TEKsystems

Consultant | Information Risk | Data Protection | Compliance |
Consultant Position at First Citizens Bank – Raleigh, NC

Exception Management | Vulnerability Management | Compliance Risk Monitoring | Audit Readiness | Regulatory Compliance (NIST 800) | Governance, Risk, and Compliance (GRC) | Threat Intel | Risk Acceptance Processes

•	Led internal security exception program including classification, root cause tracking, and risk acceptance governance.
•      Conducted internal security investigations and risk assessments aligned with insider threat and exception trends, proactively mitigating threats.
•      Advised technology owners on NIST 800-53 mappings and deviations, ensuring consistency with regulatory expectations. 
•       Strengthened NIST 800-53 compliance by aligning controls with real-time risk indicators and vulnerability data.
•       Operationalized security exception handling for unresolved vulnerabilities across multiple business units, ensuring timely remediation and risk acceptance protocols.
•       Optimized governance through the GRC platform, focusing on exception classification, closure criteria, and stakeholder escalation paths.

Information Risk Manager

JPMorgan Chase & Co.

•	Led insider threat-related risk detection and response, aligning use cases with enterprise platforms (e.g., DLP, UEBA, and SIEM).
•       Led enterprise-wide Insider Threat and Exception Management program within the 1LOD function, building coordination between cyber, compliance, HR, and Legal.
•       Managed first-line defense (1LOD) risk activities across business lines to enforce secure-by-design policies and reduce unauthorized activity.
•       Identified anomalous behaviors, data access risks, and system misuse cases through trend analysis using Splunk, Archer, and custom dashboards.
•       Maintained compliance with NIST 800-53 and audit requirements, streamlining risk acceptance and exception documentation.
•        Implemented governance uplift via Archer GRC, reducing reporting friction and increasing control coverage visibility.
•        Reduced unresolved vulnerabilities by 20% via improved exception processes and detection standards.
•        Delivered leadership briefings on exception trends and policy deviations to executive stakeholders.
•        Collaborated with detection engineering teams to improve insider threat alerting logic and reduce false positives.
•        Managed cross-functional stakeholder relationships during sensitive investigations involving access abuse or elevated privilege activity.
•        Reduced non-compliant security exceptions by 20% over two years by implementing structured remediation tracking and automation.
•        Led a remote team, increasing delivery consistency across audit, remediation, and reporting tasks while decreasing turnover by 20%.

Vice President | Information Risk

KPMG US

•	Subject Matter Expert for the Intrusion Detection System, provided technical support for entire organization.
•       Acted as Subject Matter Expert for Intrusion Detection System / Intrusion Prevention System and SIEM strategy, integrating threat intelligence feeds into monitoring platforms.
•       Assessed access to critical data sets and recommended privileged access controls to reduce insider risk, monitoring for insider misuse or suspicious escalation.
•       Led vulnerability threat management reviews across multiple client environments and advised on remediation strategies with Key Line of Business Stakeholders.
•	Vulnerability scanning, remediation of items found via internal scans.
•	Point of contact for all virus / malware issues for Desktop Support, submission of samples to Symantec.
•      Developed technical playbooks for early threat detection using SIEM and intrusion monitoring systems.
•      Managed root cause analysis and response follow-up for access control violations and anomalous behavior.

Manager | Information Security Risk Assessment | Monitoring and Response

•	Monitored for internal and external threats, risk assess and rate threats.
•	Remediation of threats by working with other businesses / groups to remediate, keeping track of items in a Governance, Risk & Compliance (GRC) system.
•	Conducted vulnerability assessments using Nessus and Qualys.
•       Delivered enterprise security awareness sessions that reduced insider incidents related to human error by 15%.
•	Authored internal information security articles.
•       Assisted in the design of compliance monitoring routines for regulated clients.
•	Monitored SIEM for potential threat / risk findings.
•	Checked and observed other network monitoring tools for potential threat / risk findings, for internal / external threats.

Senior Associate | Information Security Risk Assessment | Monitoring and Response

You know how financial institutions struggle with insider threats, data loss, and mounting compliance risk? Well, that’s what I help with. I work with financial institutions and enterprise organizations by combining behavioral analytics with investigative expertise to reduce cyber risk, support regulatory compliance, and protect what matters most, your reputation and data.

When clients work with me, they see:
✅ Reduced insider threat incidents through behavior-based detection
✅ Stronger audit readiness and reduced exception backlogs
✅ Cross-functional alignment between Security, Legal, HR and Compliance

When it comes to cybersecurity risk and insider threats, I know you want to feel confident and in control.
You want to go from being reactive and overwhelmed, to proactive and resilient. To do that, you need clear, actionable risk signals and a strategy that works across people, platforms, and processes. I understand how frustrating and risky it feels to constantly battle hidden threats, especially when the tools are complex and the pressure is high. 

That’s why I’m proud to say I’ve helped major institutions like JPMorgan Chase, KPMG, and
First Citizens Bank build and mature their insider threat programs, reduce exceptions, and align
risk frameworks like NIST 800-53 with real-world execution. You deserve a security framework that not only protects your organization, but empowers it to grow.

I’m currently seeking my next opportunity to do exactly that—partnering with a forward-thinking
organization where I can lead insider threat investigations, optimize GRC strategies, and enable
secure business operations with clarity and control.

Let’s connect:

michaelpagano794@gmail.com
914-589-8809
Now Interviewing – Schedule in my Featured Section

Cybersecurity Risk | Insider Threat Investigations | Information Security | DLP | UEBA | GRC |
NIST 800-53 | MITRE ATT&CK | Security Exceptions | Risk Acceptance | Vulnerability
Management | First Line of Defense (1LOD) | Detection Engineering | SIEM | Behavior Analytics
| Risk and Compliance | Remote Security Leadership | Security Exception Handling | Endpoint Monitoring

taplio

Michael Pagano - Cybersecurity Risk, Insider Threat Investigator's Linkedin Analytics

Michael Pagano - Cybersecurity Risk, Insider Threat Investigator

Performance Score

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Michael Pagano - Cybersecurity Risk, Insider Threat Investigator's Linkedin Analytics

Michael Pagano - Cybersecurity Risk, Insider Threat Investigator

Performance Score

Ready to grow your LinkedIn presence?

Michael Pagano - Cybersecurity Risk, Insider Threat Investigator's Linkedin Analytics