Eric Sorenson

About Eric Sorenson

CISO | CIO | Cybersecurity Pioneer in Global Business As chief information…

Experience

1. Chief Information Security Officer (CISO)

   doTERRA International LLC

   Jun 2016 — Present

   I was recruited to dōTERRA, as its first chief information security officer (CISO) soon after a major data breach at a third-party vendor compromised significant customer private data. Thus, I was in the position of having to immediately respond to and remediate this critical situation as well as to instill a security culture; technical strategy; and governance, risk, and compliance program to prevent a similar occurrence in the future. Right away, I put an action plan together and worked with our cybersecurity vendor to investigate the scope of the issue, identify indicators of compromise (IOCs), and close any remaining gaps in our strategy. Once we were confident that the immediate risk was well managed, I then reframed the way the organization protected its assets with a global security strategy that established both preventive strategies and technical response protocols. Overall, my plan first included aligning control objectives with ISO PCI, and EU GDPR, constructing a risk-based ISMS, and hiring an experienced compliance team. One of the biggest challenges—and one of my biggest wins—was ensuring that the executive team and the complete management hierarchy understood the implications of the business choices they were making with respect to information and cybersecurity risk. We collaborated quite well on determining our organizational level of comfort, with my strategic team serving as a business enablement partner throughout the organization. The company now has a comprehensive, global cybersecurity strategy with predictive and responsive components as well as supportive internal governance and communications, protecting us from the inside out (social engineering campaigns) and the outside in (controls and perimeter network security devices). To learn more about my work with building dōTERRA’s cybersecurity program, please connect with me on LinkedIn.

Education

• Utah State University

  Bachelor’s Degree, Business Information Systems

  1998 — 2002

• Westminster University

  Master of Business Administration (M.B.A.), Business Administration and Management, General

  2005 — 2009

Skills

• Glba
• Computer Security
• Security
• Corporate Culture
• Regulatory Compliance
• Entrepreneurship
• Ciso
• Health Information
• Physical Security
• Start-Ups
• Hipaa
• Financial Analysis
• CIO
• Payment Card Industry Data Security Standard (Pci Dss)
• Ssae 16
• Business Process Improvement
• Information Security
• Indicators of Compromise
• Customer Service
• Strategic Planning
• Team Building
• Health Insurance
• Risk Management
• Information Technology
• Business Strategy
• Management
• Data Security
• Enterprise Software
• Cyber-Security
• Process Improvement
• Team Management
• Database Security
• Operating Budgets
• Disaster Recovery
• Cybersecurity
• Sql
• Chief Information Security Officer
• Leadership
• Operations Management
• Network Security