Mihaela Chioveanu

Tasks:

HR Application Security Lifecycle.

HR Data Security.

Digital certification for global, critical, HR apps.

Crown Jewel Security Compliance.

Solutions:

Security:

Drive digital certification initiatives for global, high-impact criticality of HR applications, manage extensive big data processes, overseeing digital certification in line with ISO 27001 and ISO 27701, NIS2 Directive requirements, successfully certifying 209 out of 360 HR applications.

Privacy:

Conducting data auditing, managing and recording consent, implementing data security safeguards: access, use, disclosure to keeping the data collection and use of personal data to the minimum, and maintaining transparency with internal customers: the right to control who gets to see PII, cookie policy, privacy notice, data retention schedule.

Compliance:

• HR applications compliance with various regulations, such as GDPR, CCPA.
• Implement and maintain Crown Jewel Security Compliance, safeguarding high-value HR assets and systems: data risk, data protection, data privacy and system security.
• Served as a subject matter expert on compliance matters, providing guidance and support to colleagues across various departments.

Employment contracts covering multiple projects within the digital healthcare industry, including confidential assignments, where I can name a few.

Tasks:

Cloud and Edge healthcare digital solutions.
Data security, data privacy and data risk following GDPR, CCPA, HIPPA Compliance.

Roche Diagnostics Spain

Solutions:

Security:

• Supported Cloud and Edge digital healthcare business solutions within the navify project, assisting engineering teams in implementing a "secure by design" approach for digital healthcare platforms.

Privacy:

• Conducted comprehensive analysis of internal systems, processes, and products to ensure alignment with information security standards (ISO/IEC 27001, 27017, 27018, GDPR, HIPAA, CSA CCM), establishing a standardized control framework.
• Contributed to security and privacy risk management governance, including Data Privacy Impact Assessments and Transfer Impact Assessments within the Product Development Process lifecycle.

Compliance:

• Assisted in the preparation of reports for senior management, outlining findings from investigations into suspected non-compliant activities.
• Improved company''s risk management strategy by identifying, assessing, and mitigating potential risks related to noncompliance.
• Developed improvement and corrective action plans to bring operations in line with requirements.

Clarivate Analytic Spain:

Enhanced project management expertise while overseeing multiple initiatives to meet objectives and deadlines for the ISO/IEC 27001:2013 recertification process at Clarivate, covering three business segments:

• Academia & Government
• Life Sciences & Healthcare
• Intellectual Property Management Systems

Scope included 14 products successfully audited.

Task:

GRC for Lidl Plus mobile app.

Solutions:

• Governance: Maintain and enhance cybersecurity & privacy policies and procedures to ensure compliance with all relevant certifications, laws and regulations.
• Security Risk Management:

Oversee scheduled Security Audits (penetration tests), managing the process from initial request to remediation of identified vulnerabilities or reassignment to appropriate teams.

• Compliance: ISO 27001, PCI - DSS
• Maintained and reviewed Risk Management processes, tracking vulnerabilities and security findings within the internal GRC tool, ensuring compliance with frameworks such as PCI-DSS, ISO 27001, and Privacy regulations.
• Defined security plans and contributed to the development of information security management systems (ISMS), ensuring alignment with secure software development lifecycle (S-SDLC) policies.

Task:

Security Compliance for start-up IPO and achieving certifications required by the industry.

Solutions:

• Security: Vulnerability Assessment, Threat Modelling, Risk Management, Security Software Development Lifecycle (S-SDLC)
• Privacy: GDPR, HIPAA.
• Played a key role in implementing privacy compliance requirements across the organization, ensuring data collection processes within Typeform online surveys adhered to regulatory standards: Records of Processing Activities, Data Protection Impact Assessment, Data Privacy Addendum, cookie policy.
• Compliance:
• Lead and participated in internal and external audits, successfully achieving certifications for ISO 27001, SOC 2, and HIPAA.
• Conducted remote security assessments for clients, applying in-depth knowledge of information security and data protection standards, including ISO 27000 series, NIST CSF, GDPR, and PCI DSS.

• Played a key role in Vulnerability Management and Incident Response, conducting open-source intelligence investigations to assess potential security incidents, vulnerabilities, and threats, with a focus on OWASP Top 10 risks.
• Managed firewall configurations to maintain optimal levels of network protection while allowing for necessary business operations.
• Conducted thorough risk assessments for proposed projects or changes in technology infrastructure, highlighting potential vulnerabilities before implementation could begin.
• Established a robust patch management process that ensured timely updates to software and hardware components across the organization.