GRC advisory
Governance, risk and compliance
Audits go better when the evidence is already in order. I help you meet ISO/IEC 27001 and your regulator's requirements with a plan your team can actually deliver.
Scope
What it involves.
- Information system audits against your regulator's and your own requirements
- ISO/IEC 27001 gap assessments and audit readiness
- A security roadmap tied to business risk, not to a tool list
- Policies and controls people can actually follow
When to call
When teams ask for it.
- An audit or certification deadline is approaching
- Security spending is hard to justify to the board
- Controls exist on paper but nobody knows if they work
Outcome
What you have at the end.
A defensible position for auditors and a prioritised plan for the team that has to deliver it.
Usually for: Regulated institutions, public bodies and growing companies
Proof
Work and credentials behind it.
Other services
Other ways I can help.
- Penetration testingWeb, API, mobile, network and cloud testing from an attacker's point of view.
- Security operationsDetection engineering, SIEM, incident handling and malware analysis.
- Agentic AI securitySecuring AI agents and LLM features, and automating the security work itself.
- Training and speakingSecurity awareness, technical workshops and conference talks.
Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.