Information Security professional specialising in Governance, Risk & Compliance. ISO/IEC 27001:2022 Lead Auditor certified by TÜV SÜD, with hands-on experience mapping technical security findings to ISO 27001, SOC 2, PCI DSS, NIST CSF, and GDPR control frameworks — producing audit-ready documentation that satisfies both security teams and compliance stakeholders.
I'm a GRC Analyst and Information Security professional with ~2 years of compliance-aligned security assessment experience, now fully dedicated to building and supporting governance frameworks that are both technically sound and audit-ready.
My background in vulnerability assessment and penetration testing gives me a technical foundation that most compliance professionals lack. I don't just document controls — I understand what they protect against, how they can fail, and how to write findings that a board member and an auditor can both act on.
I recently completed the ISO/IEC 27001:2022 Lead Auditor programme at TÜV SÜD (March 2026), covering the full audit lifecycle from planning and fieldwork through nonconformity grading and corrective action follow-up. This complements my practical experience running compliance evidence collection and control gap analysis across client engagements at two security firms.
Delivered compliance-aligned security assessments for clients, with a strong focus on translating technical findings into structured, framework-mapped documentation suitable for audit review and executive reporting.
Conducted technical security assessments across web, mobile, API, and network environments, with all findings systematically mapped to compliance control frameworks and documented in audit-ready reports.
Each project simulates a real-world GRC engagement — producing the same artefacts a professional would deliver in an actual compliance programme: risk registers, audit evidence, vendor assessments, policy documentation, and corrective action plans.
I'm actively seeking GRC Analyst, IT Auditor, and Risk & Compliance roles where I can contribute immediately. If you're building or scaling a compliance programme and need someone who understands both the technical and governance sides of information security — let's talk.