William Jimenez Email & Phone Number

New York, Ny, Us

Menlo Park, California, Us

New York, Ny, Us

Perform independent conformance assessments of the program based on the Policy/Procedures and document gaps for remediation prior to audit or external regulators. Inclusive of creating a Scenario Analysis related to vendors’ impact on the firm and creation of business specific risk portfolio.Program: 2nd line Oversight• Execute on risk waterfall approach to narrow down on key Third Parties that require remediation or further attention from a risk perspective out of thousands of services (Risk of service failure, Risk of data loss).• Challenge Third Party - Risk & Control Self Assessment (RCSA) from inherent risk, controls and residual risk.• Produce deep dives on the program for integrity or increase program standards on an on-going basis.• Manage Third Party Governance Committee presentations that consists of program updates, issues, enhancement to policy/program and action items.• Manage US/London/Budapest team projects in a PowerPoint format to deliver to management on a weekly/bi-weekly basis.• Construct ad-hoc presentations for board meetings, regulators and senior management.• Key member in the Concentration working group & Supplier Risk Rating working group scenario Analysis / Coverage.• Developed an incident score card based on SLA, incident tracker and criticality of the service Scenario Analysis / Coverage• Run Scenario of business continuity, data leakage, cyber attack and failure of service to determine risk exposure from both reputational and capital based on the firm’s Enterprise Critical Third Party list.• Conduct in-depth analysis on each service from end-to-end and their respective business units.• Lead round table discussions with the business and subject matter experts on different scenarios.• Develop and produce quarterly packs for each business unit on Third Party risks (Incidents, critical services with weak controls, analysis on external incidents, concentration risk and supplier risk rating).

Tokyo, Japan, Jp

Implemented the Third Party framework using the RSA solution and managed a team during the development lifecycle. Integration with internal process to create a successful GRC platform. In addition, participated in the creation of the policy/procedures for Third Party Program.Projects• In coordination with 2nd line to operationalize the BHC TPRM Policy/Standards/Procedures based on industry standards (sources OCC, FRB, BITs, Shared Assessments).• Led the TPRM implementation from business requirements (with SMEs, key management) to UAT and BAU model and manage six consultants and maintained two on-going thereafter.• Collaborated with the 2nd line ORM to define KRI/KPIs for the program metrics and monitor the 1st line.• Managed integration with Accounts Payable system (Peoplesoft) with Archer solution.• Oversaw integration with an external systems (D&B, DMZ, Scripts, Datafeeds).• Supported the release of the 2nd line Incident Management system and Risk Event Capture. In addition, the Model Risk & New Product Approval system & member of the NPA process.Third Party Oversight• Provided reports to OpsRisk on the program performance• Interacted with Audit & Compliance & Head Office to perform annual assessment (3rd Line).• Built out the initial questionnaire for vendor outreach and ongoing requests related to information security inquiries• Used the Security Scorecard tool as an additional resource to review vendors where possible• Supported the development of a negative news alert procedure for data leakage, technical security breaches, and financial impactArcher GRC• Managed RSA Archer solutions/platform (SaaS services, security matrix, Organization structure, shared solutions, SSO, directory/LDAP, bug/fixes).• Started the Archer Change Management process and working groups as Archer grew.• Created a process to streamline the intake of the SIG document and determine the sections that needed to be completed based on the Inherent Risk questionnaire

Brooklyn, Ny, Us

Chiyoda-Ku, Tokyo, Jp

Implemented the TPRM program in Latin America to ensure global policies and procedures were enforced, as well as provided metrics on performance to senior management. Optimized the TPRM workflow for efficiency and consistency.• Third-Party risk subject matter expert, to provide guidance, leadership and expertise to each Line of Business (LOB) as they plan for the introduction or renewal of products or services both in the US and Latin America. • Monitored the Ongoing questionnaire for the Third-Party Vendor Management (TPVM) and provide information to appropriate stakeholders as needed.• Performed country risk assessment reviews and offshore third-party background / restricted list due diligence.• Developed a process to reflect associated Third Party risk in the RCSA.• Enhanced current Third-Party Risk Management (TPRM) tool for efficiency, user friendliness, and cross-usage of the Standardized Information Gathering (SIG).• Project Manager on the TPVM implementation: Budget, consultant, time-line, weekly-updates, presentations.• Led development and implementation of the TPRM policy/procedures across all coverage areas.• Implemented the TPRM framework within the ARCHER application (Opportunity, Due Diligence, Contract, Monitor & Oversight, and Termination).• Worked closely with a cross-functional team including LOBs, Technology, Operations and Program Management to ensure the timely completion and documentation of the required process steps in the vendor management lifecycle. Associate.• Presented Vendor Risk Management to industry peers at Bloomberg.• Participated in the Shared Assessment Organization’s working groups (Santa Fe Group) part of SIG.• Completed an internal course on Japanese cross-cultural business interaction.

New York, Ny, Us

Covered the Global Finance department to challenge their risks and understand their changes in risk profile over a period of time. Participated in the development of the RCSA tool from taxonomy to tool functionality for ease of use.• Developed strong interaction with the business and provide continued business support and partnership in the role of Operational Risk Manager.• Challenged the business to take ownership of their operational risks as the first line of defense/embed the three lines of defense.• Linked process to existing issues, metric/key risk indicators (KRIs), functional assessment, and loss data to ensure consistency and eliminate redundancy.• Facilitated workshops with functional risk leads to collaborate results & reported results to senior management.• Coordinated with designated control functions (SOX, Audit, Compliance, IT Risk, Vendor Management, Business Continuity, Model Risk) to assess the risk profile.• Supported strategic model and evaluation/development/integration into the system, including the policies/procedures.

New York, Ny, Us

Managed requests from the Operational Department, Audit and Information Security as first line point of contact for Fixed Income Sales & Trading. This created a manageable and consistent approach to the front office. Requests ranged from managing e-mail incident reviews, E-Trading system oversight, Risk and Control, access control and implementation of new policies.• Interacted with Sales & Traders on a daily basis from the Credit desk to Muni’s desk.• Produced quarterly/monthly ‘Comprehensive Capital Analysis and Review (CCAR)’ reports for FID.• Supported the initial implementation of the Risk Control Self-Assessment (RCSA) for our team from taxonomy selection, risk identification, controls, residual risk for the team.Business Information Management• Created Segregation of Duties rules for the Fixed Income business to reduce internal fraud or inside trading• Quarterly conversations with COO and S&T to understand his/her risk concerns and ensure new information security policies• Data leakage review using Vontu system; ongoing e-mail reviews & exit e-mail review• Integrated the Identity and Access Management (IAM) solutions within FID and executed the review process• Manage internal Third Parties onboarding process & engaged with vendor to understand their controls• Interacted with Internal Audit Group to remediate findings to reduce impact on the S&T:• Involved in the initial draft of audit points descriptions to modified and represent actual risk.• Detailed possible remediation and completion timeframe.• Produced ad-hoc and monthly audit point reports broken down by business area.• Worked with the Regulatory Control Group to permission Fixed Income traders to E-Trading platforms ensuring they have the correct licenses, registered with the exchange and trading limits.

New York, Ny, Us

Archer Technology •System administrator for the Archer Asset Management system•Supported approximately 5,000 users across four global regions•First Archer Certified Consultant at Morgan Stanley•Provided initial acceptance testing for Information Security, and helped with the initial install of the Archer application at MSData Collection & Analysis•Analyzed mass dataset of approximately 300,000 records via Microsoft Access•Exporting an internal application called Galaxy using XML/XSLT to import/export mass data•Using Perl to export data through the Archer API for auditing the system•Implementing the Archer Framework Solution for global information security groups to create an MIS (Management Information Systems) systemSolutions•Used the Archer Framework system to implement and integrate current InfoSec Business processes into an automatic process•Created solution specific documentation as well as performing data cleansing for more accurate data and reporting

• Assisted with the IT Infrastructure Library (ITIL) framework – extracted and reorganized data from the ITIL framework for implementation within the current company implementation• Modified/Created XML data to build module (db) in an accelerate methodSprint • Supported building an IT Risk Assessment solution, involving the classification of groups participating in the assessment and helped integrate the process of the how the risk assessment will be updated and managedBank of America• Assisted in a Risk Assessment for Bank of America.

Bachelor'S Degree, Computer Engineering

Bachelor'S Degree, Computer Engineering