Tim Shen Email & Phone Number

Chicago, Il, Us

Illinois, United States

• Leads the IT risk and policy exception management program in cybersecurity Governance, Risk and Compliance (GRC) organization.• Establishes a roadmap and matures an IT risk management program (NIST Risk Management Framework).• Advises business and IT leadership on AI governance, manages and monitors Microsoft Copilot related risks.• Serves as a business liaison and security subject matter expert for cross-functional teams, assesses IT control gaps, approves policy exceptions, and validates effective IT controls in place and HIPAA compliance for the million-dollar project- Trustmark’s Microsoft Dynamics cloud-based call center.• Regularly identifies and assesses IT risks on vulnerabilities and security threats within a cloud environment (Microsoft Azure). Additionally, identify effective IT controls to safeguard PHI and PII，and protect the continuity of healthcare benefit operations and customer service for insurance policyholders.• Engages business, IT project teams, application owners and security architects to understand security risks and translates cybersecurity requirements into technical specifications.• Validates that the IT controls following relevant regulations (HIPAA, NYDFS, GDPR), standards (NIST 800-53, CIS, ISO 27001, HITRUST) and SOC2 audit readiness.• Maintains the risk register in ServiceNow, and continuously monitors changes in the IT risk profile of critical systems and technology.• Supports security incident response to protect PHI/PII and customer data.• Facilitates IT Risk Review Committee regular meetings to discuss the risk remediation plans and status.• Develops and presents IT risk executive reports including Key Risk Indicators (KRI) to senior leadership (CISO and CIO) monthly meetings in support of leadership risk-based decisions.• Trains IT control owners and mentor junior team members in identifying and managing IT risks in support of cybersecurity program.

Greater Chicago Area

• Developed and executed a global information security risk management process (NIST Risk Management Framework) for 6,000 associates across more than 30 countries.• Collaborated with first-line defense teams and business to identify IT risks and conducted risk assessments on IT control gaps, vulnerabilities and threats to sensitive data, critical business and applications.• Acted as a business liaison and security subject matter expert for cross-functional teams—including business units, architecture groups, IT control owners, security, and project teams—to identify security requirements, assess, and monitor IT control gaps and PCI DSS compliance risks throughout a four-year, $1 billion AWS cloud migration project.• Served as the primary point of contact for business stakeholders, collaborated closely with security teams, application architects, project managers, IT control owners, and product owners to identify security and PCI DSS compliance risks and implement risk remediation plans for a three-year, $100 million M&A project.• Trusted advisor on TPRM governance.• Built and maintained the global risk register in Archer, monitored changes in the risk profile.• Established common IT controls (NIST SP 800-53) to ensure their effectiveness.• Supported security incident response and controls to protect sensitive data.• Developed and presented monthly IT risk executive reports with key risk indicator (KRI) metrics to the Security Technology and Risk Committee (STRC), effectively influenced senior leadership (CIO, CISO) and business executives on high-risk decisions and prioritization.• Trained GRC team and IT control owners in risk identification and communication. • Supported audits for HIPAA, PCI DSS, and ISO 27001 compliance, including clients and regulatory bodies such as the Consumer Financial Protection Bureau (CFPB), New York Department of Financial Services (NYDFS), and the FTC.• Advised on remediating the SOX IT general controls (ITGC) deficiencies.

Greater Chicago Area

• Documented and maintained the Global IT security policies and standards for 70+ countries across all regions (the Americas, Europe, Middle East and Africa, and Asia Pacific.)• Supported internal and clients' audits for SOX, HIPAA and ISO 27001

Columbia, Missouri And Chicago, Il

o The Senior IBM Business Information Security Consultant was responsible for ensuring that over 100 IBM applications complied with HIPAA and HCSC security policies for Blue Cross and Blue Shield across Illinois, Montana, New Mexico, Oklahoma, and Texas.o Collaborated with business and IT teams (across 1st and 2nd lines of defense) to identify and conduct risk assessments on third party IT risks (TPRM), and reviewed IT security exceptions and acceptance requests.o Advised Fortune 500 IBM clients on the implementation of security policies, IT risk and compliance management in support of SOX, HIPAA, FISMA, NIST 800-53, PCI DSS, ISO 27001 and SOC 2.