Information Security Consultant · GRC Specialist · Lead Auditor
Helping organizations strengthen security, achieve compliance, manage risk, and build resilient governance frameworks.
I am an Information Security and Governance, Risk & Compliance (GRC) professional with 8+ years of experience helping organizations establish, implement, and continuously improve their security and compliance programs.
My background spans both sides of the assurance spectrum — as an Information Security Auditor and as an Information Security Consultant — giving me a uniquely balanced perspective on what organizations need to achieve and maintain robust security postures.
I have supported organizations across diverse industries in navigating complex regulatory landscapes, achieving internationally recognized certifications, and embedding security into their operational culture — not just their documentation.
Designing and operationalizing governance frameworks that align security with business objectives and regulatory obligations.
Conducting thorough internal audits, gap assessments, and readiness evaluations to identify and remediate control deficiencies.
Executing enterprise and information security risk assessments, maintaining risk registers, and driving risk treatment to acceptable levels.
Developing comprehensive, audit-ready security policies, standards, procedures, and control documentation aligned to industry frameworks.
A practitioner-level command of the frameworks, methodologies, and controls that matter most.
End-to-end consulting engagements tailored to your compliance objectives and risk tolerance.
Full-cycle support from gap assessment through ISMS design, documentation, control implementation, and certification readiness — guiding your organization to successful ISO 27001 certification.
Structured readiness programs to help service organizations meet AICPA Trust Services Criteria, prepare audit evidence, and achieve clean SOC 2 reports that satisfy enterprise customer requirements.
Readiness and remediation support aligned to the HITRUST CSF, helping healthcare and health-tech organizations demonstrate robust data protection controls to partners and regulators.
Scoping, gap analysis, control design, and remediation planning to achieve and maintain PCI DSS compliance across cardholder data environments of all sizes and complexity.
Independent, risk-based internal audit programs covering information security controls, IT general controls, and compliance with applicable frameworks, producing actionable findings and management reports.
Development and review of comprehensive information security policy suites, standards, and operational procedures aligned to ISO 27001, NIST, and other leading frameworks.
Systematic enterprise and information security risk assessments — identifying, analyzing, and evaluating threats and vulnerabilities, with pragmatic risk treatment recommendations tailored to your business context.
Design and operation of TPRM programs including vendor risk tiering, assessment questionnaires, due diligence reviews, and ongoing monitoring aligned to your procurement and contracting lifecycle.
End-to-end BCM program development — from BIA and BCP through DR planning, crisis communication, and tabletop exercises — aligned to ISO 22301 and industry best practices.
Creation of audit-ready security documentation including Statements of Applicability, control matrices, risk registers, and management review packs for regulatory submissions and customer assurance.
Scoping, planning, and coordinating VAPT engagements covering asset discovery, vulnerability scanning, risk-based prioritization, and penetration testing. Includes pre-engagement preparation, findings interpretation, and post-assessment remediation planning to systematically reduce your organization's attack surface.
Fractional security leadership covering strategic program oversight, board-level reporting, security roadmap development, policy governance, compliance management, and vendor oversight — delivering embedded CISO-level expertise aligned to your business objectives without the cost of a full-time hire.
Independent Consulting Practice
Information Security Assurance Practice
Hands-on experience across the standards and frameworks that define information security and compliance excellence.
The international standard for Information Security Management Systems. Experienced in full ISMS implementation, Statement of Applicability, control annexure, and certification audit readiness.
Point-in-time assurance over the design of security, availability, processing integrity, confidentiality, and privacy controls against the AICPA Trust Services Criteria.
Operational effectiveness testing over an audit period, requiring sustained control performance. Readiness programs structured to minimize audit findings and reduce remediation cycles.
Common Security Framework used extensively in healthcare and health technology sectors. Provides a prescriptive, certifiable control baseline across regulatory and industry requirements.
Payment Card Industry Data Security Standard protecting cardholder data environments. Experienced in scoping, network segmentation, control implementation, and SAQ/RoC preparation.
International standard for Business Continuity Management Systems. Covers BIA, continuity strategy, BCM documentation, testing programs, and BCMS certification preparation.
Tangible, audit-ready artifacts that demonstrate your security posture and accelerate compliance outcomes.
Certified to conduct and lead ISO/IEC 27001 audits, assess ISMS conformance, and evaluate information security control effectiveness.
CertifiedCertified from a well known Information and Cybersecurity Institution.
CertifiedAdditional professional certification — to be added soon.
Coming SoonMore than eight years of practitioner-level experience across both audit and consulting disciplines — not theoretical knowledge, but proven delivery in real organizations.
Having operated as both an auditor and a consultant, I understand exactly what auditors look for — and how to prepare your organization to pass with confidence.
Deep familiarity with ISO 27001, SOC 2, HITRUST, PCI DSS, ISO 22301, and related regulations allows cross-framework optimization rather than siloed compliance efforts.
Recommendations are grounded in operational reality. Controls and processes are designed to work within your business — not just satisfy auditors on paper.
Producing clear, comprehensive, audit-ready documentation is a core strength — from policies and risk registers to SOA matrices and management review packs.
Security exists to enable business, not obstruct it. Compliance programs are designed to protect what matters while preserving operational agility and stakeholder trust.
Whether you're preparing for a certification audit, building out your GRC program, or need an independent perspective on your security posture — I'm here to help. Reach out to discuss your needs.