Verizon

Distinguished Engineer

• Prepared Verizon managed security services platform for ISO 27001 certification making it available for sale ahead of schedule
• Identify, analyze, develop end-to-end risk assessment processes to mitigate business partner and third party risk (vendor risk management)
• Quantify risks based on scope and impact, create mitigation strategies, influence adoption and added them to risk register for monitoring 
• Analyzed systems, applications and project, operation risk and established security controls improvement initiatives resulting in $5 M upfront cost reduction 
• Lead cross-functional application and vendor reviews for technology, business process, Information security and regulatory risk collaborating with business, privacy and legal teams
• Evaluate cloud security posture, assessed risks  and designed controls to remediate audit deficiencies 
• Reporting status of key risk initiatives to management via dashboards
• Awarded two Spotlight Awards for contribution to a confidential project, and three Patent Awards

Principal Risk Management

Advisor and subject matter expert on technology, operational, financial, and/or information risks and control mechanisms to prevent fraud, abuse, strategic, reputational, and operational risks
Reviewed Gift Card and Credit Card projects for  Fraud, Credit and Payment Systems and suggested controls to mitigate / keep risk within acceptable limits for Bill To Cash.
Evaluated new products, processes and projects for fraud and credit risk, and suggested appropriate controls as needed.
Manage projects, provide requirements and testing support for Bill To Cash
Review and document root cause analysis of fraud issues. After analysis suggest mitigation. Monitor progress and report once issues are fixed.
Collaborate with Tax, IT Security, Legal and Compliance teams to ensure that risk is handled adequately for platforms, portals and infrastructure.

New Product Risk

Developed business requirements for new system and process implementations and enhancements that impacted data privacy, OFAC and other regulatory requirements
Collaborate with functional teams in developing business requirements and business controls in implementation plans
Drove process improvement and control implementation projects, while dealing with ambiguity
Developed documentation of processes, risks, and controls and worked with owners to assign accountability

Verizon Global Fraud Operations

• Lead the multiple audit planning, scoping, execution, and reporting based on identified risks for applications, systems and business processes
• Performed assessments and audits, suggested control improvements, documented technical issues to get multiple stakeholders to agree on recommendations  
• Audited against various frameworks, it audit and assurance standards like ISO 27001, SSAE 16, SSAE 18 SOC, CIS, NIST CSF, and others

Verizon Internal Audit

Rutgers University

• Lecturer for 400 level course in Information Security
• Rated 4.6 / 5.0 by students

Lecturer

Harman International

• Lead Foreign Corrupt Practices Act (FCPA) audits in Brazil and U.K. 
• Lead IT and integrated audits saving Harman International over twice our department budget for the year. 
• Evaluated purchase application and transactions, and detected double payments leading to the software vendor agreeing to return 1.5 million dollars during a Purchase Card audit.
• Prepared detailed documents, reports and observations supporting audit findings. 
• Design reports and data visualization dashboards for SOX audits.

Senior IT Auditor

Kershaw K. Khumbatta P.C

Associate

Open Information Systems Security Group

Vice President

Synerzy Software Solutions Inc.

Risk Assessment, Review and remediation of Systems and Processes.

Senior Consultant

Clayton Holdings Inc.

SOX IT Specialist

Prudential Financial and Management Services Ltd.

Managed engagements for IT Risk Assessments, Security Reviews, Pre- and Post-Implementation Reviews, Application Reviews  documentation and testing.

I am a risk management professional, leading system and process improvements with business owners to reduce risk. Guide business teams on Third-Party compliance and vendor assessment for risk mitigation to achieve business objectives. I anticipate bottlenecks and manage escalations. I use data to manage risk, quantify the impact, and translate risk metrics for business stakeholders. 
I help business owners execute cybersecurity strategies and accept risks appropriately based on quantified risk appetite.
With over 15 years of experience identifying, assessing, and driving remediation for information security professional risks in applications, I understand unique client challenges across multiple industries.
I am a sought-after resource to review risks in emerging tech like cloud security, blockchain, AWS security, and complex risk assessments.

Niloufer holds multiple certifications in IT Security (CISSP, CCSP), Risk (OPEN Fair), Privacy (CDPSE), Audit (CISA, CIA), and Fraud (CFE). She is a Certified Public Account licensed to practice in New Jersey. And a Chartered Global Management Accountant (CGMA).

Niloufer has authored two patents for System For And Method of Generating Visual Passwords (US 9,171,143 B2) and Establishing An Alternate Call Path Using Short-Range Wireless Technology (US 9,392,523).
Niloufer teaches part-time at Rutgers University, the state university of New Jersey, and is the organizer of the largest cybersecurity career MeetUp group and creator of the YouTube Channel "Cybersecurity Career Talks."

Niloufer co-founded two nonprofits Step Up Skill in 2020 and (ISC)2 New Jersey Chapter in 2012.

Niloufer Tamboly

SiteRx

Head of GRC

Stories in cyber

Stories in Cyber is a podcast dedicated to the members of the NJ Cybersecurity community

Podcast Host

anecdotes

Led the following initiatives in anecdotes:
- Messaging and Positioning: Created value differentiation and assets used in understanding the positioning of the organizations and the product compared to alternatives. Applied this positioning 
- Analyst Relations with Gartner and Forrester: Got mentioned in a Gartner Report 'Market Guide for Continuous Compliance Automation Tools in DevOps'
- Content Stategy for Organic: Blogs, Marketing Assets (Data Sheets, White Papers), worked with agency for SEO that included keywords, positions, and creation of briefs which led to 5x website traffic, 2.5x keywords increased position 
- Product Marketing Campaigns: Respnsible for creation of product updates and respective enablement assets for the GTM teams 
- Competitive Analysis: Responsible for Battlecards, Competitive Sheets, Gaps in Keywords, and assets for the sales team
- Field Marketing: Led several in-person and virtual events that generated leads for sales team. Large events: IIA and ISACA GRC Conference ISC2 Security Congress.

Senior Product Marketing Manager

Reciprocity, Inc

Strategic
-Gathered Market Intelligence on SMB and Midmarket and Product Fit
-Competitive Intelligence and Positioning against Competitors
-Evaluation and Analysis on Component and Content for Compliance
-Research Analyst Engagement and Relationship with organizations like Gartner, Forrester, GRC20/20
-189% increase in sales from Q1 to Q2 2022
-23% Increase in Average ARR (Annual Recurring Revenue) Deal Size from Q1 to Q2 2022
-26% Upgrade to Premium from FY 2022
-4x Adoption of Platform Month over Month 2022
-135% increase of User Base Q1 to Q2 2022
-42% Value Gained from Product FY 2022


Product
-Built ZenComply with designers and engineers from idea to market in a 2 quarter timeline. 
-Helped Build ROAR Platform with ZenComply as a flagship application with inputs to ZenRisk
-Orchestrated the first sale of ROAR Platform before GA release

Product Line Manager, Compliance

Product
-Designed initial MVP feature of ZenComply using Miro and Confluence
-Compiled Product Requirement Documentation on Aha and Productboard
-Defined Platform Elements for Roles and Organizational Structure
-Collaborated with Designers and Engineers to Groom Requirement and Acceptance Criteria through Figma and Zeplin
-Defined Roadmap for future enhancements and milestones for ZenComply
-User Testing and Validation of concepts with customers and prospects for ZenComply

ROAR Platform
- Defined Compliance components of ROAR Platform
- Research and Executed on onboarding content for Compliance
- Defined positioning and sales enablement for ROAR and ZenComply
- Roadmap and Customer Engagement for ZenComply and ZenVendor
- Maintained GRC thought leadership workshops
- Created Foundation for Integration Approach for ROAR
- Successfully implemented AWS and CIS Benchmarks on ROAR

Senior Product Manager

Riskonnect, Inc.

Products:
- Internal Audit
- Internal Controls (SOX)
- Regulatory Compliance Assessments
- Issue and Findings Management
- Unified Compliance Framework Integration
- Compliance.ai Regulatory Change Management Integration

Product Manager, GRC

Galvanize

Products 
- Risk and Compliance Assessments
- Incident Management (Case Management)
- Enterprise Risk Management
- RiskLens API Connector
- FISMA
- Risk Register

Product Manager, ITGRC

As a Solutions Consultant, my days are filled talking with Risk and Security Executives or leads that are interested in maturing their eGRC (Enterprise Governance, Risk, and Compliance) programs. I dive into many diverse areas such as Vendor Risk Management, Threat and Vulnerability Management, IT Risk Compliance, Business Continuity and Disaster Recovery, and Enterprise Risk Management. I am a technical resource that knows how to do everything from installing and troubleshooting a solution to communicating to C-Level Executives what type of hardships similar organizations face today and how to alleviate such burdens. I have seen both the consulting side of the coin and the sales side of the coin and am proud to apply all the experience I had in my former life to the work I do today.

Senior Solutions Consultant

SAI Global

As a Pre-Sales Engineer I have had the pleasure working in the following types of deployments:

IT Security (NIST 800-53, SANS Top 20, Cobit 4.1, ISO 27001:2013)
Regulatory Compliance (OSHA, SOX, GLBA, Dodd Frank, HIPAA, PCI) 
Business Continuity (Disaster Recovery, Incident Management, Business Continuity, BIAs)
Enterprise Risk Management (ISO 31000, COSO) 
Vulnerability Management (Qualys, Nexpose, Nessus, Saint)
3rd Party/Vendor Risk Management (SIG Framework,Cloud Security Alliance, etc)
Physical Access (Asis International, ISO 27002)
Integration with external applications via Talend, API, XML Report Mapping
Automated Collections (Windows Servers, Oracle Database, Browser, Operating Systems)

Pre-Sales Dev work - Proof of Concepts POCs using Talend Integrator and Axure Mockup Tool

On-Site Training - Provided Basic and Advanced Training for Admin Users

Pre-Sales Engineer

Modulo Security Solutions

Automating risk assessment and audit processes are my primary responsibility. I create the necessary front-end interface that clients see when they use the Modulo GRC tool. My most recent client for Modulo required the automation of their Risk Assessment Process for Internal Projects. 
I have created the knowledge bases and related surveys for the following:
Cloud Based Applications
Scoping of Risk Assessment Process
Automation of the SANS top 20 Critical Controls
PCI Compliance Automation
Knowledge Transfer and Documentation of Risk Projects within the Modulo Framework

I am responsible for automating this process and mapping these controls to specific frameworks such as the following:
COBIT 4.1 and 5.1
NIST 800-53 Guidelines
OWASP Guidelines
Sarbanes Oxley Act of 2003
PCI Compliance
FISAP
Cloud Computing Risk Assessments
SIG (Standard Information Gathering)
and Internal Policies of an organization

I am an expert at integrating vulnerability scanners (Nessus, Qualys, Nexpose) with the API integration of Risk Manager. I have had experience with intergrating GRC systems with LDAP authentication, XML mapping, and integrating with databases using XML integration and API calls. 

I have had plenty of experience using the continuity and ERM (Enterprise Risk Management) solution for Risk Manager. I have used risk manager for managing the approvals, testing, and activation of disaster recovery and business continuity plans. Implementation of Business Impact Analysis for process owners and defining strategies for an organization 

I finally have a very deep understanding of the risk assessment process due to my experience in IT Auditing. I am able to understand the current risk assessment process and know how to integrate these processes to Risk Manager. I have had extensive experience mapping policies and standards to a multitude of frameworks.

IT GRC Consultant

Sunera LLC

Some of the programs I have had the pleasure of auditing: Microsoft Active Directory, Oracle Enterprise Management System, Markview, ADP, Traffic systems (Specific to Radio/TV/Film/Media), Backup systems, Databases (Oracle and SQL), Firewalls, and Business Intelligence Systems. 

Within each of the following systems I have tested several controls when it comes to IT Audit here are some of them:

•	Logical Access Controls
•	Change Management
•	Entity Level Controls (Policy and Procedure)
•	Disaster Recovery
•	Backups and Data Retention
•	System Development Life Cycle (SDLC)
•	Physical and Environmental Controls
•	Computer Operations 
•	Incident Management 
•	Segregation of Duties
•	Security Configurations

Within the duties of my current position I am responsible of the following in regard to the GRC tool

•	Development of controls to be imported to GRC tool
•	Alignment of controls to specific standards (COBIT, SOX, PCI)
•	Management of projects that contain controls for each area being tested
•	Importation of policies, standards, guidelines, baselines, and procedures of organization to GRC tool
•	Project Management automation via development of surveys through GRC tool
•	Implementation of automated collector of network servers (domain controllers)
•	Development of monthly metrics for remediation
•	Development of Findings Summary for Management Self-Assessment of General Computer Controls
•	Development of quarterly automated projects for remediation of prior year findings

IT SOX Compliance Lead

Robert Half International

In my previous life as a financial auditor, I was exposed to various types of business, and types of assurance engagements. Ranging from the small mom and pop shop write-up for tax purposes to the full blown audit engagement that uses a strict budget and constant communication with the client, I have seen it all. Here is a small comprised list of what my former responsibilities were:

•	Perform risk assessments based on prior year information and benchmarked across industries
•	Prepare audit work papers electronically and send out requests for information in regard to audit
•	Develop sampling methodology based on type of business, residual risk, in line with compliance/standards of the industry
•	Perform necessary walkthroughs with personnel of interests to document the process and to illustrate the structure of the organization through written narratives 
•	Perform the necessary test steps that relate to controls in line with compliance standards 
•	Review the findings related to the controls in-scope of the engagement with follow-up in regard to the findings
•	Prepare the Financial Statements and notes to the financial statement for various aspects of the business

With being responsible with the above tasks, it has been my pleasure to been exposed to many types of engagements. The following list is the type of engagements I was a part of:

•	Assurance Engagements (Write-ups, Compilations, Reviews, Audits)
•	Inventory Engagements
•	Internal Auditing Engagements
•	401k Engagements

I have worked in a lot of industries under various types of clients here is a short list of the type of clients I have worked for: Real Estate and Pharmaceutical.

Financial Specialist

With over 10 years of experience in security, sales, and product management, I am a certified information security manager (CISM) and a GRC strategist. I help organizations manage their governance, risk, and compliance (GRC) challenges with innovative and scalable solutions.

Currently, I am the Head of GRC at SiteRx. I lead the efforts for Vendor Risk Management, Security Compliance, Security Awareness, Data Governance, Findings Management, Privacy Management, and Product Security. Additionally, I host Stories in Cyber, a podcast that showcases the stories and insights of the NJ cybersecurity community. My mission is to empower and inspire security professionals and enthusiasts with valuable content and best practices.

taplio

The Battle

Niloufer Tamboly

Kerwyn Velasco

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?