Scott J. Wright Email & Phone Number

Ridgecrest, Ca, Us

Us

• Primary security contact and customer support liaison for all 3rd party reviews.• Testing and reviewing internal and external AI utilization.• Conducted 3rd party reviews of AI weights, data sets, frameworks, training, models & ethics.• Leading program security via purchasing, PMO and communication with all Sr. team leaders.• Managing AI research projects for: ChatGPT, MS Copilots for; Security, Azure, Office 365 etc.• Identifying learning models deterministic & non-deterministic responses for proposed business cases.• Documentation using ChatGPT for MS Azure ARC integration of Azure & Security Copilots.• Occasional minor script(s) creation/edits in Python.• Review of AI model usage such as; LLMs, GANs, VAEs, GPT-4, Jarvis, RAG, Bedrock FMs, etc.• Validating Gen AI ethics existence and analysis of 3rd parties and internal use cases.• Large Learning Model (LLM) location storage usage and data redaction reviews. • Strawberry and MeshTensorFlow DNN(s) tools viability research.

Us

• Primary contact and customer support for everything security related to the CA COVID programs.• Security control(s) oversight and policy creation / management for the programs.• Managed program change control and the PMO.• Creating policy for access to sensitive PHI and PII in managing the CA State COVID infrastructure

Us

• Integrated vulnerability & compliance monitoring tool results to remediation workflow activities• Developed advanced KPI & KRI reporting applications & managed risks for; ISO programs, vulnerability, remediation tracking and validating mitigations reported as completed.• Directed the documenting of architectures, strategic plans, tactical approaches & SecOps. • Managed the design of security for; AWS, Azure, VM’s & serverless application instances.

Alameda, California, Us

• Author of all security; policies, governance methodologies, strategies and procedures.• Developed the ISO GRC, vulnerability, reporting, and 3rd party oversight programs.• Managed the internal audits of all endpoint and perimeter systems. Optimized supporting procedures, ascertained risk postures and drove remediation activities to conclusion. • Oversight of HighTrust, HIPPA, CIS, NIST and ISO 2700x compliance requirements.• Creation, management and monitoring of the overall information security program budget. • Instituted key risk indicators (KRI) and key performance indicators (KPI) reporting and dashboards for the CIO and the Board of Governors.• Created training programs for; phishing avoidance, management responsibilities, technical incident handling, general staff information security awareness and duties.• Specified, negotiated and managed 3rd party security of cloud vendors to required SLA’s.• Created and lead the information security portions of the emergency response program.• Partnered with the PMO to identify and incorporate security requirements into new projects.• In conjunction with engineering teams implemented authentication cloud broker technologies.

Us

• Built a series of cloud based GRC applications for information security with compliance & governance harmonization of; policies, standards & asset management. Incorporated easy to create workflow automation with integrated tracking & audit trails that support full Petri net functionality and security tool integrations.• Development and management of a small application development security team.• Managed scope, feature sets, costs, budgets and risks in an Agile methodology.

San Jose, Ca, Us

• Developed an ISM engagement business roadmap to identify and reduce business risk exposures by the tracking of residual risk and the compounding of exceptions granted into total sum exposures.• Provided actionable metrics to business and ISM staff to track and schedule the remediation of risks.• Removed subjectivity in the triage and assignment of engagement tasks.• Designed an improved feedback collected from security business engagements.• Identified and assimilated metrics for a business dashboard to demonstrate business risk exposure and residual risk providing actionable metrics to business to track and remediate risk. Personally coded the metrics dashboard in MS DOT NET with a MS SQL backend database.• Provided consulting to processes for utilizing vulnerability report data and other data points into engagement solutions and messaging.• Defining and assisting in running a weekly audience with key stakeholders to review exceptions, decisions on project/business engagements & security deep-dives on certain business features.

Mountain View, Ca, Us

• Kick started a zero trust cloud network initiative, managed operational compliance requirements and tracked remediation efforts to create alignment with business and strategic objectives.• Reviewed all security, policy, governance and procedures to deliver a 360 degree view of the remediation and prioritization required to launch the BeyondCorp program.

Westlake, Texas, Us

• Developed and implemented a new vendor information security oversight process. Used this new process to review 120+ critical vendors, closing a large backlog of vendor security reviews. • Vendor oversight included detailed reviews of; policy, audit findings, penetration & vulnerability testing results, perimeter architectures and security models for high volume 24x7 applications.• Generated risk advisories, revised workflow processes to meet a large range of financial compliance criteria and to supply solutions to outstanding FED audit findings for third party oversight gaps.• Specified required architectural change requirements and negotiated timelines for completion.• Specified additional security controls, monitoring, event notification requirements and change management processes.

Elk Grove, California, Us

Developed and implemented 3 programs: Disaster Recovery, Asset Management & IT Security Audit for California Corrections Health Care Services.

Mather, California, Us

Security oversight for the complete replacement of all legacy California Emergency Management Agency statewide emergency response applications.

Schaumburg, Illinois, Us

ISACA is the pace-setting global organization for information governance, control, security and audit professionals. Its IS auditing & control standards including COBIT are followed worldwide. Its research pinpoints professional issues challenging its constituents. Its CISA certification is recognized globally and has been earned by more than 60,000. The CISM certification uniquely targets the information security management audience and has been earned by more than 10,000. The newer CGEIT designation promotes the advancement of professionals who wish to be recognized for their IT governance-related experience and knowledge. It hosts a series of international and local conferences focusing on both technical and managerial topics pertinent to the IS assurance, control, security and IT governance professions. ISACA & its affiliated IT Governance Institute lead the IT control community and serve its practitioners by providing the elements needed in an ever-changing worldwide environment.

Oakland, California, Us

• Created physical perimeter identity management & access controls for a new multi-function badge and smart card system integrated to logical security. • Automated the emergency replacement of 35,000+ personal access cards.• Integrated NERC training validation requirements to the physical access control systems.

Sacramento, California, Us

Tasks included; developing a new Information Security Strategy for the Department of Motor Vehicles.Established a formal risk management program for the Information Security Office for the Department of Health Care Services (DHCS)Integrated secure coding practices into the SDLC processes. (DHCS)Consultant to all business program owners in the areas of security, risk management and all compliance activities (HIPAA, FISMA, SB.)Represented agencies at the following state level architecture groups: Secure healthcare information exchange, federated identity management, consolidated email security & others.

Head of Compliance, Internal Audit and anti-fraud for this smaller multinational public company. Engaged by the BOD Audit Committee I was responsible for the following programs:o End to end SOX program (Years 1 & 2 - Finance & IT General Controls)o Owner of the Finance and IT Internal Audit departmentso Lead the company’s anti-fraud programs. o Managed all InfoSec, compliance and audit budgets for a department staff of 25o Chairman of the SEC Disclosure Committee.

Worldwide, Oo

• Public IT Auditor of SiteLite (managed application services provider)• Public IT Auditor of Savvis (aka Cable & Wireless, Exodus, Intel hosting…)• ISO Internal IT controls assurance and baseline controls creation for Clorox (ISO 17799)• Public IT Auditor of Gymboree (Retail chain)• ISO Internal IT audit Silicon Graphics (SAP Focus)• Internal IT audit & assurance KLA Tencor (Semi-Conductor Industry)