# Toño Herrera

Toño Herrera is a remote worker on Himalayas, Security Architect at KPMG, based in Mexico.

Source: https://himalayas.app/@tonoherrera

```text
Cyber Security professional
```

| Detail | Value |
| --- | --- |
| Availability | Looking for a job |
| Location | Mexico |
| Authorized to work in | Mexico |
| Salary expectations | 80k+ MXN |
| Job categories | GRC Analyst, GRC Analyst, Cybersecurity Analyst |
| Skills | Infosec, Security Architecture, Security Risk Assessment, Security Reviews, Information Security Management Systems (ISMS), Application Security, Secure Development Lifecycle (SDLC), DevSecOps, Penetration Testing, Threat Modeling, Code Review, Vulnerability Analysis, Cybersecurity Governance, Security Compliance, PCI DSS |
| LinkedIn | https://linkedin.com/in/tonoherreraprofile |

## What I'm looking for

```text
I’m looking to collaborate in a strong global organization and help achieve business objectives from an information security perspective.
```

## About

```text
At KPMG Technology Services America, I conducted security reviews and risk assessments for internal projects and vendors. I supported business teams through reviews involving code scans, AI red teaming, penetration testing, and threat modeling.

At Payclip, I established, defined, implemented, and continuously evaluated the Information Security Management System. Earlier at IBM, I advised organizations on application security and secure development, and worked on security requirements, code reviews, penetration test management, and compliance frameworks.
```

## Experience

### Security Architect

[KPMG](https://himalayas.app/companies/kpmg-india). Oct 2021 - Aug 2026

```text
Conducted security reviews and risk assessments for internal projects and vendors according to standards and policies. Supported business across all security review swim lanes including code scans, AI Red team, pentest, and threat modeling.
```

Skills: Security-Reviews, Risk-Assessment, Code-Scanning-Tools, AI-Red-Team, PenTest+, Threat-Modeling

### Information Security Governance & Compliance Manager

Payclip. Mar 2020 - Oct 2021

```text
Established, defined, implemented, and continuously evaluated the Information Security Management System (ISMS). Aligned strategies, policies, and processes with compliance frameworks including PCI DSS and ISO 27K, and managed cybersecurity and data protection in cloud environments.
```

Skills: ISMS, PCI-DSS, ISO-27001, Cloud-Security, Data-Protection, Privacy

### Security Services Managing Consultant

[IBM](https://himalayas.app/companies/ibm-com). Jul 2019 - Mar 2020

```text
Advised organizations on maturing their Enterprise Application Security and Secure Development Lifecycle programs. Integrated security into DevOps processes and delivered solution strategies and implementations to clients.
```

Skills: Application-Security, SDLC, DevOps, Consulting, Project-Execution

### Application Security Lead Consultant

[IBM](https://himalayas.app/companies/ibm-com). Jun 2018 - Jul 2019

```text
Managed and led information security professionals to meet customer and business objectives. Oversaw the application security practice including vulnerability analysis, secure code design, code review, and penetration test management, and performed security project management using PMI techniques.
```

Skills: Application-Security, Vulnerability-Analysis, Secure-Coding, Code-Review, Penetration-Testing, Project-Management

### Data Security & Privacy Consultant

[IBM](https://himalayas.app/companies/ibm-com). Nov 2014 - May 2018

```text
Managed the InfoSec framework for internal projects, ensuring compliance with contract specifications and regulatory requirements such as PCI DSS, ISO27001, HIPAA, and GDPR. Defined processes for user and access management, physical security, segregation of duties, and inventory of applications and systems.
```

Skills: Infosec, PCI-DSS, ISO-27001, HIPAA, GDPR, Access-Management, Physical-Security

### Information Security Analyst

Promoción y Operación S.A. de C.V. (PROSA). Aug 2013 - Nov 2014

```text
Provided security support for internal users and clients in the financial sector, implementing security measures to ensure integrity, confidentiality, and availability of information. Ensured compliance with ISO27001, PCI DSS, DRP, and BCP standards.
```

Skills: LDAP, SQL, Oracle, BMC-Remedy, Unix, Active-Directory, Web-Content-Filtering, Disaster-Recovery, Business-Continuity

## Education

### UNIR México

Master's, Cybersecurity. 2024 - Present

```text
Pursuing a Master's degree in Cybersecurity at UNIR México, expected to complete in 2025.
```

### UDLAP Jenkins Graduate School

Diploma, Cybersecurity and Personal Data Privacy. 2021 - 2021

```text
Diploma in Cybersecurity and Personal Data Privacy from UDLAP Jenkins Graduate School, completed in 2021.
```

### Mexican University

Bachelor's, Computer Systems. 2007 - 2010

```text
Bachelor's degree in Computer Systems from Mexican University, completed in 2010.
```

## Tech stack

- Oracle
- SQL

To contact Toño, message them from this profile with a Himalayas employer account: [Hire on Himalayas](https://himalayas.app/hire).

## People also viewed

- [Julio Suarez](https://himalayas.app/@juliosuarez): Privacy Audit Team Lead, IBM Corporate Assurance & Remote
- [Antonio Ortiz](https://himalayas.app/@antonioortiz1): Pentesting Supervisor, Deloitte Touche Tohmatsu Limited
- [Aleksandr Egoryshev](https://himalayas.app/@egoryshev): Chief Information Security Officer, Fieldwood Energy E&P Mexico
- [Ramesh Reddy](https://himalayas.app/@rameshreddy3): Cybersecurity Specialist, Praxis IT
- [Gabriel Pineda](https://himalayas.app/@gabrielpineda): Governance, Risk and Compliance Analyst, GlobalLogic
- [Daniel Enrique Zumaya Solis](https://himalayas.app/@dzumaya82): Independent Cybersecurity Consultant, Independent Consultant
- [Isidro Ramos Angeles](https://himalayas.app/@isidroramosangeles): Technology and Cyber Risk Manager, HSBC Mexico
- [Victor Alejandro Flores Rivera](https://himalayas.app/@victoralejandroflore): Líder de Seguridad de la Información, Subastas Ventura
- [fzA4B4k-GB-Dbaa Díaz Diaz](https://himalayas.app/@fza4b4k-gb-dbaadazdi): Security Assurance Lead, Kyndryl/AlfaTech
- [Azael Baeza](https://himalayas.app/@azaelbaeza): Cybersecurity Consultant, Deloitte