What the resume doesn't tell you.

1. Mark Goldstein Value Proposition
I protect corporate, customer, and employee data in a complex legal, regulatory, and
technological environment that changes daily. I started in cybersecurity/privacy as the victim of
ID theft and have seen how threats affect families, organizations, and now our national security.
As a MBA with 20+ years working in various functions I combine process & technology, along
with the critical component, the people to make the protection of data embedded in the
organizational DNA.
The nexus of cybersecurity, privacy, and business Compliance
Working across the ecosystem/know the parts Collaborative
Focus on the customeremployeethe human Protect the data like it’s your own
Speak the language of business Future focus/proactive strategy
Data is everywhere
The nexus of cybersecurity, privacy, and business – Security is how you protect data. Privacy
is what you do with the data. Both have the same goals but they take different paths. It is easy to
find someone who knows cybersec or privacy but not easy to find someone who covers both
fields. I integrate privacy practices (i.e., privacy by design, privacy assessments) and security
practices (i.e., least privilege, strong passwords) with a focus on business objectives. Having
worked in customer service, engineering, IT, project management, salesmarketing, I connect
protection of information across business operations and the critical element, employees, to make
it part of the enterprise’s DNA.
Working across the ecosystem/know the parts – Cybersecurity & privacy issues are complex
including technology (encrypting data in motion/at rest), human behavior (how to get
customers/employees to create strong passwords), current events (breaches, FTC settlements,
competitive changes), and legal/regulatory (what will the Supreme Court say about privacy, will
Congress enact breach legislation). I understand the components of this ecosystem protecting
data whether it is in the cloud, in a smartphone, or in an employee’s laptop.
Focus on the customeremployeethe human – Often organizations focus on technological
solutions while short-changing the human side of the equation. People can do great damage.
Connect employees with consequences of their actions. Engage people in the process. Take the
complexity out of cybersecurity/privacy.
Protect the data like it’s your own (and often it is) – I’m a passionate protector of all kinds of
information from financial data and intellectual property to company, customer, and employee
data. This comes from being the victim of ID theft as well as sitting in kitchens of dozens of
customers who were severely affected by malware, ID theft, and reputational damage. This is
serious stuff! Spread the passion to employees.
Collaborative – When working across organizational functions, collaboration is essential. Find
solutions that are wins for multiple groups. I started quarterly reviews between AOL’s privacy
and cybersecurity teams. This not only increased “eyes” looking for potential issues but it
enhanced the value of each team.
MG Value Proposition 1 1 December 2011 (Ver. 1.4)

2. Compliance – I worry about reduction in incidents rather than percentage of compliance.
“Compliance hawks” use checkboxes to ensure privacy and security. They think their job is done
when they check off all of their compliance metrics. Compliance is important but it should set
the “minimum floor.”
Speak the language of business – Effectively communicate the value of privacy/security I
speak the language of CFO’s who are concerned with ROI of cybersecurityprivacy investments,
chief marketing officers who worry about brand perception, chief legal officers who worry about
FTC investigations, and CEO’s who want to ensure risk is mitigated.
Future focus/proactive strategy –Changes happen fast in cybersecurity/privacy. Just read the
news. While it is important to know what happened to ensure it doesn’t happen again, I
proactively find the vulnerabilities and the areas that will be getting the attention of privacy
advocates and regulators. I ensure employees are proactively trained to be cybersecurity/privacy
sensitive and to use privacy/security by design when creating new products. Cloud computing,
mobile data management (MDM), “big data,” consumerization of IT, hacktivism, and mobile
apps are causing major changes. I understand these issues and anticipate the next issue.
Information security doesn’t end at the company’s gates – The touch points with customers
are growing through mobile apps, social networks, e-commerce sites, call centers, and traditional
bricks-and-mortar. Partners, vendors, and suppliers have access to sensitive data. Data flows
everywhere and there is a need to know where. At AOL I mapped dozens of data elements at
outsourced call centers, marketing partners, and service providers.
MG Value Proposition 2 1 December 2011 (Ver. 1.4)