Senior GRC & Cybersecurity Risk Consultant

Manage end-to-end third-party security, privacy, AI, and technology risk assessments through OneTrust. Perform intake validation, vendor due diligence, security questionnaire reviews, evidence analysis, residual-risk evaluations, and risk-based approval decisions.

Partner with Privacy, Legal, Procurement, IT, Engineering, and business stakeholders to define risk treatment conditions, contractual safeguards, data processing requirements, integration controls, and remediation actions. Support ISO/IEC 27001 and SOC 2 readiness, maintain security governance documentation, and review AI use cases and vendor capabilities against organizational requirements.

Conduct end-to-end ISO/IEC 27001:2022 certification audits as Lead Auditor, including Stage 1, Stage 2, and surveillance audit activities for organizations across international markets. Assess the design, implementation, maintenance, and operating effectiveness of Information Security Management Systems.

Participate in ISO/IEC 42001 and ISO/IEC 27701 audits covering AI management systems, privacy management systems, governance, risk and impact assessment processes, AI lifecycle controls, and PII responsibilities. Perform documentation reviews, interviews, evidence validation, control testing, and audit sampling, and prepare formal audit reports and certification findings.

Led cybersecurity program and maturity assessments to evaluate current-state capabilities and develop future-state recommendations aligned with ISO/IEC 27001, the NIST Cybersecurity Framework, CIS Controls, and organizational requirements. Conducted risk and control assessments and worked with cross-functional teams on mitigation and remediation strategies.

Supported privacy and data protection assessments involving personal-information collection, use, processing, storage, sharing, and protection. Used OneTrust and IBM OpenPages for privacy impact assessments, risk assessments, evidence collection, issue documentation, remediation tracking, and risk-to-control mapping; delivered executive reports and remediation roadmaps.

Managed security, privacy, and regulatory compliance activities for global client accounts, ensuring alignment with GDPR, CCPA, HIPAA, contractual obligations, and cybersecurity requirements. Governed account risk registers with documented risk ratings, mitigation actions, owners, and remediation status.

Conducted security and privacy compliance assessments against IBM policies, security baselines, client requirements, and industry standards. Led client security audits, vendor assessments, third-party questionnaires, evidence collection, and remediation activities with international business and technical stakeholders.

Executed IT General Controls and SOX compliance audits for organizations in financial services, manufacturing, retail, and other regulated industries. Performed control walkthroughs and assessed the design and operating effectiveness of controls related to user access management, change management, and IT operations.

Prepared audit workpapers and formal reports in accordance with internal methodology and external audit quality requirements. Communicated audit findings, control deficiencies, and remediation recommendations to process owners, senior stakeholders, and management.

Master's Degree in Cybersecurity.

B.S. in Digital Systems and Robotics Engineering.