Steve Marchal Email & Phone Number

Santa Clara, California, United States

Boise, ID

• Managed and Led Cyber Security Governance, Risk, and Compliance (GRC) for a leading platform services (SaaS) provider in the Trucking transportation industry. This includes information assets that support and deliver.
• Collaborated with Business Partners to provide Cyber Security Risk guidance on privacy, contracts, 3rd party risk audits, KPIs and KRIs, RFI/RFPs, internal audit, risk assessments, policies and standards, business.
• Partnered with business partners to provide cybersecurity risk guidance across privacy, contracts, third-party risk, performance metrics (KPI/KRI), business initiatives (RFI/RFP), audits, assessments, policies and.
• Collaborated across departments and led the build out of an Information Security Management System (ISMS) program resulting in the initial ISO 27001 certification.
• Provided annual assurance of ISO 27001 Surveillance Audits and PCI DSS Attestation.
• Directed and coordinated comprehensive security reviews encompassing software, vulnerability management, vendor assessment, architectural analysis, and risk evaluation.

West Des Moines, Iowa, United States

• Technology Risk & Control Self-Assessment (RCSA) and Control Frameworks - Strategy, Operations & Quality Practices.
• Provided risk management guidance and consulting, supporting business groups in designing and implementing risk mitigation strategies, processes, and controls.
• Monitored programs and collaborated on strategic planning with business groups.
• Developed and performed data management functions and communications including reporting on Control Effectiveness, RCSA Scorecard, KPIs and KRIs, dashboards, and training programs.
• Technologies: SHRP (RSA Archer - COBIT), FAIR methodology, CMMI, Tableau Dashboards, JIRA, DMS, micro-learning, MS Office.

Des Moines, Iowa Area

• Provided Cyber Security and Compliance leadership and consultation for a PCI DSS Level 1 Service Provider who is a leading multinational provider in magazine fulfillment, business process outsourcing, and customer data.
• Championed and created a Cybersecurity Program utilizing industry frameworks (CIS CSC, NIST CSF, NIST 800-53, FFIEC, ISO 27001).
• Worked with leaders to grow the culture of Cybersecurity and Compliance in an Agile environment.
• Led Compliance program initiatives (PCI DSS, GIS DOJ, SSAE, GDPR, CCPA), Security/Privacy Assessments, Security Awareness, Policies and Standards, Questionnaires, KPIs and KRIs, and 3rd Party RFPs.
• Spearheaded implementation mechanisms for centralized security log monitoring (SIEM).
• Technologies: AlienVault SIEM, Tenable Vulnerability Management (PCI DSS ASV), OWASP, Cloud (Azure and AWS), IBM AppSec (DAST), Agile/Scrum, Solutionary (PCI DSS), PEN test tools, CVE, CVSS, Change Management.

Des Moines, Iowa Area

• Managed and enhanced Information Security service management, risk reduction strategies, and problem resolution for the largest healthcare provider in Iowa and South Dakota.
• Led the selection, design, implementation, and tuning of security solutions including Network Intrusion Protection System (IPS), Network Data Loss Prevention (NDLP), and Endpoint Protection Suite.
• Championed and enhanced the Vulnerability Management Program and system Configuration Management (CIS Benchmarks) program to meet and exceed compliance requirements. Provided governance oversight and reporting results.
• Evaluated key industry vendors, conducted proof-of-concept pilot reviews and led the selection, design, implementation, and tuning of Network Intrusion Protection System (IPS), Network Data Loss Prevention (NDLP).
• Managed secure messaging environment and work with the Privacy Office to enhance detection and blocking of messages with PHI to meet new HIPAA reporting requirements.
• Technologies: Compliance (HIPAA/ HITRUST) McAfee Security Suite (Vulnerability Manager/ Database Scanner, McAfee ePO, CVE, CVSS, Change Management (ITIL), Anti-malware, NIDS/NIPS, HIPS, NAC, DLP), Oracle Identity.

Bloomington, Illinois, United States

• Security Operations Center (SOC) activities, ensuring 24/7 problem resolution and change management for one of the largest private networks.
• Served as the primary point of contact for technical issue resolution and customer support, maintaining the security of network and information systems through proactive measures.
• Implemented robust defenses against unauthorized real-time attacks and probes, utilizing: Network Intrusion Detection, Host Intrusion Prevention, Endpoint Protection (Antivirus/Malware/Firewall), Network Firewalls.
• Technologies: Internet Security Systems (ISS) NIDS, HIPS, Symantec Antivirus Corporate Edition, Trend Micro IMSS, Email Gateway, Sendmail, Nokia/Checkpoint Firewall-1 NG, Sidewinder Firewalls, Gauntlet Firewall.

Cedar Rapids, Iowa, United States

• Managed, lead, research, analyze, design, plan, and organize corporate-wide security functions for the Chief Information Security Officer (CISO).
• Develop and maintain policies, standards, security baselines, and procedures to ensure alignment with industry best practices and regulatory requirements.
• Conduct comprehensive risk and threat assessments to identify vulnerabilities and prioritize security measures.
• Design and deliver user awareness training programs to foster a culture of security awareness throughout the organization.
• Provide incident response and investigative support as part of the Computer Incident Response Team (CIRT), ensuring timely and effective resolution of security incidents.
• Conduct architecture reviews and product assessments to evaluate the security posture of existing systems and recommend enhancements.