AVA Compliance Solutions

AVA provides bespoke Governance, Risk, and Compliance (GRC) strategic advisory and implementation services such as the following:
- GRC Program Design and Roadmap: build for the current client needs with design for future markets and business goals. Specific offerings include setting up Enterprise Risk Management, Policies and Training, Customer Trust and Assurance to speed up Sales Operations, Third Party Risk Management, Internal and External Audits and automation.
- Help organizations with industry-specific needs and achieve attestations for compliance with various standards such as: FedRAMP/NIST-800-53, CMMC/NIST-171, NIST CSF, HIPAA, HITRUST, PCI DSS, IRAP, Cyber Essentials Plus, DORA, NIS 2, SEC and NYDFS reporting.
- Information security certifications and attestations: ISO 27001, ISO 27017, SOC 2 Type 1 & 2, Cloud Security Alliance STAR 1 & 2.
- Operation Technology (OT) cybersecurity certifications such as IEC 62443.
- Privacy program design and specific privacy compliance and certifications: GDPR, CCPA and other relevant US privacy laws, ISO 27018, ISO 27701.
- AI regulations and certifications: EU AI Act, ISO 42001.
- Other compliance requirements where applicable such as OFAC, ITAR, Digital Accessibility/WCAG, Ethics and Code of Conduct, Insider Threats.

Co-Founder and Partner

Akamai Technologies

Ensured successful transition of the Noname GRC function into the greater Akamai portfolio and appropriate teams and processes and supported targeted compliance objectives.
- Delivered 2024 Noname Security audits for PCI DSS, HIPAA, SOC 2 Type 2, and CSA STAR 2 completed on time and without any findings despite the transition of some tools and personnel over to Akamai.
- Ensured successful delivery of PCI DSS Level 1 certification for the API Secuity Platform (formerly Noname) and the Akamai Connector.
- Created detailed instructions and training for both Akamai and Noname Security Sales and GRC personnel on contract and RFP responses, as well as provided advice to improve Go-To-Market efficiency and deliver successful transition of Customer Trust and Assurances practices from Noname to Akamai with all contract/RFP requests addressed 100% and usually within 24 hours.
- Completed full gap assessment of the Australian government IRAP requirements, complete with detailed answers and specific evidence references.
- Completed full assessment of CMMC levels 1, 2, and 3 requirements with mapping to relevant SOC 2 and PCI DSS controls, and specific answers and evidence references.
- Assisted existing programs with EU DORA and NIS 2 compliance for comprehensive task tracking and scheduling.
- Developed executive presentation template for regulation compliance, including highlights on DORA and NIS 2.
- Performed analysis and provided recommendations for US government export compliance, such as ITAR and EAR.

Director of Compliance

University of Vermont Grossman School of Business

Advisor to Women in Leadership graduate program

Advisor

Noname Security

Continued the expansion of Noname’s amazing compliance program towards the IPO/acquisition stage.

VP of Compliance

Led an amazing team of security and privacy professionals to build the best compliance program in the world.
* Designed long-term compliance roadmap by aligning compliance frameworks and standards to meet current and future business and regulatory needs. Expanded existing SOC 2 and PCI DSS controls and added CSA STAR Level 2 and HIPAA attestations to provide a comprehensive and scalable foundation.
* Established an Information Security Management System. Created and updated 50+ policies, procedures, and standards to follow NIST best practices and other industry guidance.
* Developed internal audit framework and control testing, and enabled automation for monitoring and evidence gathering. Structured internal audit controls to meet all external obligations to reduce time and resources for external audits and enable quicker gap identification and resolution.
* Set up vetting of customers, partners, and vendors to meet regulatory compliance.
* Created and deployed new information security awareness training. Deployed new privacy awareness training. Set up metrics and alerting to track progress and ensure compliance.
* Assisted the sales team to increase efficiency and control in reducing the sales cycle and enforcing contractual standards.
* Participated in 300+ contract reviews and RFP responses. Negotiated directly with customers to significantly reduce corporate risk.
* Updated MSA and other contractual terms to reduce business risk and enable future business growth.

Director, Risk and Compliance / Global Risk Officer

ForgeRock

Designed and built a mature compliance program in less than 3 years to facilitate a hugely successful IPO.

Select accomplishments:
* Delivered ISO 27001 certification within the first year. Delivered successful attestations for SOC 2 Type 2, Cloud Security Alliance (CSA) Star Level 2, and HIPAA Security Rule/HITECH Breach Notification Requirements.
* Designed a comprehensive internal audit program to cover all ISO27001 and other security requirements, while reducing time spent by other business units and developing the audits to be scalable and easy to maintain going forward.
* Established relationships with key stakeholders and SMEs across all Business Units to speed delivery of security initiatives by 200%;
* Managed enterprise security risk program, identified 90+ risks and mitigations;
* Negotiated and responded to 200+ customer contracts and security RFP/RFI requests, including from top Fortune 500 companies.
* Provided security compliance reports and advice to executives.

Head of Security Compliance

Cisco

Oversaw end-to-end delivery of information security projects for Cisco WebEx and Cloud Services to protect 90,000+ business customers. 
• Led GRC initiatives to meet Cisco's Data Protection and Privacy requirements. Developed processes and build a security monitoring platform to provide visibility and proactive response to security threats. Assisted with vulnerability assessment and remediation.
• Provided technical guidance to meet audit compliance for FedRAMP, SOC2, and ISO 27001.
• Developed Infrastructure & Cloud logging and monitoring requirements and implementation guides.
• Identified ways to improve organizational effectiveness and security culture as a Product Security Advocate. Developed security awareness through Learning & Development training (videos, presentations, wikis) and presented to engineers and managers at Cisco internal conferences. Reduced product security issues by 200%.
• Managed several security engineers and performed hands-on research and analysis of Cloud and Infrastructure security. Identified and documented 100+ product security improvements. Developed 20+ new threat models and detection mechanisms.
• Established metrics and 5-year roadmap for global initiatives. Identified project dependencies and advanced efforts 6 months ahead of schedule.

Program Manager and Product Security Advocate

Dobrushkin.com

Management Consultant:
Improve organizational strategy, business operations, and work culture to increase productivity, enhance product vision, and sustain company growth. Clients include travel, non-profit, social networking services, mobile apps and games, network security, and stealth start-ups.
• Drive toward 80-20 rule. Identify key projects that will bring 80% of desired effect with 20% of resource investment.
• Reorganize processes, resolve cross-cultural and cross-functional difficulties in operation and communication.
• Promote positive work environment to increase employee productivity, collaboration, and retention.
• Develop user engagement and growth strategies. Lead local and international teams.
• Assess viability of technical projects and start-up opportunities to counsel angel investors.
• Provided technical implementation guidance to Silicon Valley start-up, which led to an early launch.
• Identified and implemented information security risk reduction and compliance strategies.

Life Coach:
Help individual clients rediscover and realign their passions with purpose to become who they were meant to be and realize their potential.

Management Consultant and Life Coach

SunnyKarma

Lead process improvement and design of systems and programs. Addressed shifting priorities and requirements in a fast-moving startup environment to ensure optimal system operations and user satisfaction.

Program Manager

Progeny Systems

Promoted to progressive responsibility via top performance

Technical Program Manager
Oversaw day-to-day management of large scale government projects.
• Managed projects for NASA and US Navy, which led to annual sales of more than $100 million and $45 million in revenue.
• Pioneered major program re-design by changing the Navy lab culture to collaborative effort across all units, even between competitor companies, increasing operations by 40%.
• Facilitated integration across 10+ parallel sites, shortened problem resolution to 1/3rd of original time. 
• Designed new security solutions that reduced software costs by 50% per year; a total savings of over $5 million for the Navy.
• Collaborated with 20+ contractor organizations, proactively driving system usability improvement and function.

Information Assurance Integration Lead
Directed integration of information security products across US Navy submarine fleet.
• Led system integration for Unix/Linux/Windows platforms and directed software and hardware testing, creating 400+ reports to facilitate compliance and accountability.
• Guaranteed compliance to DoD requirements (FISMA, ISO 27001, etc.) supporting successful Certification and Accreditation (C&A).
• Managed intrusion detection product from concept to delivery, saving the Navy over $1 million per year.
• Ensured integrity, confidentiality, and non-contamination of data across classified and corporate networks.

System Administrator / IT Manager
Ensured IT infrastructure security and operation across multiple offices.
• Developed Progeny’s first access system to classified data via SIPRNet circuit, meeting DISA accreditation.
• Managed IT assets, MS Windows AD environment with Exchange, DNS, WINS, DHCP services. 
• Deployed system-wide security solutions including IDS/IPS, firewalls, patch management, disaster recovery.

Software Engineer
• Developed client/server and Web applications, real-time data processing, database management, and Apache/IIS Web servers.

Technical Program Manager

Fraunhofer CRCG

Developed content search engines and graphical user interfaces using Java Servlets/Applets with Oracle/MySQL databases as the back-end.

Software Engineer

I love building compliance programs that extend beyond IPO due diligence to provide business value and visibility into where the biggest risks are and how to address them. I have managed every part of a compliance program, from internal audits to external certifications and customer audits, to customer trust, to third party risk management, to privacy and legal compliance, to contract review and negotiation. Working with people, building relationships, and solving problems together is what I enjoy most. I have done this in various IT and leadership roles over my two decade career with startups, Fortune 500, and government agencies.

Delivered two successful exits with both startups where I had led the GRC function (ForgeRock - IPO, Noname Security - Acquisition by Akamai).

“The beatings will continue until morale improves” or is our government waiting for every single American citizen to be defrauded or blackmailed through continued data breaches? 

No matter what administration is in power or what set of cyber policies they enforce, the trend continues to get worse and worse for every American since the invention of the Internet. On top of that our utilities, our cities, our critical infrastructure get hacked on a daily basis, costing us hundreds of billions of dollars a year, and countless lives lost, but no one seems to care enough to declare this a national emergency and start doing something meaningful about it…

https://lnkd.in/epYag33U

undefined undefined

Governance, Risk, and Compliance (GRC) Executive building IPO-proof GRC, Startup Advisor, Investor, Consultant, Mentor

If you needed another reminder why Third Party Risk Management is critical to your business and your customers, and no, I don’t mean using annual questionnaires to manage vendor risks - https://lnkd.in/e_Yas9_P

I don’t always agree with Sam Altman, but he is spot on here. Most of the issues we have encountered in modern societies are due to the fact that we let tech companies regulate themselves or made the rules too vague and arbitrary. Tech companies’ job is to follow the law and not invent their own laws, at least for things that are essential to societies. https://lnkd.in/ez5PRzxm

“Everyone has a plan until they get punched in the mouth” - true wisdom from Mike Tyson. AWS and UAE had to find this out the hard way, thanks to Iran’s missile strikes.

Also for everyone in Third Party Risk Management, especially those of you in regulated industries and legacy enterprises that believe security questionnaires are still the best way to assess vendor risks, you may want to update your questionnaire to go beyond asking your vendor if they have a fire extinguisher in their data center…

P.S. Thanks to Kevin Qiu for calling this out!

techradar.com

AWS UAE data center suffers outage after being hit by military strikes

InfoSec

Noel Cruz

Small businesses can still incur massive class action lawsuits for not doing their cybersecurity right. https://lnkd.in/eFBGSvps

Does 50% of small businesses suffering from cyber attacks sound accurate to you? I would wager the number is even higher than that. We have an epidemic and with AI-infused hacking tools and chaining of vulnerabilities and ease of identifying new exploitation paths this will become even worse unless we do something significant about it. https://lnkd.in/eYbD66BU

More competition is always good. Anthropic set the standard, but it is still anyone’s game at this point. https://lnkd.in/e5Xr9rYd

Good cybersecurity reminders for small businesses dealing in finance. https://lnkd.in/eMp4Twki

Scary stuff, but not surprising given how big of a threat surface and opportunity compromising an MSP gives attackers. https://lnkd.in/eG7EzbUS

It is a sad truth in how the world currently works with technology and beyond where the business strategy is to release something that delivers decent value and captures enough of the market and then starts to degrade the service but raises the cost to its users…

Remember the years when you could buy a new car and if it came from a nunber of respected brands you could count on it to run for 1-2 decades without major issues? Or a dishwasher or laundry washer or dryer that could last decades? Now we accept that utility devices and gadgets are meant to last less than five years and call it a win.

Similarly, remember the days of the early Internet where the products we saw continued to innovate and get less buggy and more accessible over time? Now no matter what technology we look at, most products get worse and more expensive over time…

If instead of crying about it you want to laugh, here is a video to summarize the “ensh*ttification” of technology - https://lnkd.in/eMB8YmxV

P.S. I am still hopeful that if we get decent product liability regulation we can force businesses to maintain decent service through a reasonable timeline or face lawsuits. Or there could be even better ways to reset the innovation and reward trend for businesses to roll out products that last and don’t degrade significantly over time. After all, we had this as normal up until the last decade or two…

Transitioning to a different set of infrastructure for a massive company with gazillions of data is no easy task, so let’s not blame Oracle here. A part of me wonders if Oracle is trying to save America’s brains by getting people off TikTok this way… https://lnkd.in/eW6idny3

Want to have some fun and see how AI features can actually help improve productivity, especially for software testing? Come to the 2026 #TricentisTransform !

SAVE THE DATE 🔥 #TricentisTransform 2026!!

3 major cities. 1 unforgettable experience 👏 https://bit.ly/4smmlsf

An interesting case for lawyers adept in securities laws to follow. As a layman I do not understand what constitutes securities fraud when it comes to social media that can have an immediate effect on a company’s stock price. I think as a nation we never decided on what defines social media and how it needs to be governed… https://lnkd.in/e2BS85-k

taplio

Val Dobrushkin's Linkedin Analytics

Val Dobrushkin

Performance ScoreVal Dobrushkin's LinkedIn Performance

Val Dobrushkin's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Val Dobrushkin's Linkedin Analytics

Val Dobrushkin

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Val Dobrushkin's LinkedIn Performance

Val Dobrushkin's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Val Dobrushkin's Linkedin Analytics

Performance ScoreVal Dobrushkin's LinkedIn Performance

Val Dobrushkin's Best Posts (last 30 days)