Bradley’s Journey

Bradley assumed the role of Vice President and Chief Information Security Officer at Paychex in September 2019. In this capacity, Schaufenbuel is tasked with safeguarding the confidentiality, integrity, and availability of Paychex’s information assets. He is driven by the vision that a robust information security program not only protects the organization but also serves as a key business enabler and a source of competitive advantage in the market. “We are not a provider of cybersecurity services.  However, we do use the strength and maturity of our cybersecurity program to differentiate Paychex from its competitors in the human capital management (HCM) space,” he elucidates.

With over 20 years of experience in the field of information security, Bradley brings a wealth of expertise to his role. Before joining Paychex, he was Vice President and Chief Information Security Officer at Paylocity Corporation and has held senior security positions at various banks, insurance companies, and professional services firms. 

Schaufenbuel’s educational background includes a Master of Laws and a Juris Doctor from the University of Illinois at Chicago, an MBA from DePaul University, and a Bachelor of Arts from the University of Northern Iowa. He is a licensed attorney, a member of the United States Supreme Court Bar, and a certified Chief Information Security Officer with over a dozen additional information security certifications. Schaufenbuel is also an active speaker at cybersecurity conferences and has authored numerous books and professional journal articles on information security management and IT governance.

A Diligent Focus on Security

Under Bradley’s leadership, Paychex has demonstrated a strong commitment to cybersecurity by aligning its security controls with industry-leading frameworks and standards. The company’s approach integrates the NIST Cybersecurity Framework (CSF) and the ISO 27001 standard to establish a robust defense against cyber threats. By mapping its cybersecurity defenses to the MITRE ATT&CK Framework, Paychex ensures that all security measures address known attack techniques and enhance their ability to identify, stop, and prevent cyberattacks. 

Their security services are delivered through agile project management principles, allowing for flexibility and responsiveness in managing and adapting to emerging threats. Leveraging cybersecurity tools from over 50 vendors, Paychex fortifies its defenses to protect sensitive data and combat potential attacks effectively.

Furthermore, the efficacy of Paychex’s cybersecurity controls is demonstrated through a series of rigorous assurance engagements, including SSAE-18 SOC 2 Type 2 and SOC 1 Type 2 audits, HITRUST certification, and PCI Data Security Standard (DSS) Attestations of Compliance (AOC). The company is also in the process of adding ISO 27001 registration to its list of credentials. A dedicated team of IT compliance experts, working in tandem with legal and compliance professionals, ensures that Paychex meets all legal, regulatory, and contractual requirements. 

This includes adherence to state and national privacy laws, the Health Insurance Portability and Accountability Act (HIPAA), New York Department of Financial Services (NYDFS) regulations, and the PCI Data Security Standard (DSS), among others. “We maintain a comprehensive data security program that leverages controls such as zero-trust principals, state-of-the-art multi-factor authentication and authorization techniques, fine-grained role-based access control, and masking, encryption, and tokenization techniques to safeguard the data entrusted to use by our clients,” Bradley shares.