Bethany J. De Lude

 Head of cybersecurity at a global investment firm with >$447B in assets under management, reporting directly to the Global CIO-Head of Technology Transformation and driving cyber value across security operations, engineering, governance and product domains. Oversees 4 direct reports, a $10M budget, >30 global cyber resources and the cyber health of >200 portfolio companies with 29 offices worldwide.

 Focuses on reducing the likelihood and impact of cyber-attacks across the enterprise. Plays a key role in inspiring trust, preserving value, and achieving a competitive advantage by creating a cyber-resilient organization. Drives security, AI, and technology strategies, evaluating enterprise risks and delivering outsized value to stakeholders, supporting >12B in 2023 investor commitments.

 Implements programs to manage insider risk (“Trusted Person Program”), monitor cyber health (“Cyber Program Metrics”), accelerate and structure R&D (“AI Fast Track”), and communicate business impact (“Cyber Value Creation”) and regularly meets with Carlyle’s audit committee; risk committee; and the CAPM, BDC and CTAC (regulated funds) boards.

Board and Committees:

 Carlyle Operating Committee (Member)

 Carlyle Americas Portfolio CISO Council (Chair)

 Carlyle IT Security and Trusted Person Program Committees (Chair)

 Carlyle Technology Leadership Team (Member)

 Institute for Applied Network Security Client Advisory Board (Member)

 Reporting to its founders, led Cred’s transformation into a security-aware culture, understanding that smartly managing and protecting digital assets is essential for business survivability, especially in the volatile crypto marketplace.

 Established and accelerated efforts to assess critical vendors, embed security clauses into contracts, enhance the security architecture, and pro-actively manage risk. Led cyber incident investigations and liaised with federal law enforcement as needed.

 Reporting to the Office of the Chairman, provide exceptional thought leadership and expert advice to assist the Board with making strategic decisions about information risk management and cyber-security related investments, such as a significant revitalization in its cybersecurity awareness and training program and the introduction of an automated tool to facilitate the implementation of its information security risk management framework.

 Created the PCAOB Information & Cyber Security Program Strategy and initiated associated governance activities. Built coalitions and credible connections with stakeholders in support of its successful execution.

 Completed information security program assessment and created formal program plan and out-year roadmap.

 In the role of Executive IT Security Liaison to the Judicial Conference of the United States, secured approval for national security policies in key information security areas; secured endorsement for a formal Judiciary Information Security Framework and implementation guide, introducing a standard security risk management model.

 Led an independent assessment that served as the foundation for an increase in IT investment, with the budget expanding from $16MM to $26MM, forecasted to reach $35MM in 2019; expanded the team of employees and contractors from 30 to over 160.

 Introduced videos and other materials to foster increased awareness of information security risks, as well as a content-rich Intranet; secured representation on multiple committees and executive councils and formed the IT Security Subcommittee within the Judicial Conference of the United States.

 Led over 400 court unit assessments, identifying trends, persistent security gaps, and gathering information to foster data-driven, evidence-based risk decisions.

 Safeguarded critical systems and information from unauthorized access by adopting Two Factor Authentication for all remote connections, as well as technologies designed to filter and scan network traffic for anomalies,

 Led an independent project to assess the effectiveness of the Prometric information security program. Prometric is a global provider of professional assessment and testing services. This assessment involved interviews with a cross-section of domestic and international stakeholders (over 40 interviews), site visits to a representative set of testing centers, and detailed reviews of supporting business processes, infrastructure, and applicable policies and procedures. This project was sponsored by the General Counsel and Senior Vice President. At its conclusion, Prometric was provided a practical action plan and detailed roadmap for evolving its security program.

 Led many cross-functional efforts to establish and support an effective public company compliance program. For example, created a network of 30 Records Champions to develop the Company's records retention program. Leveraged this network to reduce consulting fees by 30%. Similarly, reduced outside fees 50% in support of Safe Harbor self-certification by establishing and working through cross-company security and privacy liaisons.

 Directed and mentored IT Security Operations team on the process for conducting a product bake-off as the selection method for a laptop full disk encryption solution. Through a competitive RFP process and associated proposal evaluation cycle, a pool of 12 candidate vendors was reduced to three bake-off participants. By selecting our solution through a competitive bake-off, we were assured that the selected product will work in our unique environment and were able to encourage the vendors to provide their best pricing. In the end, a clear victor emerged and CEB saved $82,980.00, for a savings of $52.19%, from the winner’s initial bid.

 Calibrated the effectiveness of the Information Security organization and provided analysis to executive leadership for informed investment decision making. Supplemented analysis by creating an “Information Security Strategic Plan”, which resulted in increased head count and substantial new funding to enhance security capabilities and improve internal security controls. Protected over $2M of revenue by successfully addressing client security concerns. Provided periodic reporting to the Board of Directors.

 Created and published foundation policies in order to strengthen CEB’s baseline controls. Established a cross-company policy working group, e.g., HR, Legal, IT, and so on, which collaborated on many artifacts germane to the information security and intellectual property domains, e.g., a “Corporate Information Security Policy”, “Corporate and Personal E-Mail”; “Acceptable Use of Company Property and Information Assets”; “Business Acceptance of Risk”, and “Compliance with European Union Data Privacy Requirements” policies as well as updated the “E-Mail Disclaimer” policy. By codifying leadership’s expectations across a broad domain of business activities, these policies have strengthened CEB’s ability to hold personnel accountable for their actions and to measure compliance against a common standard.

 Cultivated strategic relationships to promote a culture of accountability and informed, risk-based decision making. In part, partnered with the Learning & Development department to create an “Information Security Matters” web-based training module. This class became an integral component of every employee’s annual training curriculum, beginning in FY 2008. Provided thought-leadership to Finance, Legal, and IT to imbed a security checklist into procurement decisions involving third parties with whom sensitive information will be shared. Served as a featured speaker to CEB’s Information Risk Executive Council, Information Technology Steering Committee, and Meetings Department, among others. Directed the collection of security performance metrics from the IT Security Operations team, the IT Infrastructure team, and HR as well as conducted work force and management surveys to obtain ERM performance indicators. Additionally, liaised with UK and US stakeholders to conduct IT controls testing in support of CEB’s Sarbanes-Oxley 404 reporting. Lastly, informed executive leadership on issues impacting CEB’s risk profile and facilitated “in the decision-making.”

 Provided leadership and strategic direction to the Centers for Medicare & Medicaid (CMS) Information Security Program. Support activities included creating the “CMS Information Security Program Plan – Fiscal Years 2006- 2008”, which identifies both tactical and strategic initiatives for the current and two out-years; overseeing the execution of independent security test and evaluations of over a dozen major applications, general support systems, and data centers that support Medicare and Medicaid claims processing; providing quarterly program status reports to the Department of Health and Human Services (DHHS); and liaising with system and business owners to facilitate risk-based decision making and to identify and prioritize risk remediation activities.

 Developed the CMS virtual handbook of information security policies, standards, procedures, and guidelines, which serves as a central repository for information security artifacts. During FY 2006, several new publications were posted to the repository, including the “CMS Information Security Test Scripts”, “CMS Information Security Reporting Standard”, and the “CMS Acceptable Risk Safeguards”. This virtual handbook was also incorporated into the “CMS Integrated IT Investment & System Life Cycle Framework” to ensure a consistent application of security principles across CMS IT developments and to formalize the integration of security principles into the investment lifecycle.

 Identified process improvements, such as streamlining the process for establishing security interconnection agreements with external third parties, standardizing the process for testing contingency plans, and creating uniform work plans to achieve and maintain compliance with the CMS certification and accreditation program. Coordinated implementation of process improvements across organizational units.

 Provided thought-leadership in support of the DHHS Secure One initiative through active participation in the Chief Information Security Officer working group. In this role, contributed to the analysis of proposed and existing legislation, such as the Federal Information Security Management Act of 2002 (FISMA); discussed trends in information security and their impact to DHHS initiatives; and provided formal comments to both National Institute of Standards & Technology and Federal Information Processing Standards publications in order to formulate department-wide information security strategy, to identify pragmatic solutions to complex issues, and to promote a consistent and pragmatic approach to addressing information security issues.

 Effectively managed the Division of Security Policy and Assessment; developed and monitored multi-million-dollar budget; oversaw FISMA compliance and reporting initiatives; and regularly reported information security program status to CMS auditors as well as executive and senior level management. Notably, during my tenure, the DHHS FISMA score lifted from 45.5 in 2005 to 86.4 in 2006. This solid B score represents the first passing grade earned by the department.

 Created Riggs Gramm-Leach-Bliley-Act (GLBA) 501(b) Compliance Program; directed its implementation and on-going maintenance; and communicated methodology and approach to bank regulators, auditors, and audit committee members. Support activities included documenting Riggs Information Security Program; executing a bank-wide security risk assessment; developing a corporate risk reduction strategy; and liaising with business owners to identify suitable options for risk remediation.

 Developed Riggs security assessment program and oversaw its execution; authored supporting methodology and developed reporting templates. Provided management oversight to all information security assessment activities.

 Developed Riggs Vendor Oversight Program, which is a risk-based program for the on-going monitoring of vendor’s operating conditions, financial performance, and security controls. This program was approved by Riggs audit committee and has been integrated into Riggs overall vendor management program.

 Established, promoted, and formalized Riggs’ information security vision and mission statements; identified strategic security projects in support thereof; and coordinated multi-disciplinary teams to strengthen security controls, as appropriate, to meet business needs.

 Identified process improvements, such as streamlining account enrollment and maintenance, in support of Riggs strategic “Operational Excellence” objective. Coordinated implementation of process improvements across organizational units.

 Effectively managed information security organization; developed and monitored multi-million-dollar budget; led recruitment initiatives; and regularly reported information security program status to Riggs audit committee, regulators and auditors.

 Led PricewaterhouseCoopers government Security & Privacy team.

- Directed a staff of 25+/- security professionals.

- Served as firm’s cyber subject matter expert and the relationship manager for several government and commercial clients.

- Served as a featured speaker at conferences and technical seminars.

- Received of firm’s All-Star Award for Distinctive Client Service.

- Earned highest employee rating each evaluation cycle.

 Managed large-scale security projects for clients in the financial and government verticals. The following is an illustrative sampling of contributions:

- Led the security review of a statistical scoring engine that is used to perform transaction fraud analysis. This review focused on validating and verifying that the cryptographic techniques used to safeguard these fraud detection models were properly conceived and implemented.

- Applied the concepts of PKI to enhance the service offerings of a large federal government client. In addition, served as system integrator to ensure various PKI products were developed securely and would work compatibly upon integration and deployment. Over 1 million certificates were fielded by this entity.

- Authored an Information Security Policy for a large financial institution. Creation of the policy required extensive interviews with network, mainframe, and security personnel as well as a thorough literature review.

- Served in a technical advisory role to the audit department of a large financial institution that was responsible for overseeing the deployment of a large scale (+75,000 certificates) web-based PKI.

- Led multiple security risk assessments of critical applications, which included identifying both process and technical vulnerabilities as well as developing risk mitigation options for their remediation.

 Directed the development, testing, and prototype demonstration of a Communications Security (COMSEC) Attack Sensing and Warning capability.

 Educated industry and government partners concerning various aspects of the system security evaluation process as part of an interagency cross-certification effort.

 Participated in a cross-organizational Secure Wireless working group, which authored a Security Policy, Security Requirements Document, an Unauthorized Events List, and a Program Assumptions document used in subsequent Secure Wireless initiatives.

 Served as technical team leader for the evaluation of a tactical communications system, a media encryption device, and a secure wireless satellite phone. Also, performed a site security assessment of a Global Command, Control, Communications, Computers, and Intelligence network.

 Provided security guidance and facilitated cross-organizational technical discussions while serving as the Technical Director for Security supporting both a COMSEC Attack Sensing and Warning Special Project Office and the Security Management Infrastructure (SMI) Server Products Division.