Hameed U.

Upwork Top Rated · 100% Job Success · CISM Certified · 10 Years Experience I help SaaS and cloud-native companies reach audit-ready status for SOC 2, ISO 27001, ISO 42001 and GDPR — on schedule, without disrupting your product roadmap or slowing down your sales cycle. I have led compliance programmes across the full lifecycle — from initial gap assessment and policy design through to auditor coordination and surveillance audit preparation. My engagements cover every department that auditors touch: IT, HR, Legal, Finance, DevOps, and Procurement — so nothing falls through the cracks and you walk into audit day confident. ━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT I DELIVER ━━━━━━━━━━━━━━━━━━━━━━━━━━━ ▸ SOC 2 Type I & II Readiness Full gap assessment, control mapping, policy library, and auditor coordination — from kickoff to clean audit report. ▸ ISO 27001 Certification & Surveillance Support ISMS design and implementation, Statement of Applicability, risk register, internal audit programme, and evidence preparation for certification and surveillance audits. ▸ GDPR Compliance Data mapping, Records of Processing Activities (RoPA), DPIAs, privacy notices, Data Processing Agreements, and breach notification procedures. ▸ AI Governance & ISO 42001 Emerging framework — policy design and readiness assessments for organisations integrating AI into their products and workflows. ▸ Security Policy Library 30+ audit-ready policies written in plain language — policies your engineers will actually read and follow, not 40-page documents that sit on a shelf. ▸ Vendor & Third-Party Risk Management Supplier security assessments, due diligence questionnaires, contract security clauses, and ongoing monitoring frameworks. ▸ Audit Coordination & Evidence Management I act as your single point of contact with external auditors — managing evidence requests, Information Request Lists (IRLs), and auditor communications so your team can stay focused on the product. ━━━━━━━━━━━━━━━━━━━━━━━━━━━ FRAMEWORKS & STANDARDS ━━━━━━━━━━━━━━━━━━━━━━━━━━━ SOC 2 · ISO 27001:2022 · GDPR · PCI DSS · NIST CSF · ISO 42001 · HIPAA · CIS Controls ISO 9001 · ISO 20000-1 ━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHY CLIENTS CHOOSE ME ━━━━━━━━━━━━━━━━━━━━━━━━━━━ ✔ I understand your stack before you explain it I work exclusively with SaaS and cloud-native teams on AWS, GCP, and Azure. I speak the language of your engineers, not just your auditors. ✔ I write policies people actually follow Every policy I deliver is proportionate, readable, and built around your actual workflows — not copied from a template library. ✔ I cover the full scope — not just one layer Most consultants focus on IT controls. I work across HR, Legal, Finance, DevOps, and Procurement — the departments auditors always reach into and that always catch companies off guard. ✔ I have coordinated with major audit firms I have prepared evidence packages and managed IRL submissions for surveillance and certification audits coordinated with firms including - so I know exactly what auditors look for and what they push back on. ✔ I deliver structure, not just advice Every engagement produces working artefacts: trackers, dashboards, policy documents, risk registers, and roadmaps — not slide decks with recommendations you have to figure out how to implement. ━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHO I WORK WITH ━━━━━━━━━━━━━━━━━━━━━━━━━━━ I work primarily with SaaS companies preparing for their first SOC 2 or ISO 27001 audit, and with established companies managing surveillance audits or expanding their compliance scope into GDPR or AI governance. Typical client profile: → 20–300 employees → Cloud-native infrastructure (AWS / GCP / Azure) → Small or no internal security team → Facing an enterprise customer security review or upcoming audit → Compliance is blocking a deal or a funding round