Pete Bottcher

• Led security requirements reviews for third-party and contract engagements, standardizing security review checkpoints and reducing approval cycle time by 25%. Partnered with stakeholders to embed enforceable control language before execution. • Assessed control effectiveness across infrastructure, cloud, and application environments, documented gaps, and drove remediation to closure to improve audit readiness and reduce risk exposure. • Identify, document, and track cyber risks; manage mitigation plans and follow-ups with IT stakeholders. • Executed security testing across infrastructure, applications, cloud, and mobile environments, including penetration testing and vulnerability scanning, to identify and prioritize remediation for critical exposures. • Support information security program execution and ongoing PCI DSS readiness (requirements interpretation, system impact reviews, annual audit support). • Develop and update information security policies, standards, and supporting procedures. • Support incident response activities during cyber incidents, including investigation support and containment/remediation coordination. • Performed security-by-design architecture reviews for AWS, Azure, and Microsoft 365 environments, advising on secure configuration, solution selection, and deployment controls to reduce implementation risk.

• Provided advisory support across GRC and risk management, helping IT leaders improve control maturity, reduce risk exposure, and prioritize remediation by business impact across infrastructure and application teams. • Led security assessments and gap analyses against frameworks such as PCI DSS, SOX, ISO 27001/27002, NIST, documenting findings and driving remediation plans to closure. • Managed audit readiness by refreshing policies and procedures, coordinating evidence collection, and supporting internal and external auditors through fieldwork and follow-up to close findings faster. Conducted and coordinated control design and testing, including vulnerability management governance, configuration/hardening validation, and exception tracking.

• Led PCI DSS security compliance functions, translating requirements into control design, implementation guidance, and sustainable operating procedures that improved audit readiness and reduced recurring exceptions. • Perform security reviews, evaluations, and risk assessments to identify exposures; drive remediation tracking and proactive reporting of gaps impacting critical systems and network infrastructure. • Maintain audit readiness by producing and curating evidence (policies, procedures, configurations, hardening validation) and supporting compliance audits through completion. • Monitor evolving legislation, regulations, and best practices; recommend program and process improvements to strengthen enterprise security posture. • Provide expert guidance to IT teams and business partners on system hardening, vulnerability management, incident response, and protection of corporate information and intellectual property. • Conduct partner/stakeholder assessments and document threats, vulnerabilities, controls, and impacts on critical assets.

• Consulted on security procedures, documentation, and integration planning during the Icahn Enterprises merger and acquisition to support continuity and reduce transition risk. • Mentor and Train incoming CISO. • Develop, maintain, and review security policies, procedures, and response playbooks.

• Developed and maintained security policies, procedures, response playbooks, and formally documented controls supporting PCI DSS and SOX in a Tier 1 retail environment. • Led security risk analysis and exception investigations, enforced policy compliance and managed corporate security awareness programming. • Partnered with project teams to embed security requirements into IT initiatives; provided advisory support across applications, infrastructure, and operations domains. • Oversaw PCI/SOX compliance and protection of PII for 20,000+ current employees and 200,000+ former employees. • Managed WAF for eCommerce, IPS configuration/monitoring, firewall auditing, and disaster recovery planning. • Project-managed major security deployments including Tivoli Identity Manager/IBM ESSO rollout, QRadar SIEM, and Sourcefire IPS implementation.

• Led enterprise security program across eight casino properties in the U.S. and Aruba, overseeing PCI compliance, SOX support, and protection of customer PII while advising executives on control adequacy and risk priorities. • Owned security governance: policies/standards, risk management (gap analysis, BIA, risk assessments), and executive recommendations on control adequacy across technology, personnel, and physical security. • Established logging and monitoring practices for threat detection and incident response; drove improvements to operational security processes. • Built and executed audit plan to validate adherence to IT security policies across properties and departments. • Managed and mentored a distributed security team; delivered ongoing security education and standards enforcement.

• Delivered 30+ B2B connection projects end-to-end, translating partner requirements into secure connectivity designs and implementation plans. Managed stakeholder communication and execution timelines.

• Led security engineering and risk management engagements for federal clients under DITSCAP/DIACAP and FISMA governance. Performed onsite technical assessments including vulnerability analysis, penetration testing, and security risk assessments, according to NIST/OMB/DoD requirements. Performing onsite Risk Assessments containing a variety of technologies (Databases, OS platforms, Networking Hardware, Applications, etc) Assisting clients to help interpret and remediate all vulnerabilities. Assist in developing System Security, Disaster Recovery, and Contingency Plans, based on established requirements by relevant governing bodies (NIST, OMB, DoD, HIPAA, and NSA).

• Served as team lead delivering federal risk management and C&A activities under DITSCAP/DIACAP and FISMA governance. Executed vulnerability analysis, penetration testing, and physical risk assessments.

• Led network and Windows server administration in Windows 2000/2003 environments, including SIPR network support. Managed clustered file/print services and SAN-backed storage and Cisco VoIP phone/recording solution.

• Managed a 20–30 person engineering and analyst team delivering government contract deployments, serving as the primary liaison between field teams, engineering, and customers to keep programs on schedule. • Built rollout staffing plans, training materials, and onboarding to support large-scale deployments and operational readiness. Executed large-scale identity and device programs including migration of 6,000+ users between Windows domains, provisioning/maintenance of ~50,000 user accounts.

• Planned and executed Windows 2000 migration activities, coordinating schedules, cutovers, and stakeholder communications across multiple sites. Standardized rollout procedures and checklists to improve consistency.