My responsibilities and achievements in this position
Lead the cybersecurity program within the IT team, ensuring on-premises and cloud-based security and data protection standards.
Design and implement security solutions for on-premises and Azure cloud enterprise environments.
Maintain Azure and on-prem security controls aligned to NIST 800-171, NIST 800-53, GLBA, PCI-DSS, CIS, and FedRAMP compliance frameworks.
Review and recommend security control configurations based on compliance requirements and business objectives.
Lead the continuous vulnerability management process to improve security posture and compliance.
Manage POA&M (Plan of Action and Milestones) documentation for tracking and ensuring timely vulnerability remediations.
Conduct continuous monitoring of systems and applications for threats and vulnerabilities.
Manage security processes including patch management, change control, and risk assessment for proactive risk identification and mitigation.
Develop and prioritize cybersecurity policies, procedures, and guidelines to support strategic security objectives.
Create and maintain policies supporting disaster recovery, incident response, vulnerability management, and security awareness training.
Analyze security program effectiveness using KPI and KRI metrics, and adjust strategies accordingly.
Collaborate with and lead SOC operations for logging configurations, threat insights, and remediation efforts.
Manage endpoint security solutions with EDR/XDR platforms, including SentinelOne, Microsoft Defender for Endpoint and Cloud, and Microsoft Sentinel for increased visibility and threat mitigation.
Configure and maintain data security settings across Microsoft Azure, Office 365, SharePoint, and Teams, including data classification and labeling policies using Microsoft Purview to enhance collaboration security, information protection, and regulatory compliance.
Develop operational runbooks, standard procedures, and strategic roadmaps to strengthen data security posture management across cloud and on-premises platforms.
Investigate and remediate sensitive data exposure and permission risks across SharePoint, OneDrive, and file servers by identifying open access, broken ACLs, and inconsistent group permissions.
Engage internal and external stakeholders to align security initiatives with broader business goals.
Report security program metrics and progress to administrative boards, steering committees, and directors to demonstrate effectiveness and financial ROI.
Oversee security vendors, consultants, and service providers, with a focus on cloud DLP, key management services (KMS), and encryption strategies.
Integrate security measures into IT operations, improving overall workflow and security readiness across teams.
Collaborate with Security Operations to develop incident response playbooks tied to data security events, enhancing detection, investigation, and mitigation efforts related to data exposure and access risks.