Summary
IT Audit and Technology Risk leader with 15+ years of experience leading technology audits, strengthening SOX compliance, improving cybersecurity governance, and enhancing internal controls across global financial institutions. Trusted by executive stakeholders to assess technology risk, improve control effectiveness, and deliver practical, business-focused assurance.
Building on that foundation, I specialize in AI Governance and Responsible AI, applying proven audit principles to AI risk, governance frameworks, and automated assurance. I help organizations adopt AI with confidence by making governance practical, transparent, and evidence-based. View AI Governance Expertise & Evidence.
Selected Achievements
- Reduced SOX control testing time by 40% by automating audit testing across 50+ enterprise applications.
- Directed cybersecurity, cloud, and technology audits for Citibank, S&P Global, MUFG, Truist, DTCC, and City National Bank.
- Reduced quality-review cycle time by 30% through improved evidence standards and control documentation.
- Designed City National Bank's first threat-informed CRI coverage assessment methodology.
- Designed executive dashboards that translated complex technology and cybersecurity risks into actionable reporting.
- Expanded IT Audit expertise into AI Governance by earning the AAIA and AWS AI Practitioner certifications.
Experience
Robert Half — City National Bank | Remote (Contract)
- Designed the organization's first threat-informed CRI coverage assessment methodology, enabling reproducible evaluation of institutional controls against regulatory response guidance.
- Established evidence traceability from framework requirement through control analysis, rationale, coverage conclusion, and remediation need.
- Partnered with technology, cybersecurity, and risk stakeholders to identify control gaps, assess risk exposure, and develop remediation priorities aligned with CRI and NIST frameworks.
Self-Employed | North Carolina
MUFG | Remote — North Carolina
- Led design and operating-effectiveness testing for 15–20 technology controls per quarter, conducting stakeholder walkthroughs, evaluating supporting evidence, and documenting control deficiencies.
- Assessed control environments for business units being onboarded or integrated, identifying gaps against enterprise risk and control standards.
- Coached first-line control owners on documentation and evidence standards, reducing quality-review cycle time by 30%.
- Managed assessment scheduling and milestone tracking across concurrent engagements, coordinating with control owners, risk partners, and quality reviewers.
Truist Financial Corporation | Remote — North Carolina (Contract)
- Executed design and operating-effectiveness testing of cybersecurity, technology, and data-protection controls to determine whether controls appropriately mitigated identified business and technology risks.
- Developed and executed control test scripts and maintained traceability in RSA Archer between control requirements, evidence reviewed, exceptions, and conclusions.
- Trained and onboarded a fellow GRC tester on control-testing procedures, Archer documentation standards, and findings development.
The Depository Trust & Clearing Corporation (DTCC) | Newark, NJ
- Performed deep-dive assessments of firewalls, routers, proxies, and Unix systems using CIS Benchmarks; led walkthroughs with engineering teams to drive remediation.
- Managed end-to-end audit execution for infrastructure assessments, independently planning scope, coordinating stakeholder interviews, and tracking issues through resolution.
S&P Global | New York, NY
- Led cybersecurity audits across global business units, managing audit execution, stakeholder engagement, and executive reporting.
- Led AWS security audits and coordinated global teams to evaluate configurations against AWS Security Best Practices, managing assessment timelines across multiple business units.
- Designed executive dashboards in Tableau translating complex technology and cybersecurity risks into actionable management reporting, and automated compliance-testing workflows.
Private | New York, NY
- Evaluated smart-contract security and key-management approaches for early-stage Ethereum deployments, identifying design flaws and recommending architecture changes.
Citibank | New York, NY
- Developed automated analytics to detect orphaned accounts and segregation-of-duties conflicts across 50+ applications, enabling earlier detection of identity-related gaps.
- Enhanced SOX control automation using ACL, reducing testing time by 40% and improving identity-governance visibility.
Skills
IT Audit & Risk
ITGC • SOX • IT Control Design & Testing • Control Effectiveness • Regulatory Remediation • COBIT
AI Governance
Responsible AI • AI Risk • AI Controls • Human Oversight • Governance Operating Models • NIST AI RMF
Cybersecurity
NIST • ISO 27001 • MITRE ATT&CK • Splunk • CRI • CIS Benchmarks
Data & Automation
Python • SQL • Excel • Power Automate • Microsoft Lists • Alteryx • Power Query • ACL • Claude Code
Data Analytics & Visualization
Executive Dashboards • Dashboard Design • Executive Reporting • Data Storytelling • Audit Analytics • Tableau • Power BI
AWS
Hands-on experience with EC2, VPC, IAM, Route 53, AWS Amplify, API Gateway, and Bedrock.
Certifications
Certified Information Systems Auditor
CISA
ISACA
#252955101
2025 – 2028
Advanced in AI Audit
AAIA
ISACA
#263090511
2026 – 2029
AWS Certified AI Practitioner
AIF-C01
AWS
#521927105
2025 – 2028
Certified in Risk and Information Systems Control
CRISC
ISACA
Previously certified
2010 – 2016
Education
B.S. in Management Information Systems —
Brigham Young University