LEADERSHIP PROFILE
Professional Summary
Senior GRC leader with 15+ years of experience building and scaling security governance, enterprise risk, regulatory compliance, audit readiness, third-party risk, and policy programs across SaaS, cloud, healthcare, technology, and financial-services environments.
Combines strategic program ownership with hands-on delivery across GRC platforms, compliance automation, AWS governance, control operations, and emerging-technology risk. Trusted cross-functional partner to Engineering and executive leadership.
CORE COMPETENCIES
Leadership & Technical Capabilities
A comprehensive overview of core strengths across governance, risk management, regulatory compliance, and secure cloud engineering designed for complex enterprise environments.
GRC Program Leadership
Risk & Assurance
Designing robust operating models, GRC maturity roadmaps, and policy governance frameworks. Managing end-to-end audit coordination, issue remediation, executive risk reporting, and driving cross-functional stakeholder adoption.
Conducting comprehensive enterprise and technology risk assessments, third-party risk management (TPRM), and vendor due diligence. Designing and executing rigorous control testing, access governance, and security assurance programs.
Compliance Frameworks
Cloud & Engineering
Navigating complex compliance landscapes with hands-on framework implementation for SOC 2 Type I and II, ISO 27001, NIST SP 800-53, FISMA, CUI, HITRUST, HIPAA, PCI DSS, SOX, FFIEC, and OCC.
Strengthening cloud security posture management and DevSecOps integrations. Implementing automated compliance evidence collection, continuous control monitoring, and robust security governance for infrastructure as code.
2022 - PRESENT
Principal Security GRC Consultant
A3INFOSEC • San Mateo / Remote, CA
GRC Advisory & Program Leadership
Compliance & Audit Readiness
Lead independent client engagements spanning audit readiness, third-party risk, GRC automation, cloud security governance, AI governance, and software supply-chain risk.
Lead assessments against SOC 2, ISO 27001, and HITRUST e1; evaluate policies, technical controls, evidence, ownership, and operating practices; develop remediation roadmaps.
2020 - 2022 • SUNNYVALE, CA
Equinix Security Governance
Spearheading enterprise-wide governance, risk, and compliance initiatives to align platform capabilities with complex digital transformation objectives.
GRC Strategy & Roadmap
Advised senior leadership on a multi-year GRC and IRM roadmap aligning platform capabilities, compliance priorities, and risk-management processes with business and digital-transformation objectives.
ServiceNow IRM Implementation
Led deployment and configuration of workflows for policy management, risk assessments, control oversight, issue tracking, and compliance repositories.
2019 - 2020 • SAN FRANCISCO, CA
Cloud Compliance & Audit Readiness
RingCentral
Facilitating enterprise-grade compliance frameworks and streamlining cross-functional evidence collection to accelerate cloud security audits and partner trust.
Audit Readiness
Risk Management
Facilitated audit readiness across SOC 2, HITRUST, ISO 27001, and BSI C5, and streamlined evidence collection across Engineering, DevOps, Security, and IT teams.
Managed enterprise risk assessment remediation across Engineering, SDLC, HR, Legal, and Privacy, and led third-party risk assessments and partner security reviews supporting sales and business development.
2019 • SAN FRANCISCO, CA
Reviewed Moderate-impact System Security Plans and third-party service-provider documentation for alignment with NIST SP 800-53, FISMA, and Controlled Unclassified Information requirements.
Federal Reserve Bank of San Francisco
Conducted threat modeling and change-risk assessments; presented findings, remediation progress, and residual risk to system owners.
Senior IT Security Risk Analyst
Policy Governance & Modernization
2017 - 2019 • SAN FRANCISCO, CA
Led enterprise policy-maturity efforts as the primary information-security policy contact, aligning policies, standards, and controls with NIST, ISO 27001, HIPAA, and organizational risk objectives.
Blue Shield of California
Policy Operating Model
IT Security Policy Lead
Established a lifecycle for development, review, approval, communication, attestation, exceptions, and maintenance; facilitated adoption with IT, Legal, and compliance partners.
2016 - 2017 • SANTA CLARA, CA
MOVE INC. / REALTOR.COM
GRC Principal
Post-M&A GRC Integration
Critical Asset Governance
Directed development of a new GRC program after acquisition, aligning policies, standards, and assurance practices with News Corp requirements and ISO 27001 and ISF frameworks.
Led the Crown Jewels initiative to identify critical systems and data, document ownership and data flows, and establish a data-classification policy supporting risk-based asset management.
VISA
Senior Risk Analyst
2016 - 2017 • SANTA CLARA, CA
Security Risk Assessments
Testing & Remediation
Executive Risk Reporting
Managed assessments across Agile SDLC releases, infrastructure changes, enterprise applications, and third-party technologies using ISO 27001, PCI DSS, NIST, and FFIEC criteria.
Coordinated penetration tests, secure-code reviews, and vulnerability scans; validated risk ratings, escalated critical findings, assigned accountability, and developed practical mitigation plans.
Synthesized complex technical assessment findings into clear, actionable risk summaries and remediation roadmaps for executive leadership and key stakeholders.
Earlier Career
Financial Services Clients (PayPal, Protiviti) | Bay Area, CA
E*TRADE Securities | Menlo Park, CA
Security Assurance & IAM Specialist
Security Risk & Compliance Consultant
• Performed vendor risk assessments across critical banking service providers.
• Conducted NIST-based risk assessments across payment and financial systems.
• Performed ISO 27001 gap assessments and PCI DSS validation activities.
• Supported SOX ITGC audits evaluating control design and effectiveness.
CREDENTIALS
Certifications & Education
A comprehensive record of active and prior professional certifications, security compliance credentials, and academic foundations in accounting information systems.
CISSP
GRCP, GRCA
PCI QSA
B.S. Business Administration
Certified Information Systems Security Professional (Active)
OCEG (Previously Held)
PCI SC (Previously Held)
Accounting Information Systems, California State University, Sacramento (Graduated)
PROFESSIONAL WRITING
GRC Thought Leadership
500K+
Readers to Date
GRC PROS Blog | 2023 – Present
Built GRC PROS into a practitioner-focused GRC publication. We publish content on GRC program execution, audit readiness, third-party risk, compliance automation, CI/CD and cloud controls, AI governance, and regulatory trends.
Using AI-assisted research, writing, and content workflows to support topic development, analysis, editing, and publication.
10K+
Subscribers