Sarah Espensen

PROFESSIONAL SUMMARY: Results-driven Cybersecurity Senior Technical Program Manager with 10+ years leading enterprise-scale Governance, Risk, and Compliance (GRC), third-party risk management, and vulnerability remediation programs in cloud-first, regulated environments. Expert in PCI DSS, SOC 2 Type II, HITRUST, FedRAMP, and NIST CSF, with hands-on Workiva, OneTrust, and Security Scorecard experience. Proven ability to orchestrate 35+ concurrent security initiatives while maintaining KPI and SLA governance, executive dashboards, and cross-functional alignment across Security, Engineering, GRC, Legal, and Audit teams. Track record includes eliminating $3.5M in cybersecurity tech debt, cutting vendor onboarding by 40%, reducing audit cycles by 50%, and accelerating PCI DSS and SOC 2 Type II compliance across AWS infrastructure in under 6 months. CORE COMPETENCIES: Cybersecurity & Compliance Frameworks: PCI DSS, SOC 2 Type II, HITRUST, FedRAMP, NIST CSF, NIST 800-53, ISO 27001, GDPR, FISMA, DevSecOps GRC & Risk Management: Governance, Risk & Compliance (GRC), Third-Party Risk Management (TPRM), Vendor Risk Scoring, Risk Register, Issues & Exceptions Management, Control Framework Rationalization, Policy Governance, Audit Readiness Program & Portfolio Management: Technical Program Management, Cross-Functional Delivery, Agile/Scrum, SAFe, Strategic Roadmapping, PMO Maturity, KPI/SLA Governance, Executive Reporting, Remediation Tracking, M&A Security Integration Cloud & Security Operations: AWS (IAM, S3, Config, Security Groups, VPC), Azure, Active Directory, Penetration Testing, Red Team Findings Management, Vulnerability Management, Incident Response GRC Platforms & Tools: Workiva, OneTrust, Security Scorecard, Jira, Confluence, ServiceNow, SharePoint, SAP, Microsoft 365, Slack Process Improvement: Lean Six Sigma Black Belt, Automation Pipelines, SOP Development, Controls Rationalization, AI-Driven Dashboards, Lifecycle Integration