Femi Sunday

Motivated and detail-oriented Cybersecurity Professional with a track record of over 5 years specializing in Third-Party Vendor Risk Management and Compliance. Skilled in conducting comprehensive third-party risk assessments, crafting RFI/RFP responses, and ensuring compliance with various security frameworks including NIST, ISO 27001, HIPAA, CCPA, and GDPR. Proficient in conducting compliance audits and adept at developing and reviewing policies and processes aligned with regulatory frameworks.

Well-versed in utilizing GRC tools like One Trust and Archer for effective vendor management, including maintaining a risk register to track vulnerabilities. Experienced in designing and implementing Security Awareness Training Programs and facilitating organizations' readiness for annual Security Audits. Possessing extensive knowledge of FISMA, NIST, and FedRAMP to navigate complex regulatory landscapes

Vendor Risk and Compliance Analyst - Rogers Communication - Ontario, Canada

(2022-10)

Contract Full-Time

• Perform inherent risk questionnaires on business owners (BO) and conduct due diligence on vendors, identifying any gaps or exceptions.
• Collaborate with business owners to develop risk treatment plans for vendors.
• Ensure vendors adhere to and maintain policies and procedures.
• Review master services agreements and provide advice on security clauses to safeguard the organization's protected data.
• Engage external security vendors to explore protection strategies for system modernization.
• Review vendor artifacts such as policies, pen test reports, architecture diagrams, dataflow diagrams, and certificates of liability insurance.
• Lead annual security and privacy audits with external auditing firms and oversee remediation efforts.
• Review vendors' SOC 2 audit reports, address high-risk or critical findings, and develop treatment plans.
• Streamline the vendor risk management process by eliminating repetitive steps and reorganizing the document management system (DMS) platform.

Information Security Compliance Analyst - Ericsson

(2020-09 - 2022-08)

• Address exceptions from the previous year's SOC Audit or develop treatment plans to prepare the organization for the upcoming audit.
• Track vulnerabilities identified by the engineering team, provide remediation plans, and update completion dates accordingly.
• Develop and document policies, procedures, and guidelines for the vendor risk management program.
• Coordinate meetings with vendors to gather input and establish milestones for addressing security weaknesses.
• Ensure all required documentation is kept up to date for SOC 1 and SOC 2 audits.
• Expand policies to address gaps identified in audits and respond to RFP (Request for Proposal) requests.
• Prepare the organization for SOC audits by accurately responding to test procedures and providing the required attachments.
• Monitor vulnerabilities on the organization's vulnerability management platform and provide management with reports.
• Conduct annual reviews of policies to ensure they remain effective and up to date.
• Perform reassessments of vendors through refresh assessments and updates to documentation.

Information Security Compliance Analyst - Huawei Technologies

(2018-01 - 2020-07)

• Led a medium-sized project team and provided technical expertise on Cybersecurity projects from inception to completion.
• Managed client relationships and provided guidance on recommended actions for ongoing projects.
• Offered consultative engagement on various cybersecurity frameworks such as ISO 27001, ISO 27002 (2013), ITSG-33, NIST CSF, NIST 800-53, NERC CIP, IEC 62443, and others.
• Developed and executed strategies for Cybersecurity Architecture, Cybersecurity Programs, Risk Management, Audit, Compliance, and overall cybersecurity strategy.
• Planned and supervised cybersecurity activities throughout the project lifecycle, from requirement management and feasibility analysis to design, testing, commissioning, and operational stages.
• Conducted thorough cybersecurity threat, vulnerability, and risk assessments, involving key stakeholders, and identifying critical assets.
• Translated and communicated cybersecurity requirements to suppliers, actively participating in procurement activities related to cybersecurity aspects.
• Conducted analysis, and led a team if required, to provide necessary evidence supporting project requirements.
• Collaborated with the design and construction teams to ensure effective implementation of cybersecurity activities and adherence to cybersecurity requirements by both the project team and suppliers.
• Reviewed cybersecurity submissions from suppliers and designers, offering detailed technical comments and suggestions.

Bachelor of Linguistics Honors - Linguistics - University of Ado Ekiti