Micheline Ananou

Cybersecurity and Technology Risk professional with 6+ years of experience driving cloud security, risk governance, and control automation across cloud and hybrid environments. Proven track record of reducing enterprise risk through policy-as-code, continuous controls monitoring (CCM), and DevSecOps integration. Trusted partner to engineering and leadership, translating complex technical risks into measurable business outcomes and audit-ready programs.

Sr. Associate IA, Core Engineering TechRisk and Cybersecurity at Goldman Sachs (2022-09 – Present)

• Champion enterprise-wide cloud security and technology risk governance across 120+ applications in AWS and hybrid environments, reducing high/critical residual risk by 38% through targeted control remediation (IAM, encryption, access controls)
• Designed and implemented policy-as-code guardrails using AWS Config and Terraform, aligning cloud configurations to NIST CSF and CIS benchmarks, and automating control enforcement at scale
• Served as a core contributor within the Internal Audit Artificial Intelligence Center of Excellence (AI COE), supporting enterprise AI risk governance initiatives involving model lifecycle controls, data governance, access management, regulatory compliance, and emerging AI assurance frameworks
• Built and scaled Continuous Controls Monitoring (CCM) capabilities across Snowflake, Redshift, and data lake environments, enabling real-time detection of control drift and proactive risk mitigation
• Partnered with engineering and platform teams to integrate security, IAM, and compliance controls into enterprise CI/CD workflows, strengthening governance enforcement and reducing deployment-related risk across cloud environments
• Led AI/ML risk governance and audit coverage, assessing controls across model lifecycle (validation, drift monitoring, approvals), aligning with Model Risk Management (MRM) frameworks and emerging AI regulations
• Translated technical risk findings into executive-level reporting (KRIs/KPIs, dashboards), influencing senior stakeholders and driving risk-informed decision-making
• Directed cross-functional initiatives across security, engineering, and risk teams to operationalize audit-ready control frameworks, resulting in consistent regulatory and internal audit success

Cyber Governance & Incident Response - Promotion at Paya Inc. (2020-01 – 2022-09)

• Led end-to-end incident response lifecycle (NIST 800-61), including detection, triage, containment, and post-incident analysis, improving response time and strengthening organizational resilience
• Engineered centralized security telemetry pipelines integrating Splunk, AWS CloudTrail, and ServiceNow, significantly improving detection coverage and investigation speed
• Operationalized threat intelligence capabilities by integrating external intelligence feeds with enterprise telemetry, improving detection engineering, threat prioritization, and proactive cyber defense strategies
• Automated cloud infrastructure deployments using Terraform, enabling secure AWS adoption, standardization, and reducing infrastructure costs by 20%
• Conducted enterprise-scale incident investigations and forensic analysis across distributed cloud and on-prem environments, strengthening containment strategies and reducing operational security risk

Security and Compliance Lead at Paya Inc. (2018-10 – 2020-01)

• Led enterprise security and compliance programs (PCI DSS, SOC 2, ISO 27001), achieving successful recertifications while reducing audit preparation effort by 45%
• Directed enterprise risk assessments, control testing, and compliance validation activities across security and infrastructure domains, strengthening governance maturity and improving control effectiveness
• Embedded DevSecOps security controls (SAST, DAST, IaC scanning) into CI/CD pipelines, reducing production vulnerabilities and accelerating remediation timelines
• Enhanced vulnerability management lifecycle, improving SLA adherence and reducing exposure to critical security risks

B.S. in Cybersecurity and Information Assurance (2027)