David Cano

Work history:

• Job Title: Technology Consultant - Program Manager

  Company: Envelop Technologies

  Period: March 2021 - November 2022

  Role Description:

  As a consultant for a hedge fund client with $16 billion in assets under management, I played a pivotal role in reconciling purchases for the entire technology organization, streamlining processes and improving efficiency. I enhanced the new hire onboarding experience by introducing a personalized technology orientation, which received consistent praise from the client’s CEO during firm-wide calls, making it a standout aspect of the onboarding process.

  I managed the assignment of computer resources, including physical PCs for office and remote work, as well as Virtual Desktop Infrastructure (VDI) solutions. As the project manager for a significant data center upgrade and migration, I oversaw the installation of $250,000 worth of new hardware, ensuring a smooth transition and optimal performance. I acted as a liaison between front office business users and technology teams, providing timely solutions that enhanced user satisfaction.

  During my tenure, I served as the technology representative on the firm's COVID-19 steering committee, which facilitated increased budget allocations to address user needs in a rapidly changing environment, as well as ensuring a smooth transition back to the office. I revamped the onboarding experience for new hires and successfully transitioned the firm to cloud computing, optimizing architecture and automation for enhanced operational efficiency.

  I implemented secure file share management using Varonis and oversaw technology initiatives for remote work, ensuring seamless technology support and authorized access. I championed personalized VIP support for C-level executives, integrating technology solutions that aligned with their workflows and directing multimillion-dollar IT projects, including a successful end-to-end data center migration.

  I developed and implemented a comprehensive information security strategy for the data center migration, ensuring alignment with financial regulatory requirements. I spearheaded the creation of a Governance, Risk, and Compliance (GRC) framework, aligning the client’s security controls with financial regulations such as FINRA and SEC, as well as industry standards like SOC2 and ISO 27001.

  Leading the company’s SOC2 compliance initiative, I ensured continuous control monitoring and audit readiness, successfully reducing audit preparation time by 30%. I partnered with development, engineering, and HR teams to propose new compliance initiatives, integrating security processes seamlessly into operations.

  Through rigorous risk assessments and cross-functional collaboration, I identified and mitigated security risks, resulting in a 20% reduction in operational risk. I developed disaster recovery plans to ensure business continuity, served as a trusted cybersecurity advisor for senior executives, and provided strategic recommendations on cybersecurity initiatives, regulatory compliance, and secure technology integration. Additionally, I led the implementation of AWS cloud security solutions, ensuring compliance with financial industry regulations and reducing operational costs by 16%. 

• Job Title: Technical Business Analyst

  Company: Bank of America Merril Lynch

  Period: July 2017 - May 2020

  Role Description:

  In my role at Bank of America Merrill Lynch (BAML), I served as the Risk and Control lead for the FICC – Global Mortgage Trading and Structured Products (GMSP) group, managing technology risk and ensuring audit compliance across 50+ trading and risk management applications. I worked closely with business partners to define strategies for technical solutions, determining requirements and developing functional designs based on thorough analyses of business needs and existing systems infrastructure.

  I drove and participated in the design, development, and implementation of large, complex enterprise-wide applications, often leveraging new technologies. Collaborating effectively with developers and testers, I ensured that requirements and functional designs were accurately translated into technical designs, and that test plans and scripts met customer needs.

  My technical expertise enabled me to determine end-to-end design requirements for significant projects involving business lines, software/hardware, developers, and vendors. I coordinated annual Disaster Recovery exercises for GMSP-owned applications and played a pivotal role in the infrastructure migration of these applications to support enterprise-wide data center reduction initiatives.

  In the realm of security governance and risk management, I oversaw Identity and Access Management (IAM) controls across 50+ applications, ensuring compliance with SEC and FINRA regulations. I developed a Governance, Risk, and Compliance (GRC) framework to track and report risks, enhancing visibility into the company’s security posture.

  I led security assessments to identify risks across trading platforms, presenting mitigation strategies to senior executives. Additionally, I implemented Key Performance Indicator (KPI) dashboards for GRC deliverables and project reporting, significantly improving transparency in our security efforts. As project leader, I directed the implementation of secure application onboarding processes, which reduced project timelines by 21% while enhancing security controls for high-risk financial applications.

  Furthermore, I directed internal audits and collaborated with external auditors to ensure SOX compliance, thereby strengthening the overall control environment and fostering greater trust with stakeholders. My contributions played a vital role in maintaining the integrity and security of the organization's trading operations. 

• Job Title: IT Specialist

  Company: United States Securities & Exchange Commission

  Period: October 2016 - July 2017

  Role Description:

  In my role in cybersecurity program management, I implemented robust cybersecurity controls for network hardware, ensuring compliance with SEC regulations. I managed Active Directory Organizational Units to enhance security measures and streamline access control, meticulously setting up user and system placements within appropriate Access Control Lists (ACLs) and security groups.

  I conducted staff training on cybersecurity policies and regulatory compliance, fostering a security-first culture throughout the organization. Leading process improvement initiatives, I worked to reduce vulnerabilities and enhance incident response times, providing comprehensive training on ServiceNow and other cybersecurity protocols.

  As the lead troubleshooter for Dell systems, I addressed user issues related to deployed desktops and laptops, effectively troubleshooting LAN and wireless network problems. I configured security settings for various network hardware, including servers, printers, and workstations, ensuring optimal performance and security.

  Additionally, I managed projects with full responsibility for both execution and budgeting, developing reports to track policy implementation and ensure that systems remained security compliant. I trained teammates on the utilization of the ServiceNow ticketing application, documenting troubleshooting steps and managing user-related issues efficiently. My efforts contributed to a more secure and resilient IT environment, aligning with organizational goals and regulatory requirements. 

• Job Title: Summer Business Analyst

  Company: Bank of America Merrill Lynch

  Period: June 2016 - August 2016

  Role Description:

  In this role, I translated and provided critical internal data reports that enabled traders to effectively manage risk and forecast market trends. I successfully managed various projects, overseeing both the project and its budget, while operating with minimal supervision on enterprise-wide initiatives that demanded innovative solutions. My responsibilities included driving the design, development, and implementation of large and complex applications, often leveraging new technologies.

  Collaboration was key in my work, as I partnered closely with business stakeholders to define strategies for technical solutions, analyze business needs, and develop functional designs aligned with existing systems. I ensured that the requirements and functional designs were accurately transformed into technical designs by working hand-in-hand with developers and testers. Additionally, I played a vital role in creating comprehensive test plans and scripts that catered to customer needs, and I facilitated requirement sign-offs with developers, support teams, and traders to ensure alignment and project success. 

• Job Title: Client Support Technician

  Company: Pace University

  Period: March 2014 - June 2016

  Role Description:

  In this role, I provided technical support at the desktop level, successfully installing and troubleshooting hardware, software, and peripherals for over 15,000 stakeholders. I established and managed a comprehensive asset inventory control system, ensuring meticulous tracking of assets to maintain quality throughout their life cycles.

  I conducted detailed analyses to support the implementation of the university's PC replacement cycle, optimizing resources and enhancing efficiency. Additionally, I performed forensic extractions of data from mobile devices, generating reports that detailed relevant evidence acquired. My work contributed significantly to both operational excellence and informed decision-making within the organization. 

• Job Title: Information Systems (IT) Technician

  Company: United States Navy USS INGRAHAM (FFG-61)

  Role Description:

  In my role in the Navy, I played a crucial part in mitigating risks by ensuring that server and workstation patches were consistently up-to-date, achieving a 98% compliance rate for known Information Assurance Vulnerabilities across both classified and unclassified government networks. I supervised a team of 23 employees, overseeing daily maintenance of U.S. government assets valued at $15 million, while maintaining a work center accomplishment rate of 98%, a significant improvement from the previous 85%.

  As Work Center Supervisor, my attention to detail led to the correction of over 50 discrepancies. I developed and regularly updated a comprehensive training plan that included organization-wide information assurance training and certification tracking, enhancing the overall competency of the workforce. I played a key role in the Department of Defense’s Information Assurance Certification and Accreditation Process, verifying and implementing Security Technical Implementation Guides (STIGs) which resulted in the successful achievement of Authority to Operate (ATO).

  I reported computer, network, and physical security vulnerabilities to senior management, providing recommended corrective actions to reduce cyber risks. My investigations into information security incidents, including malware and intrusion detection, further strengthened our defenses. I improved system recovery procedures to minimize potential losses from attacks or failures and managed all local classified communications security (COMSEC) materials, ensuring proper documentation and training.

  I completed all Personnel Qualification Standards (PQS) up to Communications Watch Officer (CWO) in-rate, as well as Damage Control qualifications up to Repair Party Investigator and Scene Leader. In Anti-Terrorism Force Protection, I achieved qualification as Petty Officer of the Watch (POOW). I was also promoted to E-4 with a remarkable score of 99% and to E-5 at 98% on my first attempts, reflecting my dedication and performance. My efforts were recognized during COMSEC inspections, where I received excellent ratings averaging 90% over four consecutive semi-annual evaluations, contributing to the ship’s eligibility for deployment. Additionally, I took control of the Local Registration Authority program, transforming it from non-compliance to meeting standards with a passing average score of 85 during the next audit. 

Education:

• NYU Law School

  Master's Degree – Cybersecurity, Risk, & Strategy

  Period: May 2023 - May 2024

• Pace University

  Bachelor's Degree – Information Technology

  Period: September 2013 - December 2015