A seasoned GRC and compliance leader with deep expertise driving enterprise audit programs across SOX, PCI DSS, TIPSA, SOC 1/SOC 2, and emerging regulatory frameworks including self taught DORA, NIST AI RMF, ISO/IEC 42001, and the EU AI Act. Known for strengthening governance across cloud and on‑prem environments, enhancing cloud compliance through automation platform, and unifying control frameworks to reduce audit fatigue and accelerate readiness. Adept at managing the full lifecycle of issues remediation, partnering with cross‑functional leaders, and delivering scalable, efficient compliance operations using GRC platforms. Recognized for strategic thinking, strong execution, and the ability to elevate organizational control maturity while aligning technology, security, and financial reporting objectives. Key Accomplishments: Directed critical, full-cycle audits (SOX, PCI DSS, TIPSA), successfully. Achieved a 100% on-time audit closure rate by meticulously managing and tracking remediation activities in GRC tools. Strengthened cloud governance by implementing GCP compliance.. Planned, led, and executed the full lifecycle of SOX 404 ITGC and automated application control testing, ensuring appropriate control scope and effective mitigation of key financial reporting risks across all key financial applications (KFAs). Served as the primary liaison between IT, Finance, and Internal/External Audit, aligning SOX scope, testing schedules, walkthroughs, and documentation requirements across the enterprise. Oversaw timely and accurate execution of IT control activities, including user access reviews, change management, SDLC controls, and backup/recovery procedures, ensuring control owners maintained complete and compliant documentation. Maintained comprehensive SOX documentation in Workiva, including RACMs, process flows, system diagrams, narratives, and control procedures. Coordinated with Internal Audit and Big Four external auditors on testing, walkthroughs, and evidence requests, ensuring reliance on management testing where appropriate. Monitored IT test results and selfassessments to identify design and operating deficiencies; led root cause analysis, corrective action planning, and validation of remediation effectiveness. Provided subjectmatter expertise on IT control design for new systems, upgrades, and process changes, ensuring strong ITGC and application control coverage from the start. Trained and coached control owners on SOX requirements, ITGC best practices, documentation standards, and audit readiness expectations. Identified opportunities to streamline and automate IT controls, enhance monitoring, and strengthen governance practices across KFAs and supporting systems. Developed and delivered executivelevel reporting on SOX program status, testing progress, issues, and remediation activities, ensuring transparency and timely escalation. Promoted a culture of integrity, accountability, and collaboration, strengthening relationships across IT, Finance, Audit, and business teams. SOX 404 Expertise: Deep understanding of ITGCs (access, change management, operations, backup/recovery) and IT risk management principles. Audit Partnership: Experienced in working with Big Four firms on walkthroughs, testing, and control assessments. Analytical & ProblemSolving: Skilled at evaluating IT risks, identifying deficiencies, and developing practical remediation plans. Assisted the enterprise GRC program, ensuring alignment across SOX, PCI DSS, TIPS/A, privacy, and IT risk frameworks while driving a unified control strategy across business and technology teams. Built and matured governance structures, including steering committees, control owner forums, and cross functional working groups to strengthen accountability and oversight. Established enterprise wide compliance roadmaps, KPIs, and risk dashboards to provide leadership with clear visibility into control health, audit readiness, and emerging risks. Championed a culture of compliance by developing training programs, communication plans, and awareness campaigns that elevated organizational understanding of ITGC and regulatory obligations.

Supported IT audit efforts, authored internal control documentation, and coordinated with auditors. Improved reporting efficiency and integrated audits into GRC frameworks to enhance overall posture. Key Accomplishments: Authored audit reports, including SSPs, SARs, and ConMon plans, ensuring compliance accuracy. Enhanced reporting accuracy with weekly security updates for informed leadership decision-making. Supported executives in resolving legal and consumer issues, ensuring prompt, compliant resolutions. Automated GRC workflows to streamline control testing, reduce manual effort, and improve reporting. Directed SOC 1 and SOX control testing to confirm regulatory compliance and documentation standards. Led compliance planning and system integration for Mergers & Acquisitions (M&A), ensuring seamless, risk-mitigated transitions and uninterrupted adherence to all regulatory requirements. Conducted AI Privacy Impact Assessments (AI-PIAs) in alignment with GDPR, CCPA/CPRA, and global privacy standards. Built data-handling requirements for LLMs, including retention limits, redaction pipelines, and secure fine-tuning safeguards. Provided expert regulatory counsel on complex global privacy policies and laws, partnering with Legal to maintain strict adherence to frameworks including GDPR, CCPA, HIPAA, and APAC regulations. Developed AI risk registers and control matrices for machine-learning and LLM-based applications. Partnered with engineering/data science teams to define AI control objectives, including model lifecycle management and guardrails. Achieved a 100% on-time audit closure rate by meticulously managing and tracking remediation activities in GRC tools. Strengthened cloud governance by implementing AWS compliance automation leveraging Jupiter One Reinforced network security by addressing vulnerabilities across NAC, antivirus, firewall, and DLP systems. Conducted control testing across frameworks, identifying weaknesses and driving timely corrective actions. Standardized security procedures to improve consistency, accountability, and efficiency across all operations. Integrated audits into GRC systems, aligning controls and improving compliance readiness organization-wide. Managed vendor risk assessments and monitoring to ensure compliance and minimize external security threats. Collaborated with auditors to maintain compliance, accurate documentation, and transparent internal review processes. Provided expert regulatory counsel on complex global privacy policies and laws, partnering with Legal to maintain strict adherence to frameworks including GDPR, CCPA, HIPAA, and APAC regulations. Partnered with engineering/data science teams to define AI control objectives, including model lifecycle management and guardrails. Achieved a 100% on-time audit closure rate by meticulously managing and tracking remediation activities in GRC tools. Strengthened cloud governance by implementing AWS compliance automation leveraging Jupiter One.

Designed and executed IT compliance testing across ITIL, COBIT, ISO, SOC 1, SOC 2, and Data Privacy. Implemented vendor risk management to reduce regulatory, reputational, and cybersecurity risks. Conducted security risk assessments and recommended system and network improvements for stronger protection. Worked with IT teams, vendors, and departments to coordinate and maintain compliance efforts. Reviewed IT policies against NIST, ITIL, and ISO to strengthen compliance and control standards. Key Accomplishments: Managed migration and setup of GRC tools, ensuring accurate data transfer and integration. Coordinated project activities to streamline timelines and ensure completion of all critical tasks. Managed project costs through accurate tracking systems, reducing errors and improving financial control. Conducted inspections to identify deficiencies and enforce corrective actions for full regulatory compliance. Customized tool workflows to automate compliance tasks and improve reporting accuracy and audit readiness. Directed end-to-end GRC audit cycles, including readiness and successful remediation, for major frameworks (ISO 27001, SOC 1, SOC 2), ensuring continuous certification maintenance. Spearheaded the design and deployment of a Third-Party Risk Management (TPRM) program, significantly improving vendor due diligence and establishing continuous monitoring of third-party compliance and security posture. Strengthened the internal control environment by directing comprehensive IT General Controls (ITGC) testing and validation across access management, provisioning, terminations, and change management processes. Streamlined compliance workflows by leveraging GRC platforms (RSA Archer, ServiceNow), conducting detailed gap analysis that significantly reduced manual effort and improved operational efficiency. Performed comprehensive ITGC control testing across access management, change management, IT operations, and system development processes, validating control design and operating effectiveness for State Farm’s SOX and internal audit programs. Executed walkthroughs, evidence reviews, and sampling procedures to assess compliance with established policies and regulatory requirements, documenting results with clarity and audit‑ready precision. I identified control gaps and collaborated with control owners to clarify requirements, strengthen documentation, and support timely remediation of deficiencies. Supported audit readiness by maintaining organized evidence repositories, preparing testing workpapers, and partnering with internal audit teams to ensure transparency and alignment throughout the testing cycle.

Oversaw subcontractor costs and payments, ensuring contract compliance and accurate financial tracking. Supervised construction crews to ensure adherence to specifications, codes, and safety standards. Prepared and submitted budget estimates and progress reports, maintaining financial transparency and accountability. Key Accomplishments: Inspected projects to identify deficiencies and enforced corrective actions to meet standards. Coordinated project activities to streamline timelines, ensuring timely completion of critical tasks. Supervised and trained teams in welding and estimating, improving productivity and output quality. Managed project costs through effective tracking systems, reducing errors and improving financial accuracy. Evaluated construction methods using digital tools, increasing efficiency and overall project cost-effectiveness.