Cybersecurity GRC
Professional.
Bridging 5 years of commercial lending operations with hands-on cybersecurity GRC — assessing risks, mapping controls and building practical recommendations across ISO 27001, NIST CSF 2.0, APRA CPS 234 and Essential Eight.
Background
About Me
I am building a career in cybersecurity Governance, Risk and Compliance, bringing 5 years of commercial lending operations experience into the field.
Through hands-on projects I have worked across ISO 27001, NIST CSF 2.0, APRA CPS 234 and Essential Eight — assessing risks, mapping controls and developing practical recommendations. This portfolio showcases my GRC project work as I grow in this space.
Work
Projects
A full cybersecurity GRC assessment of Oscorp evaluating their security posture against ISO 27001 and NIST CSF 2.0, with a gap analysis, risk register and prioritised remediation roadmap.
Background
Oscorp is a technology and research organization with an established IT function but limited cybersecurity maturity. While the organization has invested in foundational IT controls such as business continuity, network security and physical security, significant gaps exist across critical cybersecurity domains including identity and access management, detection and response, vulnerability management and third party risk.
Deliverables
-
Current State Assessment
Reviewed Oscorp's existing security controls across all key domains — documenting what is in place, what is working well and areas of concern. This formed the foundation for all subsequent analysis.
-
Gap Analysis
Compared Oscorp's controls against ISO 27001 and NIST CSF 2.0 requirements, rating each gap as Critical, High, Medium or Low. Key findings included the absence of MFA, no SIEM capability, shared admin passwords and no formal vulnerability management program.
-
Risk Register
Identified the top 13 cybersecurity risks facing Oscorp, scored by likelihood and impact (1–5). Each risk includes the threat, current control and recommended control. Critical and High risks require immediate leadership attention.
-
Recommendations & Roadmap
A prioritised roadmap organised into immediate, short-term and medium-term timeframes, mapped to NIST CSF 2.0 and ISO 27001. Recommended for board-level presentation given the number of critical gaps identified.
Currently working on additional GRC assessments and framework implementations.
Expertise
Skills & Frameworks
GRC Frameworks
GRC Capabilities
Domain Knowledge
Certifications
Get In Touch
Contact
Interested in collaborating or have a GRC opportunity? I'd love to connect.