Senior Cybersecurity & GRC Consultant | ISO 27001, IT Audit (CISA), NIS2/DORA, Cloud & OT

OT/IT cybersecurity, GRC, audit and assurance. Frameworks: ISA/IEC 62443, ISO/IEC 27001:2022, NIST CSF 2.0, NIST SP 800-82, SOC 2, PCI DSS, GDPR, ISO 22301, ISO/IEC 42001, NIST AI RMF, NIS2, DORA. Regional: NCA ECC, OTCC, CSCC, DCC, OSMACC, TCC, SAMA CSF, PDPL, Aramco SACS, SAEP, SAES, Shell DEP. Audit and assurance: IT audit, internal audit, ITGC and application control testing, control gap assessment, audit readiness, three lines of defence, KPI and KRI reporting, remediation roadmaps, third party risk, enterprise risk management, ISMS, OT CSMS, Statement of Applicability, policy frameworks. OT and ICS: SCADA, PLC, DCS, Purdue model, ISA-95, zone and conduit design, security level assessment. Identity: IAM, RBAC, privileged access management, OT and IT identity boundaries. Cloud and DevSecOps: AWS (EC2, VPC, S3, Lambda, IAM), CIS Benchmarks hardening, Terraform, Ansible, CloudFormation, Kubernetes and EKS hardening, network policies, CI/CD security in Jenkins and GitHub Actions, SAST, DAST, container image scanning, secrets management, cloud compliance mapping. Tools: Nessus, Tenable, Burp Suite, OWASP ZAP, Nmap, Metasploit, Splunk. Reporting: control heatmaps, dashboards and audit reports for senior management and external auditors. Sectors: oil and gas, energy, utilities, rail and transport, telecom, finance. Delivered remotely to clients in 8 countries.