Cybersecurity, compliance & riskControls · evidence · defensibility
Cybersecurity, compliance & risk
Cybersecurity governance in high-trust environments depends on evidence-led control design, defensible assurance, and alignment between security architecture, operations, and oversight.
Representative KPI signals
15+Security and governance frameworks implemented
Multi-domainIAM / PAM integration patterns
Zero-trustSegmentation patterns for regulated environments
ImprovedAudit defensibility through evidenced controls
Positioning
This domain demonstrates how control evidence, architecture discipline, and audit readiness strengthen institutional resilience in complex environments.
Representative scope
- Policy-to-control alignment and governance traceability
- IAM, PAM, segmentation and access governance
- Risk, compliance and assurance coordination
- Security support for digital transformation and mission-critical services
Operational signals
- Security frameworks aligned with complex institutional constraints
- Identity-centric control patterns across multiple trust zones
- Risk visibility supported by decision records and evidence packs
- Cross-domain governance that strengthens audit and review readiness
Typical deliverables
- Security governance frameworks and control matrices
- IAM / PAM integration patterns and assurance views
- Audit support packs and evidence-led control documentation
- Risk dashboards, review packs and compliance briefings
Sector applicability
- Defence and security contexts
- International organizations
- Regulated industries
- Cloud and hybrid infrastructure programs
Impact in numbers
Figures as recorded on named engagements — each one is listed on the Projects page.
100%
audit compliance — cyber-security audit of DCS, SCADA, PLC and RTU per NRC, NEI and NISTCernavoda Nuclear Power Plant · 2013 – 2015
89%
of 120+ audit recommendations closed; multi-tier security across 300 servers and 350+ applicationsBRD — Groupe Société Générale · 2011 – 2013
−35%
ISO 27001 / PCI DSS / GDPR / SOC 2 audit findings within one yearUN HQ / OICT · 2016 – 2019
up to −58%
MTTR across Palo Alto, CyberArk, CrowdStrike, DLP and SIEM platformsPIR2-IT · 2024 – Present
How I approach it
- Tie risk to services. A risk register built on business services and critical assets, each with a named owner.
- Map obligations once. ISO 27001, NIST 800-53, PCI DSS, GDPR, DORA and NIS2 mapped to one control set.
- Engineer the controls. Architecture changes, not policy documents alone.
- Detect and respond. SIEM / SOAR playbooks and a cyber-crisis process exercised with executives.
- Keep evidence current. Evidence packs refreshed continuously, so audits stop being projects.
- Report in board language. Risk appetite, key risk indicators and trend — not tool counts.
Where it was applied
- Groupe Société Générale · 2013 – 2015Cernavoda NPP — cyber-security audit and service-management restructuring; 100% audit compliance.
- BRD — Groupe Société Générale · 2011 – 2013Cyber-security architecture and audit remediation; business-continuity plan; +27% data-centre efficiency.
- Innovation Center · 2019 – 2022IT audits and security assessments for banks and multinationals; Cyber Crisis Management programme; CyberPro AI security platform.
- IBM · 2008 – 2011National cyber security for the Romanian Ministry of Internal Affairs (ISO 2700x, NIST).
- UN HQ / OICT · 2016 – 2019Zero Trust and awareness programme — −35% audit findings in one year.
Where programmes usually go wrong
- Compliance managed in spreadsheets, disconnected from the architecture.
- Findings closed on paper while the weakness stays in production.
- Crisis plans written but never rehearsed with the people who decide.
- Third-party and supplier risk outside the risk register.
- Security reported as tools deployed rather than risk reduced.
Questions worth asking before you fund it
- Which five risks would stop a critical service, and who owns each one?
- How old is the oldest open audit finding?
- When did executives last take part in a cyber-crisis exercise?
- Can you produce evidence for any key control within 24 hours?