Granted.
I'm a GRC and IS Audit professional with experience across compliance frameworks — ISO/IEC 27001, SOC 2, NIST CSF, CMMC, ISO 9001, IEC 62443 and more. I translate regulatory complexity into structured, actionable security programs.
Skilled in IT risk assessments, control gap analysis, ISMS documentation, and audit evidence preparation. Experienced as a Virtual Information Security Officer (vISO) for a financial institution, bridging governance requirements with technical controls.
Beyond client work, I build GRC tools — BrahmaGrid and Khatra GRC — exploring how technology can streamline compliance workflows.
History.
- Supported IT risk assessments and IS audits for technology and regulated clients.
- Conducted Internal Audits against multiple compliance frameworks including ISO 27001, SOC 2, NIST CSF, CMMC, IEC 62443 etc.
- Conducted threat modeling (STRIDE) and identified control gaps across people, process, and technology.
- Developed and reviewed GRC documentation — policies, risk registers, and Statements of Applicability.
- Prepared audit evidence, vulnerability assessments, and management-level compliance reports.
- Served as Virtual Information Security Officer (vISO) for a financial institution client.
- Drafted GRC and ISMS documentation aligned to international security standards.
- Supported IS audits and compliance assessments under ISO/IEC 27001, SOC 2, and NIST CSF.
- Contributed to risk identification, control mapping, and audit documentation processes.
- Delivered structured web content with SEO optimization, strengthening professional documentation skills applicable to compliance writing.
Credentials.
Operations.
Foundation.
Connect.
Open to roles in GRC, IS Audit, and compliance. Need an Internal Auditor, GRC Analyst, or someone to build your security program — let's talk.