Dmytro Y.

𝗜 𝗴𝗲𝘁 𝗰𝗼𝗺𝗽𝗮𝗻𝗶𝗲𝘀 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝘁𝗵𝗲𝗶𝗿 𝗜𝗦𝗢 𝟮𝟳𝟬𝟬𝟭, 𝗦𝗢𝗖 𝟮 & 𝗣𝗖𝗜 𝗗𝗦𝗦 𝗮𝘂𝗱𝗶𝘁𝘀 𝗰𝗲𝗿𝘁𝗶𝗳𝗶𝗲𝗱, 𝗮𝗻𝗱 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝘀𝗲𝗰𝘂𝗿𝗲. I'm an ISO 27001 Lead Auditor with 10 years in security and compliance and 50+ audits behind me. I've been the auditor who signs off, and the implementer who builds the system from zero — so I know what gets you through Stage 1 and Stage 2, and what an assessor will challenge. A customer, investor, or regulator asked you for the certification, and you need it done without stalling the business or drowning in meetings. That's where I come in. Most consultants do compliance OR technical testing. I do both. You get an ISMS that passes the audit and infrastructure that's actually secure, not just documented. What I help with: 🔐 Certification readiness I take companies from no management system at all to a certificate — ISO 27001, SOC 2, PCI DSS or ISO 42001. I run the readiness review, collect and structure the evidence, handle the certification body, and sit with you through Stage 1 and Stage 2 until the report is signed. I've done this for four 100+ person companies, three of them regulated fintech entities. 📋 Building the system that passes I build the ISMS itself: gap assessment against the standard, risk assessment and treatment plan, Statement of Applicability, and the full policy and procedure set written for your team rather than copied from a template. I also stand up the controls assessors test in practice — internal audit, management review, vulnerability management and access reviews — and run the internal audit before the certification body does. You end up with a system that generates its own evidence as it runs. 🛡️ Penetration testing Web and API testing against OWASP methodology, with manual exploitation. You get findings ranked by real business impact, clear reproduction steps, and a remediation call with your developers, plus free retesting once the fixes land. It also doubles as evidence for ISO 27001 A.8.8 and SOC 2, so one engagement covers two needs. Frameworks: ISO 27001, SOC 2, PCI DSS, ISO 42001, EU AI Act, NIST AI RMF, GDPR, DORA, NIS2, CCSS, VARA, CBUAE, NIST CSF, NIST 800-53 / 800-171. Industries: SaaS, fintech, payments, crypto / Web3, startups. Certifications: CISM, ISO/IEC 27001 Lead Auditor, Lead SOC 2 Analyst (PECB), CCSSA, Practical Ethical Hacker. Message me with your case. After a short call you get a clear scope of work with pricing.