Jaime Contreras, MBA, CISM, CISA

Fractional CISO & Cybersecurity Consulting for Healthcare and Finance

Boutique, high-touch GRC, risk governance, and audit readiness advisory. Limited to select engagements — up to 30 hours per week, by application only. (See https://www.jmcontreras.click).

IT Security Specialist Gonzaba Medical Group

• Lead security and privacy risk management responsibilities for sensitive healthcare and financial data, including governance of controls across use, processing, storage, and transmission.

• Update and mature security/privacy policies, procedures, supporting documentation, and remediation action plans to achieve and sustain HITRUST certification.

• Coordinate and manage communications with internal/external auditors and senior leadership; support audit readiness through evidence planning and response management.

• Assist with review of network security logs and support investigation/remediation workflows; translate findings into control improvements and prioritized risk treatment.

Information Risk Analyst Versant Health

• Assured information security risk management for sensitive data by managing audit responses and security assurance activities for leadership and IT teams.

• Produced IT responses to 200+ scheduled and ad-hoc client audit requests/surveys, supporting customer assurance and compliance obligations.

• Drove compliance program work-streams supporting HITRUST, SOC 2/SOC 1, and PCI requirements; updated documentation, evidence plans, and action items.

• Partnered directly with the Chief Information Security Officer to support program execution and continuous improvement.

• Developed incident response onboarding/training materials and created processes to document and monitor internal/external scan results for timely vulnerability remediation.

Risk and Compliance Manager Aventine Hill Partners (now Vaco)

• Delivered GRC and audit advisory services for technology, infrastructure, SOX 404, and operational audits; performed testing and supported risk-focused audit planning.

• Conducted SOX 404 testing for a national bank aligned to FFIEC control expectations; contributed IT advisory support across data analysis, governance, risk, and compliance.

• Supported client engagement and coordination with external parties, maintaining stakeholder relationships and executing audit plans with contractors and client audit teams.

• Supported development/maintenance of control documentation, security framework adoption (e.g., COBIT), and related process improvement initiatives.

Information Systems Manager UT Health Science Center at San Antonio

• Managed internal audit/consulting team operations, including hiring/interview processes, staffing oversight, and performance management; served as sole departmental manager during the initial promotion period.

• Provided IT risk assessments and independent evaluations of technology supporting critical business functions (academic, research, financial, and medical services to improve controls and operational efficiency).

• Owned IT portions of risk assessment and annual audit planning; championed adoption of HITRUST common security framework with CIS 20 focus to strengthen enterprise risk assessment.

• Led and oversaw technology components within information technology and operational audits; performed Active Directory, PeopleSoft ERP, network security, and legacy claims security audits.

• Advised on security strategy in information security meetings, informed by HIPAA and NIST-aligned requirements and federal/state compliance expectations.

Masters in Business Administration (MBA) Texas State University

Certified Information Systems Auditor (CISA) ISACA

Certified Information Security Manager (CISM) ISACA

Certified Common Security Framework Professional (CCSFP) HITRUST

Bachelor's of Arts, Psychology University of Texas in Austin