Steve Marchal Email & Phone Number

Santa Clara, California, United States

Boise, Id

Managed and Led Cyber Security Governance, Risk, and Compliance (GRC) for a leading platform services (SaaS) provider in the Trucking transportation industry. This includes information assets that support and deliver its platform services including load planning, transportation management, telematics, route optimization, real-time rates, negotiation tools, factoring, and other shipping logistics tools.• Collaborated with Business Partners to provide Cyber Security Risk guidance on privacy, contracts, 3rd party risk audits, KPIs and KRIs, RFI/RFPs, internal audit, risk assessments, policies and standards, business continuity, disaster recovery, vendor management, vulnerability management, and application security.• Partnered with business partners to provide cybersecurity risk guidance across privacy, contracts, third-party risk, performance metrics (KPI/KRI), business initiatives (RFI/RFP), audits, assessments, policies and standards, business continuity, disaster recovery, vendor management, and application security.• Collaborated across departments and led the build out of an Information Security Management System (ISMS) program resulting in the initial ISO 27001 certification.• Provided annual assurance of ISO 27001 Surveillance Audits and PCI DSS Attestation.• Directed and coordinated comprehensive security reviews encompassing software, vulnerability management, vendor assessment, architectural analysis, and risk evaluation.• Served as a member of the Change Advisory Board, Privacy Committee (CCPA/CPRA), GRC Group, AI Group, and Security Champions, where I contributed as a trainer and awareness advocate.• Technologies: DRATA (ISO 27001), A-LIGN ASCEND (ISO 27001), Rapid7 Insight VM/IDR, CrowdStrike, Orca, Synopsys Black Duck (SCA), SonarQube (SAST), Axonius, JIRA, GitLab, Agile/Scrum, SecureScan (PCI DSS), SIG, CAIQ, SharePoint, Confluence, AWS, Azure, GCP, CVE, CVSS, Change Management, MS Office.

West Des Moines, Iowa, United States

Technology Risk & Control Self-Assessment (RCSA) and Control Frameworks - Strategy, Operations & Quality Practices.• Provided risk management guidance and consulting, supporting business groups in designing and implementing risk mitigation strategies, processes, and controls.• Monitored programs and collaborated on strategic planning with business groups.• Developed and performed data management functions and communications including reporting on Control Effectiveness, RCSA Scorecard, KPIs and KRIs, dashboards, and training programs.• Technologies: SHRP (RSA Archer - COBIT), FAIR methodology, CMMI, Tableau Dashboards, JIRA, DMS, micro-learning, MS Office.

Des Moines, Iowa Area

Provided Cyber Security and Compliance leadership and consultation for a PCI DSS Level 1 Service Provider who is a leading multinational provider in magazine fulfillment, business process outsourcing, and customer data management.• Championed and created a Cybersecurity Program utilizing industry frameworks (CIS CSC, NIST CSF, NIST 800-53, FFIEC, ISO 27001).• Worked with leaders to grow the culture of Cybersecurity and Compliance in an Agile environment.• Led Compliance program initiatives (PCI DSS, GIS DOJ, SSAE, GDPR, CCPA), Security/Privacy Assessments, Security Awareness, Policies and Standards, Questionnaires, KPIs and KRIs, and 3rd Party RFPs.• Spearheaded implementation mechanisms for centralized security log monitoring (SIEM).• Technologies: AlienVault SIEM, Tenable Vulnerability Management (PCI DSS ASV), OWASP, Cloud (Azure and AWS), IBM AppSec (DAST), Agile/Scrum, Solutionary (PCI DSS), PEN test tools, CVE, CVSS, Change Management.

Des Moines, Iowa Area

Managed and enhanced Information Security service management, risk reduction strategies, and problem resolution for the largest healthcare provider in Iowa and South Dakota.• Led the selection, design, implementation, and tuning of security solutions including Network Intrusion Protection System (IPS), Network Data Loss Prevention (NDLP), and Endpoint Protection Suite.• Championed and enhanced the Vulnerability Management Program and system Configuration Management (CIS Benchmarks) program to meet and exceed compliance requirements. Provided governance oversight and reporting results to leadership. Trained technical staff from various IT teams to mitigate vulnerabilities through weekly update meetings.• Evaluated key industry vendors, conducted proof-of-concept pilot reviews and led the selection, design, implementation, and tuning of Network Intrusion Protection System (IPS), Network Data Loss Prevention (NDLP), Endpoint Protection Suite (Antivirus/ Malware), Host Intrusion Prevention (HIPS) and Network Packet Analysis solutions. Responded to alerts and provided Incident Response resolutions and reporting. • Managed secure messaging environment and work with the Privacy Office to enhance detection and blocking of messages with PHI to meet new HIPAA reporting requirements.• Technologies: Compliance (HIPAA/ HITRUST) McAfee Security Suite (Vulnerability Manager/ Database Scanner, McAfee ePO, CVE, CVSS, Change Management (ITIL), Anti-malware, NIDS/NIPS, HIPS, NAC, DLP), Oracle Identity Manager and Analytics, Verisign Certificate Management (PKI), RSA Authentication Manager, IBM ISS NIDS/NIPS, General Dynamics Fidelis Network DLP, Network Instruments Observer and Gigator packet analysis packet analysis, Zix Corp Secure Messaging Gateway, Sendmail, NetIQ Log Manager, LAMP, VMWare ESX, Splunk, ManageEngine ADAudit, SolarWinds Orion, CVE, CVSS, Change Management (ITIL), and BackTrack/Kali.

Bloomington, Illinois, United States

Security Operations Center (SOC) activities, ensuring 24/7 problem resolution and change management for one of the largest private networks.● Served as the primary point of contact for technical issue resolution and customer support, maintaining the security of network and information systems through proactive measures.● Implemented robust defenses against unauthorized real-time attacks and probes, utilizing: Network Intrusion Detection, Host Intrusion Prevention, Endpoint Protection (Antivirus/Malware/Firewall), Network Firewalls, Vulnerability/ Patch Management● Technologies: Internet Security Systems (ISS) NIDS, HIPS, Symantec Antivirus Corporate Edition, Trend Micro IMSS, Email Gateway, Sendmail, Nokia/Checkpoint Firewall-1 NG, Sidewinder Firewalls, Gauntlet Firewall, FoundScan Vulnerability Scanner, Phone Sweep war dialing.

Cedar Rapids, Iowa, United States

Managed, lead, research, analyze, design, plan, and organize corporate-wide security functions for the Chief Information Security Officer (CISO).● Develop and maintain policies, standards, security baselines, and procedures to ensure alignment with industry best practices and regulatory requirements.● Conduct comprehensive risk and threat assessments to identify vulnerabilities and prioritize security measures.● Design and deliver user awareness training programs to foster a culture of security awareness throughout the organization.● Provide incident response and investigative support as part of the Computer Incident Response Team (CIRT), ensuring timely and effective resolution of security incidents.●Conduct architecture reviews and product assessments to evaluate the security posture of existing systems and recommend enhancements.● Spearheaded the development of the AEGON Threat & Vulnerability Management Program, enhancing the organization's ability to detect and mitigate security threats.● Contributed as a key team member in achieving ISO 17799 Security Standard certification for the AEGON Information Security Program, demonstrating compliance with international security standards.● Standardized the corporate antivirus solution and established a robust test environment to ensure the effectiveness of security measures.● Technologies: Compliance (GLBA, ISO, SOC) Internet Security Systems (ISS) RealSecure IDS and Internet Scanner, eEye Digital Security Retina and Iris Vulnerability scanners, Symantec Corporate Edition, Demarc IDS (SNORT solution), and FoundScan Vulnerability Scanner.