Looking for a job

Kwame Asante

@kwameasante

Third-Party Cyber Risk Lead at State Street, standardizing global vendor assessments and reporting across a 15-person team.

United States

Message

At State Street Corporation, I lead the global Third-Party Cyber Risk Management program, covering due diligence, monitoring, reassessment, remediation, and risk acceptance. I manage a 15-person team across the U.S., Ireland, Poland, and Singapore.

I’ve standardized assessment practices, risk documentation, escalation procedures, and executive reporting across the program. I also report material findings, remediation ageing, risk exceptions, emerging risks, and vendor trends to improve executive and board visibility.

Previously, I assessed high-risk third parties at State Street Corporation and worked in cybersecurity and GRC roles at Bank of America and United Health Group. My experience includes security evidence review, vulnerability remediation, cloud risk assessment, and regulatory and audit readiness; I hold CISA, CISM, and CTPRP certifications.

Experience

Work history, roles, and key accomplishments

Current

Vice President – Global Third-Party Cyber Risk Lead

Current

State Street Corporation

Jan 2025 - Present (1 year 8 months)

Leads the global Third-Party Cyber Risk Management program, managing a 15-person team across multiple countries and overseeing due diligence, monitoring, remediation, and risk acceptance for critical vendors.

Third Party Risk Management Cybersecurity Due Diligence Continuous Monitoring Risk Acceptability Remediation Governance NIST CSF ISO 27001 SOC 1 SOC 2 CAIQ CSA CCM SIG HITRUST ServiceNow GRC IRM SecurityScorecard Power BI Jira SharePoint Excel Tenable Nessus AWS

Assistant Vice President – Global Third-Party Cyber Risk

State Street Corporation

Jul 2022 - Dec 2024 (2 years 5 months)

Assessed complex and high-risk third parties, evaluated control effectiveness using SOC reports and ISO 27001, and drove vendor security findings toward resolution while standardizing due diligence practices.

Third Party Risk Management Cybersecurity Due Diligence SOC 1 SOC 2 ISO 27001 HITRUST NIST CSA Risk Assessment remediation Governance

Cybersecurity Engineer

Bank of America

Jun 2021 - Jul 2022 (1 year 1 month)

Prioritized vulnerability findings using Tenable/Nessus, coordinated remediation with technology teams, and assessed security architecture for technology environments including AWS-hosted environments.

Tenable Nessus Vulnerability Management ServiceNow AWS Security Architecture Risk Assessment

GRC Analyst

United Health Group

Jan 2017 - May 2021 (4 years 4 months)

Assessed third-party and internal technology risks against NIST-aligned controls and HIPAA requirements, evaluated vendor control environments, and governed remediation follow-up for identified findings.

GRC NIST HIPAA SOC 1 SOC 2 Risk Assessment remediation Audit Readiness