Didler

GRC CONSULTANT at UNITEDHEALTH GROUP (2024-08 – Present)

Assess administrative, technical, and physical safeguards at healthcare client sites against NIST SP 800-53, completing 100% of assigned control assessments on schedule to verify ePHI protections are designed and operating effectively.
Evaluate client programs for HIPAA and HITECH compliance, determining whether safeguards sufficiently protect ePHI.
Identify control deficiencies, recommend remediation, and track weaknesses through POA&Ms with system owners, achieving 90% on-time remediation.
Assessed 85% of third-party vendors handling patient data by reviewing security questionnaires, contracts, BAAs, SOC reports, and certifications, and documenting findings in a vendor risk matrix to inform vendor selection and compliance.
Document findings and risk in security assessment reports, delivering 100% on time to give leadership a clear basis for risk-based decisions.
Build risk registers, dashboards, and metrics in Excel and Tableau, and manage assessment evidence in SharePoint, enabling senior management to make timely, data-driven decisions
Develop and review information security policies, standards, and procedures for healthcare environments based on NIST SP 800-60 and FIPS 199, ensuring compliance and reducing audit findings

CYBER RISK ANALYST at BRISTOL HOSPICE (2021-01 – 2024-07)

Supported HIPAA technical safeguards by reviewing user access in Entra ID, device compliance in Intune, alerts in Defender and Sentinel, and DLP policies in Purview, helping maintain 99% compliance
Trained staff on HIPAA privacy and confidentiality, using Adaptive Security to track awareness simulations and achieving 100% staff completion.
Tracked compliance findings in Excel and reported them through Tableau dashboards, driving 90% of findings to resolution.
Prepared for state and federal surveys by gathering and validating evidence, maintaining 100% survey readiness.
Conducted internal compliance reviews of patient charts and billing documentation, identifying gaps and supporting corrective action plans.
Monitored patient records and clinical documentation using NIST SP 800-53A examination methods and Excel tracking, achieving 100% compliance with HIPAA, CMS hospice regulations, and organizational policies.
Maintained compliance logs and documentation trails in Excel and SharePoint, enabling regulators to review records within 48 hours and cutting audit-preparation time by half

COMPLIANCE ANALYST at CATERPILLAR INC. (2019-12 – 2020-12)

Performed security control assessments of control implementation and policy compliance, documenting results and driving closure of 85% of identified control gaps.
Supported vulnerability management by prioritizing CVE-based weaknesses in Jira, tracking remediation progress, and validating corrective actions, which accelerated closure of 70 % of findings within the SLA.
Maintained role-based access controls in Azure AD (Microsoft Entra ID), monitored system access, and enforced encryption requirements, preventing 12 unauthorized access attempts during the year.
Administered endpoint security and application allow-listing through Microsoft Intune and Defender for Endpoint, reducing malware incidents on managed devices by 30 %
Monitored security logs, alerts, network activity, and endpoint events in Microsoft Sentinel (SIEM) and Defender for Endpoint (EDR), identifying and responding to 45 security alerts and lowering potential breach risk.
Investigated security incidents, containing 100% within SLA, and documented findings, escalations, and post incident activities.
Partnered with incident response, threat intelligence, SOC, and engineering teams to apply control deficiency identification and implement remediation steps, which reduced repeat incidents and improved security
Developed security procedures and awareness training materials aligned with CMS regulations and NIST standards, and posted them on SharePoint to increase employee compliance

About