Joycelyn Agyemang

- Connect content resources to industry-recognized cybersecurity frameworks, including ISO 27001, NIST CSF, and HITRUST CSF, through mapping exercises, gap analysis, and coverage improvements. Collaborate with teams to align products and strategies with best practices.
- Develop training materials, such as multiple-choice questions, cheat sheets, expert articles, and security awareness programs. Focus on cybersecurity frameworks, governance, risk, compliance (GRC), and best practices.
- Manage and maintain compliance with regulatory frameworks (e.g., PCI-DSS, SOC 2, ISO 27001, NIST CSF, HITRUST CSF). Coordinate internal and external audits, prepare evidence, and handle customer security inquiries.
- Conduct thorough risk assessments, develop risk management plans, and implement security controls. Continuously monitor and audit security practices for improvement.
- Lead breach investigations, document root cause analyses, and implement mitigation measures. Monitor security controls to maintain compliance and enhance organizational security.
- Prepare and update security documentation, including policies, procedures, incident reports, and metrics. Develop KPIs for information security, and ensure compliance with legal regulations.

-Conduct third-party risk assessments and vendor due diligence, providing insights into operational risk metrics and trends, and ensuring management approval for exceptions to IT policies.
-Review vendor security postures through assessments, security questionnaires (e.g., SIG), SOC 2 Type 2 reports, scan and penetration test results, and identify vulnerabilities.
- Utilize tools like Archer to evaluate applications, track issues, implement mitigation measures, and maintain control assessments for products and initiatives.
- Prepare evidence and update findings for regulatory standards (e.g., PCI-DSS), test control effectiveness, and support internal and external audit processes as liaison.
- Define risk levels, recommend corrective actions for identified issues, and collaborate with vendors to resolve non-compliance or evidence-related issues.
- Update procedure documentation, incorporate process changes into SOPs, and promote continuous improvement in risk management and compliance efforts.

- Conduct IT risk assessments, document system security key controls, and identify IT-related risks and control weaknesses.
- Perform interviews with service providers and suppliers to clarify processes, understand technologies, verify responses, and identify control gaps.
- Collaborate with the Information Security team to define remediation plans, compile conclusions, and present assessment findings to management on control effectiveness.
- Manage scheduling, execution, and documentation of assessments, providing periodic updates and recommendations to leadership.

- Reviewed ISO27001:2013 and ISO 27002:2013 standards to identify gaps in documentation and processes, and assisted in asset register creation and relevance testing.
- Supported audit efforts through document gathering, evidence collection, and conducting mock audits for various departments.
- Documented security gaps, conducted risk assessments and business impact analyses, and proposed remediation or continuous monitoring strategies.
- Controlled documentation for easy tracking, accountability, and created standard templates to streamline data recording.

-Conducted third-party cybersecurity risk assessments using tools like Archer and BitSight, while performing information gathering, questionnaire administration, vendor response analysis, risk reporting, and monitoring.
- Supported quality assurance reviews over work products and reporting, and collaborated with internal teams and third parties to address and resolve cyber risks effectively.
- Represented the department professionally, demonstrating credibility with leadership and influencing business decisions through identifying gaps and recommending solutions.
- Updated procedure documentation to reflect process changes and ensured adherence to established standards.

- Planned and conducted system audits by defining scope, coordinating with key officials, developing test plans, and leveraging subject matter experts and system owners.
- Tested IT General Controls and evaluated control effectiveness by analyzing evidence gathered through examination, interviews, and testing.
- Performed IT controls risk assessments, reviewed organizational policies and procedures, and provided recommendations for compliance and accuracy.
- Updated audit findings reports for security compliance and assisted in requirements gathering and design for critical projects.