Stefan Carlson

About Stefan Carlson

As a Senior Manager in EY\'s Risk Consulting practice, I lead multiple security/IT compliance managed service programs (75+ team members in the US, Canada, India, and Mexico) for a Fortune 100 Cloud Service Provider. These programs are foundational to my client achieving numerous regulatory accreditations and certifications such as: IT SOX, SOC1/2, DSA, ISO 27001/42001, FedRAMP, PCI, HiTrust, etc.I advise executives on modernizing their programs to meet evolving regulatory standards using data, leveraging my technical product management skills in Cloud/Business Applications and my deep experience with IT audit. Rather than adhering to the status quo for meeting compliance, I strive to innovate and lessen the compliance burden using technology to meet audit requirements. This includes pulling compliance requirements forward in the engineering process, where possible, to achieve compliance by design.I\'m also deeply committed to mentoring and coaching within my teams and take pride in guiding several individuals at EY and in the tech industry.

Experience

1. Senior Manager, Ey Consulting (Digital Risk Consulting)

   EY

   Oct 2021 — Present · Seattle, WA, US

   Built and currently manage multiple continuous monitoring, IT compliance operations, and IT compliance onboarding programs for a Fortune 100 Cloud Services corporation. I oversee multiple teams with 70+ total team members within the United States, India, and Mexico. Building these programs began with risk identification/ranking, design of mitigating controls and processes, development of process automation, and design of executive-level reporting with technologies such as PowerApps, PowerBI, SQL, and Azure. These programs are foundational to my client achieving numerous regulatory accreditations and certifications such as: SOX, SOC1, SOC2, ISO 27001, FedRAMP, PCI, and HITRUST.‣ Developed and implemented an end-to-end SOC2 Compliance Program for a new product offering, achieving an unqualified audit opinion with zero findings in their first report.‣ Experienced in implementing IT compliance and risk management for emerging technologies such as in blockchain (Ethereum-based Royalties Platform) and in complex microservice environments. ‣ Oversaw the technical design, product management, and roll out of multiple compliance automation products (UAR Tooling, Integrated Metrics Workflow Engine, Compliance Metrics Reporting).‣ Conducted multiple IT/business risk and control assessments to pinpoint performance improvement opportunities in complex environments. ‣ Assisted in establishing data privacy programs for several Technology sector clients to address GDPR requirements.IT Audit‣ Led multiple SOX 404/Financial Statement audits for companies across Technology, Biopharmaceutical, Manufacturing, and Gaming sectors.‣ Conducted several SOC 1/2/3, and WebTrust attestations for a Fortune 100 Cloud Service provider.Lecturing‣ Guest Lecturer in IT Compliance for the Master of Professional Accounting (MPAcc) Program at the University of Washington\'s Foster School of Business.

Education

• UW Foster School of Business

  Bachelor of Arts (BA), Business Administration, Management Information Systems (MIS)

  2010 — 2014

Skills

• J-Sox
• Sox 404
• Sql Server
• Blockchain
• Risk Management
• Dfars
• Adobe Creative Suite
• Web Design
• Mysql
• IT Controls
• Technical Product Management
• Information Security Standards
• Oracle E-Business Suite
• Os/400
• IT Audit
• Project Management
• Sap Erp
• Program Management
• Gdpr
• Robotics Process Automation (Rpa)