John Sullivan

Senior Information Technology Consultant @Ambarella Inc

Santa Clara, CA, US

Information security consultant at Ambarella responsible for information security, risk and compliance and defining control procedures based on information security requirements, policies and standards, control testing, mapping issues to risks, and communicating and reporting on results. Responsible for managing vendor and 3rd party risk assessments and ensuring appropriate risk levels and risk mitigation.• Manage risk and compliance across NIST, ISO, and similar security frameworks, which include all security domains. Conduct new and recurring 3rd party security risk assessments, develop mitigation plans, and work with internal stakeholders to assign remediation tracking.• Conduct analysis and proof of concept of GRC tools. Implement and manage GRC tools after proof of concept and selection.• Manage reviews of external ISO 27001 and SOC2 compliance reports and the development of internal SOC2 and ISO27001 attestations. Analysis includes adherence to global data protection regulations, i.e GDPR and CCPA.• Manage projects under one or more industry frameworks: NIST Cybersecurity Framework, CIS Critical Security Control, and similar information security control frameworks.• Communicate clearly to all levels of management and present to and train the workforce on GRC-related topics.• Coordinate and implement security governance frameworks, perform assessments, and produce metrics and reports on the health of the program.• Manage the development and review of Security Policies to support legal and regulatory compliance needs as well as general IT and organizational information security practices.• Maintain the risk register and proactively communicate risk to management.• Conduct 3rd party vendor reviews, advise business owners on 3rd risk impacts, and respond to customer Security questionnaires and assessments.• Serve as a security expert and partner with the sales team for Customer Trust & Assessments and provide guidance for implementing security controls.

Northwestern University

BA, Economics