Aletheia Security Consulting, LLC

On assignment at Karl Storz North America

Partner

Imperva

Joined the CISO team from the ICO team to build better cross-team collaboration on strategic IT security and compliance initiatives that positively impact the material cybersecurity posture and reliability of Imperva's systems. I influence business decision-makers' prioritization of planning and resources related to the management of the business and technical risks within their respective realms. I form and lead panels of business and technical leadership to own and collaborate across pillars and technical teams that support top management's business risk OKRs. I develop strategic plans and execute within the constraints of a market contraction and still succeed, all while improving technical teams' dexterity and informed decision-making to improve security compliance, IT processes, operations programs, and underlying product qualities.

Global Lead CISO team, Security and Compliance Strategy

I led the Security and Compliance team within the Infrastructure, Cloud and Operations group. We collaborate with the CISO organization, the technical teams and enterprise leadership to strategically improve the nexus between security practice management and IT practices that drives uniformity and measurability across multiple platforms and solutions globally.

Global Lead ICO Infrastructure Security and Compliance Exec

Yahoo

I lead the Center of Excellence, a security compliance team that verifies our company maintains adequate security controls, per external internationally accepted standards. External certificates and reports such as ISO 27001, Cloud Security Alliance STAR program (Level 2 Provider), PCI DSS, SSAE 18 (SOC 2 Type 2) and even the MPA's review of media security are all under my teams purview.

Lead, InfoSec Cert Program Compliance Exec, Founder Center of Excellence

Verizon Digital Media Services

One of the many names of Edgecast > VDMS > Oath >Verizon Media Platform > Yahoo! Edgecast. I was their infosec certification and compliance program manager. I operated all of the security compliance and certification programs for ISO 27001, CSA STAR, PCI DSS, SOC 2 Type II and MPA along with all of the audits, remediation meetings and advised on all things security compliance. I also operated and facilitated the ISMS Forum (the monthly executive management risk review for ISO 27001). 
One key result of my efforts is that Edgecast has PCI capabilities, and we built a strategy to deprecate a formerly PCI-dedicated CDN called Transact, saving $2M a year on services, licenses, and unnecessary risk.

Information Security Compliance Program Executive

Toyota Financial Services Corporation

Enterprise Information Security Consultant, global responsibilities for risk control verification and documentation across a wide portfolio of solution-projects including designing and architecting an IDaaS and SSO solution, privileged access, ID governance, regulatory compliance control review and recommendations of high level architectures for remediation.  Several of these projects were globally affecting, including access control capabilities future-scaping for external identity repositories,  design of decentralization of identity administration services.

Enterprise Information Security Architect Consultant

Absolute Network Solutions

As the primary business development and sales manager, my role is critical to bottom line decisions.  I have recently secured a contract with Mattel Corporation as an information security consultant.  My experiences and great attitude are what keep me in the client's office.  
This particular role is largely independent supporting the network security needs of a recent company acquisition and the convergence of all of the technical services (network, cloud services and access control systems).

Managing Consultant

Mattel, Inc.

Principal Information Security Architect, Global technical control improvement. I was engaged for a 3 month assignment but was retained for one year. Supporting the Mega security assessment and integration, provided remediation guidance of all prioritized ineffective technical and procedural controls within the acquisition. Consulted within many corporate groups, delivering risk-mitigation solution options to every internal engagement.   Supported a cycle of PCI compliance and its remediation efforts. Delivered infrastructure design validations and access control change solutions that affected the day of nearly every employee of the company.

Information security consultant

OpenSky Group

As a business trusted advisor in the information security space, I provided technical strategic guidance, relevant solutions that help to drive our clients businesses towards robust security decisions and deliver leading edge solutions that aid in fulfilling their business growth objectives.
In my role at OpenSky, I supported several enterprise information security engagements. Here's a brief list:
* Assessed the info-sec posture of a logistical services company in a merger with a competitor
* Provided critical on-site info-sec operational support for the country's #2 healthcare transport company, resolving critical line of business application transitions, implementation of cloud-based services and mitigated many bottom line affecting risks.
* Evaluated the security posture and assessed the external vulnerabilities of a large West Coast based law firm
* Provided onsite support for an enterprise Public Key Infrastructure (PKI) assessment and roadmap in a statewide insurance services company
* Provided guidance, direction and balance with many presales opportunities including proposals written, statements of work, and other sales support activities

Recently, the company was acquired by TUV Rhineland, and has had some challenges maintaining the new parent company's financial expectations, and therefore has reorganized some of it's divisions and regions.

Western Regional ITRMS Practice Lead

Experis IT

I provide technical solution services, pre-sales focused, up to and including design, implementation, project management or support, technical service (coordination, or hands-on with equipment).  I provide services to government entities, large enterprise, mid range enterprise and education.

Sr. Technical Manager, Cisco and Internetworking Infrastructure

COMSYS

I was a direct consultant to Disney Corporation in Glendale, CA providing network consulting services from the Enterprise IT group within the Telecommunications/Business Design Services team.  I was responsible for the internal consultation of network design, bandwidth assessment, interconnectivity concerns including solution acceleration, security, monitoring and at times, hands-on technical support. 

In addition to the consulting support I provided to the Enterprise in general, I operated as a network engineer for the Disney Stores.  I provided maintenance, implementation and support of the Disney Stores network including wireless, security and design problems resolution in a 100% Cisco based network.  Significant support provided to mitigate regulatory compliance efforts (PCI DSS compliance on The Disney Stores network sections).

Sr Technical Network Consultant (Hard Assigned to Disney EIT-BDS)

I lead the Security and Compliance Strategy within the CISO team of enterprise-size companies. We collaborate with all of the technical teams and enterprise leadership to strategically improve the nexus between business management and security practices management that drives uniformity, measurability, and impactful improvements across multiple platforms and solutions globally. 

I previously led the enterprise-wide Certification Compliance Center of Excellence (C3OE) for the GRC Team in Yahoo's #Paranoids (the InfoSec team). I primarily supported one business unit known as  #Edgecast. I was their manager of IS compliance and led a team of 2 employees, 7 contractors, and 4 vendors. I also had a 'stakeholder' and influencer role in company business and technical decisions. My focus is on people first, processes second, and then technology augmentation. 

I previously worked as an information security architect consultant for Toyota Financial Services in Torrance, CA. My role required high technical acumen and a broad understanding of all applicable regulatory compliance requirements that affected nearly every aspect of their corporate environment on many of the projects and work streams that I guided. I steadfastly believe that I am a business enabler and provided guidance on options for creative technical solutions, not boundaries limiting progress as a stakeholder in risk-control ownership.   

Prior: Information Security Consultant to several mid-range companies
Information Security Solution Integration Consultant 
Enterprise Information Security Architect consultant at Mattel
Experis National Lead for Network Consulting

Prior to being a direct employee of Experis, I contracted for corporate Disney in Glendale and Pasadena, CA. My role there was very high-visibility consultative network design. My role as a network solutions architect at Disney improved the business capabilities of 2 major business units (Toon Studios and Disney Stores).

Specialties: 
Security Compliance Program Management, Security Compliance Program Implementation 
Vendor Risk Management
Legal security contract review
Enterprise Information Security Architecture
IT Project Management
Network Best Practices Consulting 
ISO 27001, CSA STAR, SOC 2 Type II, PCI-DSS,  Auditing, Consulting
Policy Writing, Technical Writing

taplio

Steve Weltman, CISSP's Linkedin Analytics

Steve Weltman, CISSP

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Steve Weltman, CISSP's Linkedin Analytics

Steve Weltman, CISSP

Ready to grow your LinkedIn presence?

Steve Weltman, CISSP's Linkedin Analytics