MATARR GAYE

• Review ISO 27001 and ISO 27002 standards to identify potential gaps in required documentation and processes.
• Work with business units, internal IT and 3rd party vendor teams to promote and adopt security best practices.
• Contribute to the continuous improvement of the information security management system (ISMS) in accordance with ISO 27001 and NIST SP 800-53 Standards.
• Assist in document gathering and evidence collection for audit purposes.
• Document security gaps identified as findings that required remediation and continuous monitoring.
• Review SOC 2 type 2 report, pentest report, internal vulnerability scan report, Incident response report, to make sure it is current and operating effectively.
• Control documents for easy tracking and accountability. Create standard templates for recording data.
• Performed Risk Assessment and Business Impact Analysis to identify risks that need to be remediated or continuously monitored.

● Performed due diligence on vendors as part of third party risk assessments.
● Monitored 3rd party operational risk trends and provided analysis of data and other operational risk metrics using Security Scorecard.
● Conducted risk assessments using the GRC tool Archer and tracked concerns found with the assistance of mitigating measures.
● Performed assessment of third-party security and related due diligence documentation (such as SOC, SIG Questionnaire, PCI, policy)
● Develop and implement risk mitigation and issue remediation strategies for identified third-party risks or issues.
● Facilitate the review of risk subject matter experts and other business stakeholders when appropriate throughout the lifecycle of an engagement from onboarding to termination.
● Gather information security controls evidence from third-parties on behalf of our clients.
● Review SOC 2 type 2, pentest report, Internal vulnerability scan report, Incident response report, to make sure they are current and operating effectively.
● Document finding, generate report and communicating reports to the business unit.