experience

Third-party risk, cryptographic governance, audit readiness

• Managed 500+ third-party risk assessments for global clients like Meta and FIFA, evaluating security posture against NIST 800-53, SOC 2, and ISO 27001.
• Built a cryptographic governance program, defining standards for AWS KMS, Azure Key Vault, and HSMs.
• Conducted technical deep-dives on penetration test reports and secure SDLC policies to validate vendor controls.
• Technical lead for external audits, partnering with engineering teams to close findings and improve security maturity.

Control reviews, risk documentation, remediation tracking

• Supported IT security assessments for client applications, reviewing control alignment across NIST, ISO 27001, and SOX requirements.
• Documented gaps, risk findings, and remediation actions to help teams improve security posture and maintain audit-ready evidence.
• Helped maintain IT risk registers and policy exception workflows, including compensating controls and risk acceptance documentation.
• Coordinated with vendors and cross-functional teams on access controls, third-party security reviews, and high-priority security issue triage.