Darrius Christian

Enterprise Product Security and Risk Manager @Acoustic

Implemented ISO 27001 based ISMS, security policies & standards across new company. Established security procedures & implement controls, including Risk Management methodology, Network, System and Cloud controls, BCP/DR, SIHP, User Access Control & quarterly verification. Established Security Training & Vendor Management processes. Worked with legal team to document applicable Privacy policy.\\\\n• Collaborated across teams to perform due diligence & preparatory activities necessary to attain certification & represented the various offerings to both internal & external third-party auditors. Remediation of minor findings in a timely manner to ensure successful final report.\\\\n• Achieve security certifications of 9 SaaS production offerings in the Marketing Cloud space. The certifications also pertained to corporate & HR systems & development environments.\\\\n• Third party external audit certification completed for ISO 27001 (surveillance audit for year 2), SOC 2 Type I (year 1) & II (year 2) & HIPAA attestation.\\\\n• Continuous improvement activities: Established risk-based weighting approach to prioritize set of controls to target for security control improvement.\\\\n• Led Data Discovery & Data Flow Mapping exercise to document regulated customer data & data handling within the Acoustic production environment (per GDPR requirements). Also confirmed data protections (encryption), access restrictions (role-based & least privilege) & data backups in place to meet legal, regulatory & contractual requirements.\\\\n• Customer security audit: Led technical teams to remediate security findings identified by key customer including improvements in Endpoint protections, email DLP controls (coordinating with external MS scripting vendor) and VPN security enhancements.\\\\n• Work with the legal team to review contractual language pertinent to IT security, data handling & protection & with the sales team to address security questionnaires from prospective or existing clients.\\\\n \\\\n\\\\n \\\\n \\\\n\\\\n \\\\n