Andy Soodek

About Andy Soodek

My professional mission is to help organizations use and protect OUR personal data responsibly. I am primarily a privacy program and data/AI governance architect, which means- I collaborate with stakeholders to assess legal and regulatory privacy, security and ADMT obligations and to identify privacy management gaps and risks- I align privacy program strategies and tactics to commonly accepted privacy and security risk management frameworks (NIST, ISO, PCI DSS)- I draft and maintain privacy and security policies, standards, processes, plans, training, 3rd party risk management tools, and IT controls - to meet the varied requirements of GDPR, CCPA/CPRA, CDPA, PIPEDA, LGPD, GLBA, etc- I facilitate senior-level governance committees, who maintain accountability for security and privacy- I design process-based solutions to close the program gaps and meet ongoing compliance obligations (PIAs, Cybersecurity Risk Assessments, Standard Contractual Clauses, Cross-Border Data Transfers)- I oversee strategic process change and technology implementation projects, inclusive of stakeholder engagement and training & awareness. CIPP/E, CISSP, CISM, MBA and ITIL Practitioner (Former PMP)Specialties: Data Privacy Regulations (GDPR, CCPA/CPRA, PCI DSS, HIPAA, GLBA), Privacy Management Frameworks (NIST, GAPP), Information Security standards (NIST, ISO 2700x, COBIT), AI/ADMT Risk Management, Data Governance, Project & Portfolio Management, Security & Privacy Awareness Training, Incident Response and Disaster Recovery Planning.Industries: Financial Services, Healthcare, Retail, Social Media, Technology, Government Contracting, Consumer Packaged Goods

Experience

1. Managing Principal, Data Security & Privacy

   Capco

   Oct 2021 — Present · Chicago, IL, US

Education

• Dominican University

  MLIS, Library & Information Science

  1993 — 1994

• University of Minnesota

  BA, Humanities

  1987 — 1992

• Georgetown University McDonough School of Business

  MBA, Operations

  1998 — 2000