Chad Sullivan

Results-driven compliance and risk professional with deep experience governing regulated operations, enforcing policies, and improving control effectiveness across healthcare and business settings. Skilled in applying NIST, ISO, COBIT, HIPAA, SOX, and SOC 2 principles to strengthen documentation accuracy, mitigate operational risks, and support audit readiness. Adept at developing structured processes, managing sensitive information, and translating regulatory requirements into practical, repeatable workflows.

Recognized for proactive risk identification, strong stakeholder communication, and a commitment to continuous improvement.

GRC Security Analyst at Rings and Cages LLC (2010-09 – Present)

• Built and managed the company's governance framework, aligning operational processes with COBIT, ISO, and NIST CSF principles to strengthen internal controls and reduce compliance gaps by 95%.
• Implemented structured financial and operational controls, improving audit readiness and reducing discrepancies in inventory, cash handling, and vendor billing by 94%.
• Conducted ongoing risk assessments across operations, identifying control weaknesses and implementing corrective actions that reduced operational risk exposure by 95%.
• Developed and maintained formal documentation (SOPs, policies, process maps, control checklists), improving procedural consistency and supporting compliance with state regulatory requirements.
• Managed vendor due diligence and contract governance, ensuring alignment with SOC 2, PCI, and GLBA-related expectations for data handling, payment processing, and service reliability.
• Leveraged Excel, Access, and SQL-based analysis to evaluate financial trends, operational KPIs, and customer behavior, enabling data-driven decisions that improved profitability by 10%.
• Oversaw incident response for operational issues (safety, customer escalations, vendor disputes), documenting root causes and implementing mitigation steps aligned with risk management best practices.
• Led staff training on policies, safety protocols, and compliance requirements, increasing adherence rates by 90% and reducing procedural deviations by 85%.
• Managed technology upgrades and system configurations, ensuring secure access controls aligned with Active Directory and least-privilege principles.
• Performed internal reviews of financial, operational, and compliance processes, identifying gaps and implementing improvements aligned with SOX-style control expectations.

Neurology Sleep Center Manager at University of Kansas Medical Center (2006-06 – 2010-09)

• Managed daily operations of a regulated medical center, ensuring full compliance with HIPAA, safety standards, and documentation controls, reducing compliance deviations by 90%.
• Oversaw staff scheduling, training, and performance management, improving procedural adherence and reducing operational errors by 15%.
• Conducted internal compliance reviews of patient documentation, safety protocols, and workflow processes, identifying gaps and implementing corrective actions aligned with healthcare regulatory expectations.
• Strengthened governance by redesigning workflows, reducing process bottlenecks by 20% and improving patient throughput by 25%.
• Maintained medical records and documentation practices aligned with HIPAA, ISO-based quality standards, and organizational policies.
• Supported technology upgrades, system integrations, and workflow automation, improving operational reliability and reducing downtime by 35%.
• Collaborated with cross-functional teams (IT, compliance, clinical staff) to ensure accurate data handling, secure access controls, and adherence to regulatory requirements.

Criminal Justice – Johnson County Community College