Robert M. Email & Phone Number

• I managed the entire Vendor Risk Management Framework using GRC tools like One Trust.• I handled the Security Compliance Assessment of numerous third party vendors/suppliers ensuring they are compliant with Security standards as well as Data Privacy regulations• I worked within scrum teams working in an agile manner whilst collaborating with other business departments• I reviewed vendor risk reports highlighting cybersecurity impacts• I created risk review documentation and used a risk tiering formula to prioritize for remediation the risks identified based on their severity.• I created a risk treatment plan using ISO27001 standards which was used by the organization to carry out risk assessments and compliance analysis across all areas of the business.• I managed the Information Technology Risk Management Framework including the Risk register for the organization• I acted in a Second line of defence capacity challenging, reviewing and reporting of risk exposure, events and emerging issues • I supported the renewal of the organization’s Cyber Essential plus certification• I created a compliance discovery questionnaire template which we sent to all business areas to answer which aided in my analysis of the different business areas • Based on the responses of the compliance questionnaire, I carried out risk assessments on their business processes and procedures. • Using a Risk Management tool I managed the Risk backlog and took actions to remediate all open risks • Worked very closely with Legal team during third-party negotiation sessions to ensure contracts where compliant with our security objectives• I identified all business owners for all suppliers and ensured that all risks associated with that vendor is brought to acceptable levels. • Managed relationships with key stakeholders to influence and support the delivery of appropriate Cyber security products

• I was the sole security analyst working on the organisations process and ensuring that our current processes align with the requirements of GDPR• As part of the initial GDPR Initiation team, I created a data inventory template which was used by the organisation to carry out data investigation across all areas of the business. • I analyzed and mapped out the requirements of the GDPR regulation to that of ISO27001.• I created and maintained a requirements document for the implementation of ISO27001 controls• I created the standard operating procedures used by the business to manage the process of Data Subject Access Requests. (DSARS)• I carried out a data investigation exercise with the aim of understanding what personal information we hold, how we collect these personal information, if we have the right level of consent to process the data and what the security controls are in place around the storage of the personal data.• I also did a deep dive into the technology applications used in processing the personal information of data subjects. • I created a workflow process that made the processing of the rights of the data subjects very seamless especially The Right of Access and The Right to be Forgotten.• Elicited high level requirements and analysed these requirements in line with the directives of the regulation.• Analysed all Data entry points to ensure that all Personally Identifiable Information (PII) captured has the right degree of privacy measures in place• Worked very closely with the Global legal team to ensure that key GDPR requirements captured are compliant with the regulation.• Worked very closely with the Data Protection Officer to develop an action plan that would consider synergies between business lines or entities for execution.• I created and maintained the Article 30 Records of Processing register.

• Involved in the privacy impact assessment of the GDPR on the business processes, systems, procedures and controls• Analysed all customer online journeys and analysing how customer data is being collected via our online presence.• Developed a privacy impact assessment template which provides an overview of key requirements and related questions for each of the key categories such as Customer/Employee, Process, Systems, People/Capability, Governance• Elicited high level requirements and analysed these requirements in line with the directives of the regulation.• Analysed all Data entry points to ensure that all Personally Identifiable Information (PII) captured has the right degree of privacy measures in place• Worked very closely with the Global legal team to ensure that key GDPR requirements captured are compliant with the regulation.• Consolidated feedback from the privacy impact assessment for the business to review• Worked very closely with the Global transformation team to develop an action plan that would consider synergies between business lines or entities for execution.• Worked with the technical teams to ensure all software development work done took into consideration the GDPR’s Privacy by Design article.• Worked very closely with the product owner to define a detailed plan for delivery

• Managed and monitored Data Protection regulatory framework to maintain compliance across the Vodafone group• Monitor, report and respond to Data protection incidents including maintaining the Data protection incident register.• Analyzed Data requirements to ensure it supports the business plan and strategy• Prepared Data protection documentation for review and validation• Performed validation checks on Data protection risk and compliance review documents• Analyzed business processes and communicated gaps in regulatory and legislative compliance to the stakeholders• Facilitated regulatory workshops with business stakeholders to identify Data protection risk areas and come up with strategies to mitigate those risks• Presented impacted assessment feedback and recommended possible improvements to senior stakeholders• Influenced strategy decisions made by senior stakeholders.• Define and document processes to support compliance with GDPR• Worked very closely with offshore Data compliance teams• Managed and led a team of junior business analysts. • Used workshops and interviews to capture, validate information, elicit requirements and identify opportunities for business improvement.• Worked closely with Senior Management, Business Owners, Project Manager, Development Teams and all relevant Stakeholders to ensure smooth delivery of the product from planning through to launch and beyond.• Worked closely with Business owners to understand the product aims and requirements. Conducted thorough customer and commercial analysis helping to refine the product scope and offering.• Worked with the data compliance manager to develop a thorough product delivery plan and roadmap.• Created and managed the Data inventory• Worked with the Project Manager to develop a thorough product delivery plan and roadmap.