Konrad Fellmann

As CISO at Encore Capital Group, I lead global cybersecurity strategy, GRC, security operations, threat management and cyber assurance across a dynamic specialty financial services organization. I oversee the protection of critical assets, improve security posture, and drive innovation in security architecture and operations working in partnership with IT an enterprise risk management teams. My role involves partnering with executive leadership, business unit stakeholders and the board to align security initiatives with business objectives, fostering a culture of resilience and trust. We identify opportunities to deploy and enhance enterprise-wide programs in threat intelligence, incident response, and third-party risk, while navigating complex regulatory landscapes across multiple global jurisdictions.

• Enhanced efficiency and synergy by assuming dual responsibilities as VP of IT Infrastructure and CISO in 2023. Facilitated seamless collaboration between IT and Cybersecurity teams, significantly reducing vulnerability mitigation time and consistently meeting SLAs for patching with 95% of systems free of critical vulnerabilities over 30 days old. Streamlined communication processes, improving weekly team integration and issue resolution efficiency. • Successfully expanded ISO 27001 certification from 4 to 16 sites globally, including North America, UK, and Australia, between 2014 and 2017. Standardized global compliance processes, enhancing operational efficiency, and reducing annual audit costs by leveraging regional resources and uniform policies. significantly bolstering organizational resilience.

• Led risk assessments and maturity evaluations for over 200 internally developed products. Implemented OneTrust for streamlined data gathering and analysis, enabling prioritized remediation actions and a 50% reduction in critical application vulnerabilities. • Governed comprehensive cybersecurity operations across a global workforce of 6,000, maintaining impeccable security records including the completion of multiple compliance audits annually with no critical findings. Advocated for pragmatic security measures and solution-oriented approaches to meet business needs. • Spearheaded the adoption of advanced security technologies including SEIM, SOAR, zero-trust architecture, and EDR. Led successful contract negotiations to optimize technology spending while enhancing security across both on-premises and cloud environments.

• Orchestrated the strategic overhaul of security operations, architecture, and compliance controls, ensuring alignment with corporate, contractual, and legal security requirements globally. • Led worldwide vulnerability management, risk assessment, and incident response activities, significantly enhancing security posture and compliance across all operational levels. • Directed comprehensive internal and external audit programs, aligning with PCI-DSS, SOC 1 & 2, SOX, and other regulatory frameworks to uphold rigorous security standards

During my tenure as Audit and Compliance Manager, I rendered expertise in leading day-to-day operations of the audit and compliance department that provide information security assessment and consulting services to clients. I have coordinated with clients to develop security/compliance plans and lead assessment for PCI-DSS, ISO 27001, HIPAA, Privacy, and SSAE-16 engagements. I have prepared assessment reports and provided recommendations for clients to meet compliance requirements and improve overall organizational security. I have led the conduct of security gap assessment and compliance assessments for clients ranging from small businesses to Fortune 500 companies. I have supported organizations in development and implementation of security control mitigation plans to support successful achievement of regulatory compliance audits.

Provide a complete range of information security solutions, security assessments and regulatory compliance services, to include performing physical, host and network security assessments using industry standards and methodologies. Leads teams of consultants on security and privacy compliance efforts, using ISO 17799 standards for assessing regulatory security efforts.

Established and managed division personnel, physical, and information security programs. Direct division efforts to identify and evaluate all critical systems. Develop and implement security policy, processes and procedures and recommend cost-effective strategies to meet business objectives and strengthen security posture. Collaborate with external auditors to conduct in-depth DITSCAP, HIPAA, and SOX compliance audits and penetration testing, presenting all results to senior management and developing appropriate plans of action to mitigate risk. Develop internal control objectives for SAS 70 audits and map documentation to audit objectives. Develop and implement division security awareness training program. Direct the activities of System and Network Security Administrators. Develop and implement internal technical assessment and regulatory compliance audit programs.

Provided a full range of information systems security services, including network security assessments, information security training, penetration testing, and secure architecture design to Federal agencies. Conducted DITSCAP, FISMA, ISO 17799, HIPAA, and NIST Certification and Accreditations (C&A) and audits, to include the development of regulatory compliant documentation sets, network security assessments, and risk mitigation plans. Interviewed clients to determine scope of work, develop project plans, and identify opportunities for follow-on services. Perform Windows NT to 2000/2003 Active Directory migrations, including Exchange 5.5 to 2000 account migration. Designed, implemented and maintained secure network architectures, including product testing, recommendation and purchasing.

Provided technical and project leadership for product data management (PDM) and collaborate product commerce software solutions (Windchill), managing teams of 2-8 consultants. Analyze manufacturing customer business processes and requirements to propose web-based PDM solutions, through interviews and a hands-on approach. Produced technical and project related specifications to include, system description documentation, use cases, product lifecycle/workflow diagrams and RFI/RFPs. Provided system administration support and ensured that web and application servers were securely configured. Reviewed client business process to develop and implement appropriate access and provisioning controls to data during the product lifecycle. Additional tasks include installing and configuring web servers, servlet engines, search engines, Oracle databases, and Java environments. Developed, modified, and debugged application software and web-front ends to meet client requirements.