Security and compliance program
Built the information security program behind ISO/IEC 27001 certification and SOC 2 readiness.
Context
Customers and auditors needed a formal security program with controls that could be shown, not just described.
What I did
Led policy development, risk assessments, security controls, audit preparation and remediation. The goal was controls that run as everyday workflows, so the evidence already exists when an auditor or customer asks for it. I also ran vendor risk reviews and set guardrails for internal AI use.
Outcome
ISO/IEC 27001 certification and SOC 2 readiness. The same policies, controls and evidence were used in customer security reviews.
More work
Enterprise application platform
Planning an internal application platform to bring business tools and workflows into a common environment.
Data and analytics modernization
Building an internal data engineering capability and a foundation for company-wide reporting.
Technology governance and portfolio
A structured way to plan, prioritize and track technology work across operations, security, data, software and automation.