Laurence Kirby

Information Security Manager @TTEC

Lead end-to-end third-party risk management (TPRM) program for 30+ high-risk vendors, conducting inherent risk assessments, vendor due diligence, and NIST 800-53 Rev5 security control scorecarding; reduced remediation timelines by 40%Evaluate vendor security attestations (SOC 2 Type II, ISO 27001) and analyze technical control implementations for authentication, encryption, disaster recovery, and infrastructure securityReview and negotiate vendor agreements for risk-related clauses including data handling, access controls, breach notification, and liability provisions in collaboration with Legal and ProcurementExecute FISMA, CMMC 2.0 and FedRAMP compliance programs, maintaining continuous Authority to Operate (ATO) for multiple AWS cloud-hosted systems supporting federal contractsCoordinate SOX Type 2, FISMA, FedRAMP and CMMC 2.0 evidence collection and audit readiness assessments, ensuring IT control effectiveness across business unitsConduct DAST and SAST application security testing using Veracode for internal applications and third-party vendor integrationsPartner with Engineering teams to provide technical guidance on secure vendor integrations, API security, and infrastructure hardeningLead IT compliance initiatives across MARS-E, HIPAA, SOX, FISMA, and FedRAMP frameworks, driving regulatory readiness and audit successManage POAM lifecycle including compliance metrics reporting, remediation tracking, and quarterly reviews with Internal Audit and executive leadershipSupport CMMC 2.0 Level 2 implementation for systems handling Controlled Unclassified Information (CUI), implementing and validating NIST SP 800-171 security controls across applicable system boundariesPrepare and coordinate DoD assessment readiness and third-party audit responses, including evidence collection, System Security Plans (SSPs), and Plans of Action & Milestones (POA & Ms) aligned to CMMC requirements.