10/20/2026 updated

**** ******** ****
100 % available

Cybersecurity GRC & AI Governance | ISO 27001 · NIS2 · ENS · SOC 2 · ISO 42001 | vCISO

Granada, Spain
Worldwide
MBA in Leadership & Management
Granada, Spain
Worldwide
MBA in Leadership & Management

Profile attachments

CV_Alejandro_Gonzalez_Ostos_GRC.docx.pdf

About me

I help regulated and technology-driven organizations strengthen cybersecurity governance, risk and compliance. I lead ISO 27001, NIS2, SOC 2 and AI Governance, ISO 42001 initiatives covering risk assessment, control implementation, audit readiness, remediation, executive reporting

ComplianceGovernance Risk Management and ComplianceSystems Integration
I help SaaS, technology-driven and regulated organizations assess, implement and improve cybersecurity, Governance, Risk & Compliance (GRC), and AI Governance programmes across Spain and Europe.
My focus is turning regulatory requirements into practical security controls, measurable risk reduction, audit-ready evidence and sustainable governance processes.

CORE EXPERTISE

• ISO 27001 & ISMS: Gap assessments, risk assessments, risk treatment plans, Statement of Applicability (SoA), control implementation, internal audit preparation, remediation and certification readiness.

• NIS2, ENS & DORA: Regulatory applicability, compliance gap assessments, cybersecurity risk management, governance, incident management, operational resilience and remediation roadmaps.

• SOC 2 Type I & Type II: Readiness assessments, Trust Services Criteria mapping, control design, evidence collection, gap remediation and audit preparation.

• AI Governance, ISO 42001 & EU AI Act: AI risk assessments, AI inventories, governance frameworks, risk classification, policies, human oversight, third-party AI risk and regulatory readiness.

• GRC & Control Assurance: Risk registers, control testing, compliance monitoring, KPIs/KRIs, audit findings, remediation tracking and executive reporting.

• Fractional CISO / vCISO: Cybersecurity strategy, governance programmes, risk oversight, security roadmaps, stakeholder reporting and ongoing advisory.

• Third-Party Risk Management (TPRM): Vendor security assessments, supplier due diligence, risk classification, evidence reviews and remediation.

• Business Continuity & Human Risk: ISO 22301-aligned continuity planning, Business Impact Analysis (BIA), security awareness and social engineering risk management.

SERVICES AVAILABLE

– ISO 27001 Gap Assessment & Implementation
– ISO 27001 Internal Audit Readiness
– SOC 2 Type I & Type II Readiness
– NIS2 / ENS / DORA Compliance Assessments
– ISO 42001 & EU AI Act Governance
– Cybersecurity Risk & GRC Assessments
– Fractional CISO / vCISO Services
– Third-Party Risk Management
– Audit Evidence & Remediation Support
– Continuous Compliance & Control Monitoring

CLIENT VALUE

→ Practical compliance roadmaps and prioritized remediation
→ Stronger audit and certification readiness
→ Documented, traceable and operational security controls
→ Improved risk visibility and executive accountability
→ More efficient evidence management and audit preparation
→ Scalable cybersecurity and AI governance programmes

SECTORS

SaaS · Technology · Healthcare · Financial Services · Fintech · Pharmaceuticals · Public Sector

GEOGRAPHIC COVERAGE

Spain · European Union · Remote International Projects

LANGUAGES

Spanish (Native) · English (Professional) · German (Basic)

Experience

Professional experience5 - 10 years
Freelancer since2020

Languages

GermanGoodEnglishFluentSpanishNative speaker

Project history

Founder & Cybersecurity GRC Consultant / vCISO

Spectrasec

Internet & IT

< 10 team member

Lead cybersecurity Governance, Risk & Compliance (GRC), information security and AI Governance engagements for SaaS, technology and regulated organizations across Spain and Europe.

• ISO 27001 & ISMS: Gap assessments, risk management, Statement of Applicability (SoA), control implementation, evidence management and certification readiness.

• NIS2, ENS, DORA & SOC 2: Compliance assessments, control mapping, remediation roadmaps and audit preparation.

• Fractional CISO / vCISO: Cybersecurity strategy, governance, risk oversight, security roadmaps and executive reporting.

• AI Governance, ISO 42001 & EU AI Act: AI risk assessments, governance frameworks, policies, controls and regulatory readiness.

• Third-Party Risk Management: Vendor due diligence, supplier security assessments and risk remediation.

• Audit & Control Assurance: Control testing, evidence collection, findings management and continuous compliance.

• Business Continuity: Business Impact Analysis (BIA), resilience planning and security governance.

• Human Risk: Security awareness and social engineering risk management.

• Executive Advisory: Risk registers, KPIs/KRIs, management reporting and security improvement plans.

• Enterprise Due Diligence: Customer security reviews, security questionnaires and compliance evidence.
Focus on practical controls, measurable risk reduction and audit-ready governance.


SOC 2 Readiness & GRC Consultant.

Accurate Global INC

Internet & IT

10-50 team member

Supported SOC 2 readiness and cybersecurity governance activities, helping translate Trust Services Criteria into operational controls, evidence requirements and remediation actions.
• SOC 2 readiness and gap assessment.
• Control mapping and control ownership.
• Evidence requirements and audit preparation.
• Identification and remediation of control gaps.
• Risk and governance documentation.
• Support for policies, procedures and security controls.
• Coordination of audit-readiness activities with internal stakeholders.
• Preparation for Type I / Type II assurance requirements.

Cybersecurity GRC & NIS2 Advisory — Cybersecurity SaaS Client

Confidential Cybersecurity SaaS Client

Internet & IT

10-50 team member

Provided strategic cybersecurity GRC and NIS2 advisory to a cybersecurity SaaS company, supporting regulatory readiness, enterprise customer requirements and commercial positioning.

• NIS2 Compliance: Assessed governance, cybersecurity risk management, regulatory requirements and organizational readiness.

• ISO 27001 & GRC: Reviewed security controls, risk management practices and compliance requirements.
• Regulatory Strategy: Translated NIS2 and cybersecurity obligations into actionable business requirements and service capabilities.

• Enterprise Readiness: Supported customer security assessments, compliance discussions and enterprise due diligence.

• Commercial Advisory: Contributed to compliance-focused positioning, go-to-market strategies and partnership opportunities.

• Customer Journey: Reviewed enterprise security requirements, procurement considerations and customer decision points.

• Stakeholder Alignment: Collaborated with commercial and operational teams to align cybersecurity, compliance and growth objectives.

• Executive Advisory: Supported strategic decisions on governance, regulatory readiness and cybersecurity priorities.

Focus: Connecting NIS2, ISO 27001 and cybersecurity governance with enterprise customer expectations and commercial growth.

ISO 27001 & SOC 2 Readiness Consultant — SaaS Client

Confidential SaaS

Internet & IT

10-50 team member


Supported the client across ISO 27001 and SOC 2 readiness, strengthening the ISMS, control environment and audit evidence.

• Performed ISO 27001 and SOC 2 readiness and gap assessments.
• Reviewed cybersecurity risks, controls and governance requirements.
• Supported risk treatment and Statement of Applicability activities.
• Mapped controls to ISO 27001 and SOC 2 requirements.
• Defined and reviewed evidence requirements and control ownership.
• Identified control gaps and coordinated remediation actions.
• Supported preparation of policies, procedures and governance documentation.
• Prepared the organization for external assurance and audit activities.
• Improved traceability between requirements, controls, evidence and remediation.
• Worked directly with stakeholders to operationalize security and compliance controls.

Human Risk & Social Engineering Specialist

Kymatio

Internet & IT

10-50 team member

Supported organizations in assessing, managing and reducing cybersecurity risks associated with human behaviour, social engineering and employee security awareness.

• Human Risk Management: Identified behavioural cybersecurity risks, employee vulnerabilities and opportunities for risk reduction.

• Security Awareness: Supported awareness programmes designed to strengthen security culture and employee resilience.

• Phishing & Social Engineering: Contributed to simulation initiatives, risk identification and behavioural improvement.

• Risk Assessment: Analysed human-related threat exposure, security behaviours and organizational vulnerabilities.

• Metrics & Reporting: Supported human risk indicators, programme reporting and identification of improvement priorities.

• Cybersecurity Governance: Aligned human risk initiatives with organizational security policies, risk management and compliance objectives.

• Client Advisory: Supported customer-facing discussions, programme coordination and cybersecurity improvement initiatives.

Focus: Strengthening organizational cyber resilience through measurable human risk management, security awareness and behavioural risk reduction.

Portfolio

Recommendations

Contact form

Log in to get in touch

You need to be logged in to use the contact form.

Sign upLog in