Nicholas Torres

Senior information security and third-party cyber risk professional supporting enterprise risk programs in regulated environments. Experienced in vendor security assessments, risk and control governance, regulatory mapping, incident-response planning, remediation oversight, and executive reporting. Combines GRC, analytics, SDLC, and Agile delivery experience to translate complex risk issues into clear actions for business and technology leaders.

Cybersecurity Risk Auditor / Assessor — Contractor supporting Capital One at Ampcus, Inc (2026 – 2026)

Provide third-party technology risk oversight and governance for Capital One, supporting technology-governance processes, emerging-regulation compliance, and third-party incident-response planning

• Oversee third-party technology risk and control frameworks across the vendor lifecycle for Capital One’s Enterprise Technology.
• Develop requirements and oversight protocols for technology integrations and key technology-governance processes
• Enhance the enterprise third-party risk framework by integrating generative AI (GenAI) monitoring, risk, and ethical-use requirements into vendor oversight
• Analyze emerging digital-operational-resilience requirements, including DORA, and translate them into third-party program updates that support enterprise compliance
• Build and maintain a third-party cyber incident and vulnerability response playbook with key stakeholders.
• Identify and define technology and cyber requirements for third-party processes, providing effective challenge and risk-informed recommendations to leadership
• Advise stakeholders and senior leaders across global teams on aligning third-party security objectives with business priorities and emerging risk-management approaches
• Translate complex technical issues into concise written reports and presentations for executive audiences

Sr. Information Security Risk Analyst at Radian Group (2022-10 – 2025-12)

• Reduced average open Risk Register entries in NAVEX IRM (LockPath) from 20 to 5 and average time to closure from 30 to 8 months by implementing a structured review process; delivered real-time dashboards and reports to senior leadership, improving SLA tracking and risk decision-making
• Partnered with Supplier Relations to oversee 350+ annual vendor security assessments against NIST, ISO 27001, and SOC requirements, using RiskRecon, Black Kite, and SecurityScorecard to support monitoring, regulatory alignment, and compliance oversight
• Updated 25 policies and coordinated policy-owner attestations to keep records accurate and document revisions
• Applied regulatory knowledge from SOC audits, ISO 27001, and the CSBS Nonbank Enhanced Exam while mapping Radian's controls to NIST CSF
• Created risk-entry templates, gap analyses, and threat-tracking logs in NAVEX IRM (LockPath) and ServiceNow, incorporating metrics and quantitative risk criteria to support security assurance

GRC Project Manager & Technical Team Lead at Cadmium (EthosCE LMS) (2021-05 – 2022-10)

• Managed the end-to-end asset lifecycle, reviewed system logs, and conducted NIST SP 800-37 risk assessments to support regulatory compliance
• Migrated the legacy ticketing system to Jira Service Management, reducing monthly operating costs by 64% through process automation and workflow improvements while maintaining SLAs and enhancing reporting
• Managed an eight-person cross-functional team of four project managers, two business analysts, a software developer, and a graphic/web designer
• Reviewed and implemented NIST- and HITRUST-aligned security policies, procedures, and practices in support of PCI DSS SAQ-D compliance; updated 12 policies and coordinated owner attestations
• Partnered with organizational leaders on security assessments and risk analyses for systems and processes, improving company-wide risk visibility and supporting continuous improvement
• Created Client Services training and documentation, using hands-on workshops and digital resources to improve onboarding, cloud-security awareness, and secure handling of business information for 15 employees.

Technical Project Manager at DLC Solutions (EthosCE LMS) (2019-08 – 2021-05)

• Led client requirements gathering, budget oversight, and vendor and security management for 32 clients.
• Partnered with developers using Agile user stories, test cases, and workflow diagrams to drive delivery
• Ran feedback loops that improved onboarding efficiency by 15%

MS in Information Technology; Concentrations: Analytics & Business Intelligence and Healthcare IT; Graduate Certificate: Cybersecurity Management – Virginia Tech (2021-05)

BA in Philosophy & Sociology – Furman University (2018-05)