Joe Paul, MBA, CISSP, CRISC, CISA, CGEIT, CBCP, CAISP

As a member of the Advisory Council, I participate in regular group discussions and offer recommendations to help guide SecureWorld regional agenda content topics that are timely, relevant, and valuable. As a SecureWorld Advisory Council member, I’m also part of a group that acts as a sounding board to ensure conference events meet the expectations of our peers and local attendees.

- Oversaw the implementation and compliance tracking of SOC 2 and NIST frameworks, managing reporting processes for more than 10 regulatory and client compliance requirements. - Managed 5 SaaS applications to track compliance initiatives for HIPAA and GDPR, resulting in a 20% increase in compliance reporting accuracy. - Defined and monitored key cybersecurity metrics, including incident response time and compliance rates, resulting in a 30% reduction in incident response time and a 15% increase in compliance rates. - Coordinated 10+ internal and external audits by liaising with auditors and stakeholders, reviewing evidence submissions to ensure compliance, and overseeing task assignments that reduced audit completion time by 20%. - Led HITRUST r2, Interim r2, and i1 certification processes, ensuring timely completion of all audits and achieving 100% compliance on first attempts. - Managed compliance initiatives with standards such as SOX, HIPAA/HITECH, HITRUST, and SSAE 18 SOC1/SOC2, achieving successful audits and a 100% compliance rate. - Managed a team of 5 compliance auditors to execute training and awareness programs, conduct risk assessments, and lead business continuity and disaster recovery (BCDR) exercises, resulting in enhanced compliance across 3 corporate security projects. - Led the vetting process for over 50 vendors by reviewing third-party security risk assessments to ensure compliance with established security standards. - Led a cross-functional team of 10 members to implement SOC 2 and NIST compliance standards, achieving all security compliance objectives set for the year. - Chaired a 10-member Committee on Risk and Control, delivering quarterly reports on compliance metrics and risk assessments to senior leadership.

- Led the development and implementation of Supplier Assurance Services (SAS) Standards and Procedures, resulting in a 30% improvement in compliance metrics such as audit pass rates. Provided monthly updates via email and presentations to keep all stakeholders informed and ensure adherence to the new standards. - Led SAS governance forums, tracking over 50 compliance issues monthly and ensuring alignment across 5 cross-functional teams. - Designed and implemented IT security assessment procedures and checklists, ensuring compliance with SOC 2 and NIST standards. - Developed and maintained 5+ compliance toolkits using leading software solutions, ensuring adherence to regulatory standards, including HIPAA and GDPR. - Evaluated the impact of operational strategies on 50+ third-party vendors in Corporate Third-Party Operations (CTPO), collaborating with cross-functional teams to implement changes effectively. - Conducted training sessions for a community of 100+ SAS members to clarify assessment requirements, processes, and the impacts of changes. - Updated and maintained a library of over 200 documents for cybersecurity compliance assessments, specifically addressing SOC 2 and NIST guidelines, improving audit readiness and stakeholder confidence. - Provided governance insights to the SAS training program, enhancing participant engagement by 30% for over 100 trainees, and delivered actionable strategic recommendations to the Chief Technology and Product Officer (CTPO) for expanded training initiatives. - Coordinated with the CTPO Exam Management team, Compliance, Operational Risk Oversight, and JPMC client teams on SAS-aligned audits and reviews, managing over 50 RFIs and ensuring timely responses.

- Managed the Manager's Control Assessment (MCA) by implementing and reporting on more than 10 key risks, controls, tests, and Key Risk Indicators (KRI), which resulted in a 15% improvement in compliance effectiveness. - Identified control deficiencies through direct interactions with over 50 customers, documenting issues systematically to ensure timely reporting and resolution. - Achieved timely remediation for 90% of identified issues and prepared weekly management reports on issue status and corrective actions using Jira. - Oversaw multiple internal and external audits, ensuring accuracy of 100+ documented issues and effective implementation of corrective actions. - Collaborated with a cross-functional team of five to implement MCA governance for three key CTI Global Functions, enhancing compliance and operational effectiveness.

- Led Information Security Compliance for North America and EMEA, successfully completing 15+ internal and external audits and client assessments within a strict 30-day timeline. - Responsible for achieving and maintaining ISO 27001:2013 certification at several key NTT DATA Services data centers in the United States and the United Kingdom. - Managed a global team of 15 security and compliance professionals, overseeing compliance with SOC 2 and HIPAA standards. - Conducted quarterly ISO 27001:2013 internal audits, identifying compliance gaps and ensuring adherence to the standard. - Completed over 50 customer security compliance questionnaires and audits for standards including ISO 27001, HIPAA, HITECH, SOX, and PCI DSS, ensuring compliance and enhancing stakeholder trust. - Conducted asset-based risk assessments to identify specific risks, such as data breaches and compliance gaps, and created detailed risk treatment plans that reduced operational vulnerabilities and enhanced compliance with industry regulations. - Led the management of NTT DATA Services' Information Security Management System (ISMS), enhancing risk assessment processes and incident response capabilities to strengthen organizational security posture. - Reviewed and aligned over 50 company policies and procedures with the Information Security Management System (ISMS) to ensure adherence to ISO 27001 standards, resulting in successful compliance audit outcomes. - Led monthly information security meetings with a team of 10+ managers to identify critical cybersecurity risks, prioritize mitigation strategies, and ensure compliance with NIST guidelines, producing detailed risk management plans that enhanced organizational security posture. - Led Root Cause Analyses (RCA) for over 10 major information security incidents, identifying corrective and preventive actions, and ensuring closure follow-up on all identified issues.

- Managed information security, data privacy, and data security operations in the Legal Department, achieving compliance with HIPAA and GDPR regulations while mitigating risks across 10 key projects. - Led the company's information security program by implementing risk management controls, successfully reducing security incidents by 30% and enhancing the overall security framework. - Responded to all external third-party risk assessment requests and reduced turnaround time from several weeks to just a few days. - Developed and performed third-party risk assessments on all vendors and clients who handled or may handle personal data. - Conducted regular privacy impact assessments on personal data processing systems, identified specific vulnerabilities in data handling practices, and developed targeted corrective action plans to address compliance gaps. - Advised and trained 50+ leaders and employees on GDPR and HIPAA standards, collaborating with the Data Privacy team to ensure compliance in personal data collection and transmission.

- Led the Information Security Group's risk and compliance objectives by managing governance processes for contracts with over 100 third-party vendors across the global organization. - Developed a risk management strategy for third-party governance, incorporating specific information security requirements into 50+ contracts to enhance protection against potential security threats. - Led compliance initiatives for control standards such as SOX, PCI DSS, and NIST 800-53, resulting in successful audits and certification renewals. - Managed a team to conduct contract reviews for over 100 agreements quarterly, ensuring compliance through monitoring, auditing, and timely issue remediation. - Conducted quarterly assessments of information security requirements, updating protocols in response to specific threats like ransomware attacks, which resulted in a 30% reduction in vulnerability incidents. - Defined three key governance indicators for third parties to ensure compliance with all regulations, resulting in monthly reports and trend analyses shared with five major stakeholders. - Led comprehensive information security assessments for 10+ third-party organizations to evaluate their security posture and ensure compliance with PepsiCo's security standards, while diligently tracking assessments, remediations, and exceptions in Archer GRC.

- Led the corporate compliance program in the Legal Department, achieving adherence to over 15 federal, state, and company regulations, including HIPAA, HITECH, and FISMA, and conducting regular audits and risk assessments. - Led the SOC 2 Type 1 audit engagement program, ensuring compliance with privacy and security regulations and completing over 50 audit tasks, which improved risk mitigation strategies by identifying and addressing more than 20 previously unrecognized risks. - Managed a team of 5 compliance analysts in auditing and training programs, leading to a 20% improvement in compliance adherence rates and developing enhancements to VHA's existing compliance program. - Consulted the Legal, IT, Marketing, Operations, and Sales departments to assess security and compliance for their products and infrastructure, resulting in a 15% increase in adherence to HIPAA and GDPR standards. - Collaborated with the security team and three business units to document and assess over 50 current and potential risks, ensuring that appropriate controls were implemented and formally recorded in the risk management process. - Led the incident response for over 10 potential breaches of Protected Health Information (PHI), ensuring timely resolution and compliance with HIPAA regulations. - Acted as a trusted privacy advisor for 10 member hospitals, providing guidance on compliance with HIPAA regulations and addressing specific privacy inquiries. - Monitored HIPAA and federal regulations to support the VHA compliance program, using a tracking system for quarterly updates and achieving 100% audit readiness. - Reviewed and collaborated with the legal team on 50+ contracts to ensure compliance with state and federal regulations.

- Collaborated with 10+ business stakeholders to clarify strategies and priorities, resulting in the successful implementation of cloud-based solutions that met specific business requirements and adhered to enterprise architecture standards. - Managed IT capital and operational budgets totaling $2M to support annual business cycles and ensure strategic alignment of resources. - Led a global IT team in the development and implementation of SOx audit policies and access control measures, enhancing operational security and compliance across 15+ regions. - Developed and implemented Agile project management processes to document and prioritize 20+ IT investments, improving the selection and tracking of projects aligned with business value.