Hire the Best Enterprise Risk Management Professionals

Information Security & GRC Specialist | Cybersecurity Product Manager | Risk & Compliance Consultant I am an experienced Cybersecurity and GRC professional with a proven track record in designing, implementing, and managing security frameworks, compliance programs, and risk management strategies across public and private sectors. With a strong technical foundation and a Master’s degree in Information Security, I bridge the gap between governance, compliance, and hands-on technical security. What I Offer: ✅ Governance, Risk & Compliance (GRC): Policy, procedure, and control development aligned with ISO, NIST, SOC2, GDPR, PCI-DSS, Cyber Essentails, Essential 8, NZISM, NCA, SAMA, etc. Internal audits, control testing, and evidence collection for compliance readiness Risk assessments, vendor due diligence, and enterprise risk register management Awareness training programs development ✅ Cybersecurity Consulting & Technical Expertise: Vulnerability assessment & penetration testing (Metasploit, Nessus, BurpSuite) Security operations & monitoring (SIEM, IDS/IPS, NGFW, WAF) Cloud security (AWS, Azure) and virtual environments (VMware, vSphere) Malware analysis, intrusion detection, and incident response ✅ Product Management for GRC Platforms: Lead product roadmaps for compliance, risk, vendor, and policy management modules SME in embedding international best practices (ISO 27001, NIST, COSO, etc.) into product features Experience working closely with developers, QA teams, and stakeholders to deliver secure, user-friendly, and compliance-driven platforms Skilled in customer-facing demos, stakeholder engagement, and executive-level presentations Certifications & Credentials: Certified Information Security Manager CISM - ISACA ISO/IEC 27001 Lead Implementer – PECB International Certificate in Enterprise Risk Management – IRM UK Certified in Cyber Security (CC) – (ISC)² GRC Professional – OneTrust HCIA Security – Huawei | CCNA Security – Cisco Plus certifications in Threat Intelligence, Python, and Network/Endpoint Security Why Work With Me? I combine strategic GRC expertise with deep technical cybersecurity knowledge—rare in the industry. Whether you need end-to-end compliance implementation, risk assessments, vendor security reviews, or product strategy for GRC and cyber security platforms, I can deliver with professionalism, accuracy, and a solutions-focused mindset. Let’s work together to strengthen your organization’s security posture, streamline compliance, and build trust with stakeholders.

I am a CAMS-certified AML/KYC specialist and Merkle Science Certified Crypto Investigator (CCI) with 12+ years of experience across Big4 advisory, regulatory audits and hands-on AML/CFT program implementation for banks, NBFCs, fintechs, DNFBPs, VASPs and MSBs. I help organisations design and strengthen AML/CFT frameworks that stand up to regulatory inspections, audits and institutional due diligence, particularly across environments aligned with FATF standards. My core experience is built primarily in India and the UAE (RBI, SEBI, FIU-IND, CBUAE) and I support global clients by applying FATF-aligned methodologies across jurisdictions including the US, UK, EU, Canada and Australia. I focus on practical, regulator-aligned solutions - not theoretical frameworks. Clients I have worked with have achieved clean regulatory reviews, passed institutional due diligence audits and successfully completed FIU registrations across multiple jurisdictions. I have supported clients in: - Helped clients reduce identified compliance gaps by 30-40% through structured gap assessments and remediation programs - Preparing for regulatory inspections and audits - Strengthening KYC, transaction monitoring and sanctions frameworks - Building AML programs from the ground up When Clients Engage Me - Conducting independent AML reviews and preparing for regulatory inspections. - Setting up AML compliance for fintechs, MSBs or crypto exchanges. - Fixing weaknesses in KYC, EDD or transaction monitoring systems. - Responding to audit findings or investor due diligence. - Building AML frameworks for new or scaling regulated businesses. Core AML/KYC Compliance Services AML/CFT Programs & Risk Management - AML/CFT program design and implementation (FATF-aligned). - AML risk assessments, gap analysis and remediation planning. - Policy, procedure & SOP drafting tailored to regulatory environments. - Fractional / Interim Compliance Officer support. KYC / EDD / Sanctions Screening - KYC / KYB / CDD / EDD framework design. - Sanctions & PEP screening - OFAC/SDN, UN, EU, UK HMT. - Transaction monitoring program design and optimisation. - SAR / STR reporting frameworks. - Wolfsberg CBDDQ & correspondent banking due diligence. - OSINT-based investigations (UBO, directors, entities). Audit, Reporting & Regulatory Support - Independent AML/CFT audits and compliance testing. - FIU registration consulting (FIU-IND, MSB frameworks, advisory support globally). - Regulatory reporting reviews (SAR/STR, CTR, record-keeping). - Multi-jurisdiction AML advisory using FATF methodology. - Institutional investor AML due diligence support. Emerging & Digital Asset Compliance - AML frameworks for crypto exchanges and VASPs (FATF Rec. 15 aligned). - FIU-IND VDA SP registration advisory. - Travel Rule compliance gap assessments (FATF Rec. 16). - KYC / EDD frameworks for high-risk digital asset clients. Why Clients Choose Me - CAMS-certified AML specialist with Big4 foundation. - Deep financial crimes compliance experience + global applicability. - Strong expertise across banking and fintech environments, with a growing practice in crypto/VASP compliance. - Practical, audit-ready deliverables aligned with regulatory expectations. - Clear scoping, transparent communication and reliable execution. Frequently Asked Questions (FAQs) Q: Can you support clients across the globe? Yes. I apply FATF-aligned AML frameworks globally and adapt them to jurisdiction-specific requirements. Where needed, I work alongside local legal/regulatory experts. Q: What does an AML audit include? A full operational audit covers AML governance, KYC/CDD/EDD, sanctions screening, transaction monitoring, SAR/STR reporting, record-keeping, training and internal controls - with a structured remediation plan. Q: Do you support crypto and VASP compliance? Yes. I support AML framework design, VDA SP registration, FATF Rec. 15 compliance and Travel Rule readiness for crypto businesses. Q: What deliverables can I expect? AML policies, risk assessments, audit reports, KYC frameworks, SAR/STR templates, training materials and regulatory documentation. Core Skills: AML compliance consultant | KYC expert | CAMS certified | Financial crime compliance | FATF compliance | OFAC sanctions | FinCEN AML | MSB compliance | Crypto AML consultant | Transaction monitoring | SAR reporting | EDD | KYB | Compliance officer | AML audit | FIU registration | Fintech compliance | Blockchain AML | Regulatory compliance | RBI compliance | CBUAE compliance | AML program review | Compliance gap assessment | VASP AML | VDA SP compliance | Beneficial ownership | Wolfsberg Group | AML/CFT framework | Virtual asset compliance | Digital asset AML Looking for a compliance partner who delivers practical, regulator-ready solutions with integrity? Invite me to your project or send a message. I respond within 24 hours with a clear, honest assessment of how I can help!

Stop letting compliance block your enterprise sales deals. You have built a great product, but your biggest prospects enterprises, healthcare providers, and banks won't sign the contract until they see your ISO 27001 certificate or SOC 2 Type II report. You don't need a checklist or a template library. You need a strategic partner who can fast-track your audit readiness so you can focus on closing deals. I am a Fractional CISO and Lead Auditor specializing in turning compliance into a competitive advantage for high-growth startups and established enterprises. I don't just "write policies"; I architect the security infrastructure that builds trust with your customers. 🚀 THE "AUDIT-READY" BLUEPRINT I integrate seamlessly with your team (Slack/Teams) to deliver: SOC 2 & ISO 27001 Readiness: From Gap Analysis to Final Audit in 12-16 weeks. Automated Compliance (Vanta/Drata): I configure your Vanta, Drata, or Secureframe instance to automate 80% of evidence collection, saving your engineers hundreds of hours. AI Governance (ISO 42001): Future-proof your AI products against the EU AI Act and NIST AI RMF. Vendor Risk Management: I handle those 100-question security questionnaires from your clients so you don't have to. 🏆 WHY CLIENTS HIRE ME 100% Audit Pass Rate: I have guided 50+ companies through successful external audits. Commercial Focus: I prioritize controls that unblock revenue without slowing down your dev team. Certified Expert: Lead Auditor for ISO 9001, 27001, 14001, 45001. 🛠 TECH STACK Governance: Vanta, Drata, Sprinto, Secureframe. Cloud: AWS, Azure, Google Cloud (GCP). Frameworks: ISO 27001:2022, SOC 2 Type I & II, HIPAA, GDPR, ISO 42001 (AI). 🗣 WHAT CLIENTS SAY "Heena didn't just get us certified; she helped us close a $2M deal with a Fortune 500 bank by handling the security diligence personally." — CEO, FinTech Series B Next Step: If you have an audit deadline approaching or a sales deal stuck in security review, click the "Invite" button. Let's get you audit-ready.

I help banks, fintechs, and regulated companies prepare for DORA, ISO 27001, GDPR, and cybersecurity audits by turning regulatory requirements into practical controls, risk registers, policies, and evidence that stand up to scrutiny. My core expertise includes DORA gap assessments, ICT risk management, cyber resilience, operational resilience, ISO 27001 implementation, GRC program design, regulatory compliance, third-party risk management, ITGC testing, risk assessments, and audit readiness. At Bank of Valletta, I led a multi-department DORA gap audit across IT, operations, and payments, mapped EU DORA RTS obligations to controls, tracked remediation, and presented mitigation roadmaps to the Board. I also standardized 45+ corporate policies across ISO 27001, DORA, and GDPR control environments. I built a GRC program from scratch for Ellipse Advisory Group, including the control framework, risk management cycle, internal audit processes, risk dashboards, and policy library aligned with ISO 27001 and NIST CSF. I can help with: - DORA gap assessments and remediation roadmaps - ICT risk and operational resilience frameworks - ISO 27001 gap assessments and implementation support - GRC program design and control mapping - Risk registers and risk assessment workshops - Information security policies and procedures - Third-party and vendor risk assessments - ITGC testing and audit evidence preparation - Board-ready risk reporting - AI governance, EU AI Act, ISO 42001, and NIST AI RMF You will receive clear deliverables, practical recommendations, and documentation your team can use with auditors, regulators, senior management, and vendors. If you need a defensible compliance program rather than generic templates, send me a message with your framework, deadline, and current challenge.

I build compliance management systems that hold up at audit and that teams actually use. I am a certified ISO/IEC 27001:2022 Lead Auditor with over 14 years inside accredited management systems, currently leading national operations and integrated compliance at a NATA-accredited inspection and engineering firm across ISO 9001, 45001, 17020 and 17025. In 2026 I founded Wellfound (wellfound.au), a compliance documentation consultancy for technology and SaaS companies, NDIS providers and registered training organisations. We build the management system you take to certification: ISO 27001, ISO 9001, NDIS Practice Standards or Standards for RTOs 2025. Audit-ready, version-controlled, fixed price, six weeks. What sets the work apart is that it is built from the operator side, not the audit side. I have run the system, sat in the surveillance hot seat and closed the corrective action. That perspective sits in every document we deliver. If your next audit is on the calendar and the documentation is not, let's talk.

Your AI initiatives are accelerating. Regulatory expectations are rising. Audits are becoming more demanding. I help organisations operationalise AI governance, technology risk, and enterprise GRC so governance becomes an enabler of business not a last-minute compliance exercise. Over the past 13+ years, I've worked across PwC, Wells Fargo, JP Morgan Chase, and Viatris, designing governance frameworks, leading technology risk assessments, strengthening audit readiness, and building operational risk programs for regulated organisations. Selected highlights 300+ business-critical applications assessed through enterprise control testing 230+ third-party vendors governed across the complete TPRM lifecycle 35% reduction in residual risk through structured remediation and governance improvements Core advisory services Operational AI Governance AI governance readiness assessments NIST AI RMF implementation EU AI Act readiness AI governance operating models AI risk and control frameworks Technology Risk & Enterprise GRC Enterprise control testing Technology risk assessments Risk and control design Governance operating models Executive risk reporting Audit Readiness ISO 27001 SOC 2 PCI DSS Evidence management Control remediation Audit-ready documentation Third-Party Risk Management Vendor risk frameworks Inherent risk assessments Due diligence Continuous monitoring Lifecycle governance My approach focuses on translating governance frameworks into practical operating models with clear ownership, decision accountability, and audit-ready evidence not simply producing policies that sit on a shelf. Alongside my advisory work, I publish independent research through AIforUI, covering operational AI governance, technology risk, and governance implementation for regulated organisations. I work with organisations globally and welcome engagements ranging from governance assessments and audit readiness to longer-term advisory and transformation programmes.