Mariamne I.

I help B2B (business-to-business) companies bring their information security and privacy practices up to the standards their prospects require. I help you communicate your practices, which can improve your competitiveness, and shorten your sales cycles. I provide: - Infosec and privacy services for B2B SaaS and tech companies, targeted at removing delays in sales cycles due to security requirement bottlenecks - Security program development / maintenance / management / assessment / remediation - Create assets to speed answering of customers' information security questionnaires - Information security policies, privacy policies, acceptable use policies, employee handbooks - Review of customers' information security and privacy requirements and cost-sensitive options to meet them - Preparation for SOC2 Type I & II audits (controls, description of system, selection of auditors) - GDPR compliance guidance and implementation - Set up the Processes / Procedures / Auditable evidence required by common compliance standards for: -- Access control -- Risk Management -- Security Awareness Training -- OWASP proficiency -- Application Penetration testing -- Vulnerability testing -- Vendor (aka third-party) requirements (What you require of YOUR vendors, so that you are compliant.) -- IDS monitoring My clients appreciate that I offer them multiple ways to meet a security or privacy requirement. I understand the needs of start-ups, entrepreneurs and companies working to grow their sales to larger companies, who have more stringent requirements. I love to put things in place that you can maintain on your own and use over and over. And, I can help you put in place lightweight cycles of review, so that you can keep your practices up-to-date. I have over 25 years of experience in IT, and a B.S. in Computer Science. I have worked in the fields of healthcare, finance, audit, e-commerce and advertising, where I have managed projects, designed compliance and quality assurance activities, created new documentation including procedures and training materials, and designed and managed testing. For the past 9 years, I have developed methods to manage and document security and privacy compliance commitments, and built security programs. Recent projects ------------------- Assessed company's practices in light of the new California Consumer Privacy Act (CCPA). Created Data Flow Profiles to document flow of personal data, and to determine if further documentation needed for GDPR compliance. Implemented process triggers that notify management of project changes that affect compliance. Updated Information Security Policy and Vendor Requirements to reflect changes client made to comply with GDPR. Led company's self-audit of one of their practices against updated FBI's public threat advice and related recommended best practices. Took SaaS (software-as-a-service) company through preparation and successful completion of SOC 2 Type II audit. Updated company-specific portion of Security Awareness Training for company's staff. Implemented .Net development team's OWASP Top 10 training and training completion documentation. Prepared architecture and data flow diagrams for SaaS application, for use in discussions with prospects' Information Security departments.