Shahzad A.

Preparing for ISO 27001 certification or a SOC 2 audit, maintaining an existing compliance program, or looking for security leadership without a full-time CISO? I help startups, SaaS companies and growing organizations build security controls, evidence and governance their teams can operate and maintain. As a fractional vCISO for an international BPO, I built an ISMS from the ground up and managed security controls and evidence in Scrut across ISO 27001:2022, SOC 2 Type II, GDPR, HIPAA and PCI DSS. My work included more than 50 security documents, a Statement of Applicability covering all 93 Annex A controls and a risk register covering 32 assets. My user access review identified nine anomalies, including a two-factor authentication gap, and I established ongoing governance with executive reporting. I can help you with: • ISO 27001:2022 gap assessments and prioritized remediation roadmaps • SOC 2 readiness, control documentation, evidence management and audit preparation • PCI DSS, GDPR and HIPAA readiness, including gap reviews, policies, controls and evidence preparation • ISMS design, implementation and continuous improvement • Risk assessments, risk treatment and Statements of Applicability • Security policies, procedures, controls and evidence management • Internal audit preparation and certification readiness • Ongoing compliance coordination and fractional vCISO support • Security governance, executive reporting and customer security questionnaires For a new program, I start with your business, systems and existing controls, then identify what needs to be built and who will own it. For an established program, I focus on keeping evidence current, resolving gaps and preparing the team for its next audit or customer requirement. I hold a master's degree in Information Security and bring more than six years of cybersecurity consulting experience. My approach is practical: clear responsibilities, documentation that reflects how you work, and controls your team can sustain. Tell me your current stage, the audit or customer requirement you are working toward, and where you need support. I will recommend a practical starting point.