results of engagements and their associated risks, threats, findings, and recommendations▪ Facilitated incident response and disaster recovery tabletop exercises▪ Developed security program strategies and tool/solution recommendations along with affiliated roadmaps and project plans▪ Performed organization wide threat and risk assessments and provided recommendations across people, process, and technology to fill identified gaps▪ Supported all aspects of the sales cycle including pre-sales, scope development, and creation of level of effort (LOE) and statement of work (SOW)

Irvine, California, Us

Scottsdale, Arizona, Us

Created the controls and process flows for the entire security organization, encompassing all security and technology toolsets. Additionally, developed action and remediation plans to ensure our control environment addressed information assurance standards and regulations (e.g., ISO 27002, NIST 800-53, NIST CSF, FFIEC, and GLBA)Redesigned the company’s user access review process from policy changes to automation of controls (implementation of our IAM tool) to ensure that each layer of user access was being completely reviewed Performed in self-assessments against the FFIEC ISH, FFIEC CAT, GLBA, NIST CSF, and the New York State Department of Financial Services (NYDFS) to ensure we remained compliant to those regulatory standards and frameworksSupported the company’s annual PCI assessment to ensure we remained compliant with the Payment Card Industry standards. Responsibilities included performing PCI scope review, supporting our external QSA, and remediating any identified gaps to maintain our PCI accreditationSupported various internal, external, and government agency audits by performing walkthroughs of processes, providing evidence, and addressing questions or concerns. For any identified exceptions, provided management responses and new process proposals. Additionally, assisted on closing audit findings by creating action and work plans with process owners then performing independent validation to be presented to said agency or auditorDeveloped and distributed various security awareness campaigns to promote best security practices (e.g., security open house and security awareness newsletters) Analyzed risk acceptance submissions across infrastructure and architecture to evaluate proposed policy and procedure exceptions. Once the residual and inherent risk ratings were identified, presented to leadership all artifacts to determine whether the company would accept or deny the risks

Worldwide, Oo

Performed external and internal audits (PCOAB/AICPA compliant including SOX and SSAE16 engagements) over the design, implementation, and operating effectiveness of IT controls.Created and presented technical courses to inform colleagues of new cyber risks, concepts, principles, and security implications within emerging technologies.Performed program governance, data security, and data protection assessments to ensure requirements were meet with accordance to GLBA, HIPAA, FFIEC, and PCI-DSS other applicable laws, regulations, and best practices.Performed system implementation/upgrade evaluations to ensure that the development and implementation of critical applications successfully covered the system development life-cycle phases (SDLC). This included evaluating user acceptance, parallel, and regression testing and analyzing the conversion of legacy data, key configurations, and interfaces.

Valley Forge, Pa, Us

Provided account support services for Vanguard’s largest division of clients. My efforts helped promote account acquisition, retention, and growth by providing custom solutions to best fit each client’s specific needs, investment goals, and noted concerns.Maintained in-depth proficiencies in relevant financial, tax, and legal topics/trends in order to appropriately educate and advise clients on products and services offered by Vanguard that would best serve each client.

Provided technical support for systems, applications, services, and users within enterprise IT environments for a variety of nonprofit organizations.