Theodore Agha

Information Security Risk & Compliance Specialist @Kaiser Permanente

Perform risk assessment review based on the prescribed framework the organization is adhering too and regulatory requirement as well as company\'s policy-Recommend and help developed appropriate information security policies, procedures, tailored to meet organizational security requirement and regulations-Support the company\'s compliance and certification effort including ISO 27001, HIPAA, GDPR, SOC 2, SOX, HITRUST, by gathering of evidence and answering security related questions-Coordinate and liaison for IT with external auditors and internal control owners to support various internal and external audits by gathering and validation of artefacts and upload them in the SharePoint-Documentation review including policies, standard operating procedures and updated as necessary. Support Third Party risk management program by ensuring that third parties comply with applicable security control requirements as well as company\'s policy-Identify gaps in control implementation by doing gap analyst/ control mapping and work with all the control owners to develop remediation plan within a specific deadline-Conduct security awareness training to all newly hired employees as mandated -Schedule walkthrough meetings with external auditors and control owners to discuss and validate control requirements.