Douglas Gunnels Porter

Leading an 8-person team responsible for Cardinal Health's enterprise Cyber Risk Management Strategy and Framework — the governance layer that turns technical risk into decisions leadership can act on.

Owned Cyber Risk Strategy, IT Policy & Standards, and Issue/Exception Management, including the Archer IRM platform that runs it

Chaired the IT Risk Advisory Board, facilitating risk treatment ac

Built and led a remote-first, multi-national team of 17 (US & India) driving Cardinal Health's Third-Party Risk Management (TPRM) strategy — leveling up the company's vendor cyber risk maturity from the ground up.

Designed the governance, resourcing, and operational model for Vendor Third-Party Risk, aligning oversight across procurement, legal, and business units

Built executive and operationa

Led Cardinal Health's Vendor Third-Party Risk Program, working directly with vendors and internal business partners to remediate unacceptable security risk through assessments and contract negotiation.

Built and ran Third-Party Cyber Crisis Response — planning and executing incident response for supplier security incidents

Stood up an extended risk team in Philippines (CHIP) to scale program ca

Performed third-party vendor risk assessments and led remediation of unacceptable security risk in partnership with vendors and the business — while helping mature the program itself.

Built vendor risk metrics and reporting from scratch to inform program strategy

Increased visibility into vendor risk by researching and consolidating data from disparate sources

Operationalized manual activities

Provided thought leadership on Identity and Account Management (IAM) for IT leadership and administrators.

Assessed and recommended software for Identity Governance and Administration (IGA) and Data Access Governance (DAG) to help guide future strategy, and was trusted to aid in other major project implementations.

Developed standards, requirements and test plans for automated risk-based acc

Involved in multiple infrastructure and system change projects to achieve PCI compliance. Supported several major business projects through technical expertise and project planning

IIS Web Server and eCommerce administration. Integrated web server patch scheduling for all environments with Software Development Life Cycle. Updated company firewall with new changes in compliance with audit proc

Identity and access management for multiple systems. Improved company user administration to pass Price Waterhouse Cooper audit and trained 6 Service Desk Analysts in its use.

Worked as Service Desk Analyst at Endsleigh Insurance Services Ltd.

Mar 2017

Aug 2015

Topics covered:
• Information Security
• Network Security
• Database Management
• Project Management
• Software Design
• Legal and Ethical issues

Jun 2008