Michele Garcia

About Michele Garcia

A dedicated professional with 25+ years of information technology security, risk, compliance and global program management experience. Specializing in the implementation of new programs/processes for Program Management Offices and GRC organizations. Specialties: IT Compliance & Controls, Governance, IT Security & Risk Management, Payment Card Industry (PCI), 3rd Party/Vendor Assessments, Sarbanes Oxley, Privacy Legislation, GDPR, Contract Reviews/Negotiations, Global Program Management, Policy/Process Development

Experience

1. Enterprise Security Compliance Senior Manager

   Latham & Watkins

   Jan 2017 — Present · Los Angeles, CA, US

   Current responsibilities include:• Developed and managing the firm’s compliance program, cloud vendor management program and risk management activities. Working with the ISO, General Counsel, senior management, attorneys and other departments to implement and enhance policies and procedures related to compliance with client and regulatory requirements (e.g. HIPAA, GDPR) and the firm’s information governance strategy. • Led two 3-year cycle of ISO 27001 certification audits, with no exceptions, including the transition to ISO 27001:2022.• Managing the client security request process and security audits, collaborates with applicable business process owners to ensure answers are accurate and properly described, and ensure back up documentation is provided as needed. Collaborates with the Security and IT Directors to monitor and test compliance with client guidelines and internal control procedures. Acts as a conduit between client and firm to resolve client audit questions/issues. • Developed and maintaining vendor governance strategy and risk monitoring process to ensure a streamlined approach for fulfilling internal and client standards of compliance. Reports to top executive stakeholders on the risks associated with each vendor and determining go forward requirements. In collaboration with business process owner, ensures that applicable client requirements are addressed in vendor contracts.• Arranging penetration and vulnerability testing by identifying and negotiating with vendors, scheduling testing, and following-up on results delivery. Tracking, monitoring and reporting on the remediation efforts arising from testing with issue owners.

Education

• Seton Hall University

  Bachelor of Arts (BA), Computer Science

  1983 — 1987