Eugene d.

As a CISSP-certified Information Security and Compliance Manager with extensive experience in cybersecurity, risk management, cloud security, and regulatory compliance, I help organizations establish, implement, and maintain effective security and compliance programs. I specialize in helping startups, growing businesses, and established organizations achieve and maintain compliance with SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, and NIST frameworks. My approach combines practical compliance management with hands-on technical expertise across AWS, Azure, GCP, DevOps, DevSecOps, CI/CD pipelines, and application security. I focus on implementing security controls that satisfy audit requirements, reduce actual business risk, and integrate naturally into existing operations. I work directly with management, engineering, IT, and external auditors to simplify compliance, address security gaps, and build sustainable security programs without unnecessary complexity or expense. SERVICES OFFERED Security Compliance & Audit Management * Lead SOC 2 Type I and Type II readiness, implementation, and ongoing compliance programs * Implement and maintain ISO 27001:2022 Information Security Management Systems (ISMS) * Support HIPAA Security Rule compliance, risk assessments, and safeguards implementation * Manage PCI DSS, GDPR, NIST CSF, and other regulatory or contractual security requirements * Coordinate external audits, evidence collection, control testing, and remediation activities * Develop and maintain security policies, procedures, risk registers, and compliance documentation * Manage ongoing compliance using platforms such as Vanta, Drata, and Secureframe * Establish sustainable compliance processes that reduce recurring audit preparation efforts Security Assessments & Risk Management * Conduct security assessments, gap analyses, and enterprise risk assessments * Identify security weaknesses across cloud infrastructure, applications, networks, and business operations * Develop risk treatment plans and prioritize remediation based on business impact * Perform vendor security assessments and third-party risk reviews * Establish vulnerability management and remediation tracking processes * Support customer security questionnaires and due diligence requests Cloud Security & Infrastructure Compliance * Assess and improve security configurations across AWS, Microsoft Azure, and Google Cloud * Implement identity and access management, least privilege, MFA, and access review processes * Evaluate cloud logging, monitoring, encryption, backup, and disaster recovery controls * Review infrastructure configurations against CIS benchmarks and industry best practices * Implement cloud security controls aligned with SOC 2, ISO 27001, HIPAA, and PCI DSS requirements * Support cloud security assessments and remediation activities DevSecOps & Secure Software Development * Integrate security controls into CI/CD pipelines using GitHub Actions, GitLab CI, and other development platforms * Implement SAST, DAST, software composition analysis, and dependency scanning * Establish secure software development lifecycle (SDLC) policies and procedures * Implement secrets management, infrastructure-as-code security, and vulnerability remediation processes * Support application security reviews and penetration testing coordination * Align engineering practices with security and compliance requirements without unnecessarily slowing development Security Operations & Incident Response * Develop and maintain incident response plans and procedures * Support security incident investigation, containment, and remediation * Establish security monitoring, alerting, and escalation processes * Implement vulnerability management and patch management programs * Develop business continuity and disaster recovery plans * Coordinate backup and recovery testing and document results for audit evidence Governance, Risk & Compliance (GRC) * Establish and maintain information security governance programs * Develop security policies, standards, procedures, and control frameworks * Conduct internal audits and management reviews * Manage risk registers, corrective actions, and compliance improvement plans * Establish security metrics, reporting, and management oversight processes * Support continuous compliance monitoring and annual certification maintenance * Coordinate compliance responsibilities across engineering, IT, HR, and business operations Endpoint, Identity & Access Management * Implement endpoint security, device management, and system hardening controls * Establish employee onboarding and offboarding security procedures * Conduct periodic user access reviews and privileged access assessments * Improve security configurations across Microsoft 365, Google Workspace, and SaaS applications * Implement MFA, conditional access, and identity security controls * Support endpoint compliance using Microsoft Intune and other MDM solutions