Taylor A. LaCass

Own cybersecurity, enterprise IT, compliance, and privacy for a high-growth SaaS platform supporting global retail partners.

• Built and scaled the company's first formal information security, compliance, and enterprise risk program, defining the strategy, roadmap, policies, control model, risk lifecycle, reporting, and remediation processes.
• Led the company's AI transformation, directing enterprise-wide deployment of AI technologies while establishing AI governance policy, security controls, and cost controls for token spend and usage.
• Own identity, endpoint, and internal-systems operations across the US, Canada, UK, and Europe, including Okta, device management, endpoint protection, productivity platforms, access governance, and employee onboarding and offboarding.
• Direct security operations spanning managed detection and response, SIEM, vulnerability management, penetration testing, incident-response readiness, investigations, escalation, and corrective-action tracking.
• Partner with engineering to strengthen AWS infrastructure, applications, APIs, development practices, and sensitive-data protections; review architecture and drive risk-based remediation without unnecessary product friction.
• Lead SOC 2 Type II, PCI, privacy, and customer-assurance programs and translate GDPR, UK GDPR, ISO 27001, contractual, and enterprise requirements into practical controls and accountable ownership.
• Strengthen operational resilience through business-continuity and disaster-recovery planning, backup validation, recovery procedures, incident playbooks, and recurring testing across critical systems.
• Manage third-party, partner, acquisition, and new-market security risk, including technology consolidation and control alignment for acquired European operations and distributed service providers.
• Make security a practical shared responsibility through clear control ownership, role-based awareness and training, repeatable guidance, and cross-functional remediation.
• Advise executives on material risk and security tradeoffs while leading a lean internal team and managed partners across security, GRC, IT engineering, and user support.

Led information-security risk, governance, and control operations in a regulated consumer insurance environment.

• Owned enterprise information-security risk and governance, aligning security priorities and remediation with legal, regulatory, and business requirements.
• Oversaw control assurance, monitoring, issue remediation, security awareness, and management reporting while partnering across technology and business teams.
• Reported security risk, incidents, control performance, and remediation status to management, improving visibility and accountability across regulated operations.
• Led security and GRC engineering personnel and coordinated internal and external stakeholders to improve control maturity and risk visibility.

• Led IT audit, compliance, and risk activities, serving as the primary bridge between external auditors and internal technology and business teams.
• Managed evidence, response development, control assessments, issue resolution, and remediation tracking for IT-related external audits.
• Advanced PCI ROC readiness and IT-control maturity through risk-based reviews and implementation of proportionate mitigation measures; GRC scope also included ITGC audit readiness and COBIT audit readiness aligned with state regulators.

Managed Ohio operations and compliance following the firm's acquisition of Cheek Law Offices.

• Led post-acquisition integration of processes, policies, controls, reporting, and compliance practices across regulated consumer-debt operations.
• Prepared client audit responses, led onsite-audit coordination, and improved performance through process-gap analysis, root-cause review, and remediation.
• Managed staff, production analysis, forecasting, and process improvement while maintaining operational continuity through the acquisition.

• Served as the firm's first compliance manager, building its formal compliance management system, department, policies, procedures, controls, training, monitoring, and executive reporting.
• Conducted audits, investigations, risk assessments, and root-cause reviews; directed corrective and preventive actions across regulated operations.
• Designed employee training and translated FDCPA, FCRA, TCPA, GLBA, client, legal, and ethical requirements into repeatable operating controls.
• Reduced client-audit defects by more than 20% within the first year; operational performance later ranked first among 58 firms for the organization's largest client.

• Supported high-volume consumer-debt litigation, built repeatable documentation and templates, and maintained working knowledge of FDCPA, FCRA, TCPA, and GLBA requirements.