You Work With the
Expert.
Not a Junior Analyst.

A publicly traded global energy company was carrying forward audit findings across key SOX ITGC domains including access management, change management, and computer operations. The internal audit team lacked the bandwidth to close control gaps before the annual external audit window, and external auditors had flagged elevated risk across the IT control environment.

Embedded as the senior GRC lead for the ITGC remediation program. Conducted a full control gap assessment mapped to COBIT 5 and the internal SOX framework. Built remediation task owners, evidence collection templates, and walkthroughs for all in-scope systems. Coordinated directly with external auditors to align on control design expectations prior to testing. Deployed AuditBoard to centralize evidence management and create real-time audit status visibility for the CFO and internal audit director.

A mid-size fintech company needed to achieve PCI DSS v4.0 compliance ahead of a contract renewal deadline. The organization had never undergone a formal PCI assessment, had an undefined cardholder data environment scope, and was six months from the assessor visit. The compliance team had no prior PCI program experience.

Led a structured PCI DSS readiness program from scoping through pre-assessment validation. Defined the CDE boundaries, applied network segmentation to reduce assessment scope, and built a control implementation roadmap prioritized by assessor risk impact. Deployed Drata for continuous compliance tracking across AWS infrastructure. Conducted mock assessor walkthroughs to ensure staff could respond confidently during formal testing.

A healthcare technology company providing software to regional hospital systems had outgrown its informal approach to HIPAA compliance. A prospective enterprise client required a formal HIPAA Security Rule compliance program, third-party vendor risk documentation, and a Business Associate Agreement process before signing. The company had no existing security policies, no risk assessment on record, and no vendor oversight program.

Built the HIPAA Security Rule compliance program from the ground up aligned to NIST CSF 2.0. Delivered a formal Security Risk Assessment covering all ePHI systems, a complete policy library across 18 required and addressable specifications, and a vendor risk process using UpGuard for ongoing third-party monitoring. Worked with legal counsel to establish a standardized BAA template and vendor onboarding checklist.