Ryan Gall Email & Phone Number

Clayton, Nc, Us

North Carolina, United States

⦁ Established and defined the periodic assessment revalidation process for KPMG. Thisincluded defining the procedure, the schedule, and the periodicity of performing securityassessments on applications that hold sensitive information but also have not beenreviewed within the last 12 months⦁ Led the team to accomplish goals and reduce turnaround time. This was reflected in themonthly meetings held with the CISO⦁ Led Resource Management at their request to identify gaps in their strategy. Misalignedsystems and responsibilities were the top concerns.⦁ Perform risk and controls assessments focused on applications that have been inproduction for years without anyone revisiting security controls in place. SSL v3encryption in transit was OK years ago but would need an upgrade today.⦁ Identify gaps in the security of applications and go through risk resolution, mitigation, oracceptance. Risk acceptance requires business owner acceptance and in cases ofincreased vulnerability, CTO and sometimes CISO risk acceptance⦁ Provide business application owners with an Authority to Operate (ATO) certificationreflecting the completion date of their latest security assessment⦁ Identify interoperability issues and architect business, process and technology solutions toresolve issues across multiple systems and lines of business.⦁ Perform security review of Data Center Operations, Physical & Network Security, Storage(SAN, NAS), Data Center Assessment⦁ Mitigate IT risk and compliance, working across organizations, identifying cyber riskthreats, and working with project teams to identify secure viable solutions to mitigate oreliminate risk⦁ Function as a subject matter expert in several IT security domains (e.g. access control,cryptography, monitoring, etc.)⦁ Guide developers on recommended controls and countermeasures; present test findingsand interface with stakeholders; liaise with external 3rd party pen testers as required

Raleigh, North Carolina, United States

⦁ Redesigned the KPMG US vendor management program to improve operatingprocesses, assessment and vendor metrics; created procedures, presentation materialsand tracking documentation for management communications and metrics⦁ Completely revised the third-party security assessment program to include mandatoryremediation plans, re-tiering of all vendors, and risk acceptance from the stakeholders.Met with KPMG management committee and provided the project proposal, timeline,milestones, and cost to execute and received full requested funding⦁ Worked with Risk Management and Legal to rewrite the Information ProtectionAgreement to be included in all third-party contracts to protect KPMG and KPMG clientdata⦁ Perform risk and controls assessments focused on supplier governance, strategy andoversight, onboarding, ongoing monitoring, subcontracting, continuity of business, securityassessments, and exit strategies for significant third parties⦁ Responsible for Information Security Assessment details and artifacts captured to supportSOC audits of systems at KPMG⦁ Conduct security assessments to evaluate vendor security programs and identify risks toKPMG data handled by Cloud and non-Cloud vendors; drive and track vendor remediationefforts⦁ Perform the vendor security review process which includes vendor classification, workingwith vendors to acquire assessment material, performing assessment and risktracking/communication⦁ Manage and track IT vendor risk-related documentation in GRC (Governance Risk andCompliance) applications like Archer and/or SharePoint⦁ Create security testing plans and test cases using improved security testing artifacts andprocesses that I helped design⦁ Provide expertise related to Risk, Security, Vulnerability, and Compliance Assessmentsplus Mitigation and Remediation Guidance to firm Technology Projects based upon NIST,ISO, and OWASP

Montvale, New Jersey, United States

⦁ Identify interoperability issues and architect business, process, and technology solutionsto resolve issues across multiple systems and lines of business.⦁ Expert in the implementation of offshore security controls and policy configuration forvirtual environments accessed by offshore or remote users⦁ Perform security review of Data Center Operations, Physical & Network Security, Storage(SAN, NAS), Data Center Assessment⦁ Mitigate IT risk and compliance, working across organizations, identifying cyber riskthreats, and working with project teams to identify secure viable solutions to mitigate oreliminate risk⦁ Liaise with IT and other representatives of assigned business functions to ensure thatproject pipelines are understood and that project priorities are reflected in IT Risk &Security resource planning⦁ Lead Security Manager on the largest and first cloud migration initiative for KPMG.Assisted in the design, issued requirements, and assisted in liaising and communicatingfindings from static code review as well as penetration testing. Collected artifactsleveraging my AAD account in the environment. Document findings and instructed theteam to identify remediation plans, and presented the findings to the CISO, CIO, CTO,and National Managing Partner.⦁ Function as a subject matter expert in several IT security domains (e.g. access control,cryptography, monitoring, etc.)⦁ Guide developers on recommended controls and countermeasures; present test findingsand interface with stakeholders; liaise with external 3rd party pen testers as required⦁ Develop detailed work plans, schedules, and resource plans for recurring penetrationtests; establish and report on metrics to gauge pen testing effectiveness, progress, andkey risk areas identified through audits⦁ Monitor remediation activities; maintain awareness of the current security threatlandscape⦁ Develop Security baseline, assessment, governance, risk, compliance and mitigationstrategies

Bs, Business Administration (Mis)

Ba, Geography (Gis)