Security expertise grounded in real-world delivery.
My work sits at the intersection of business, risk, security, compliance and technology. I help organizations take cybersecurity and compliance requirements — ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 27701, SOC 2 — and turn them into security programs, controls, assessments, documentation and remediation activities that actually get implemented, not just written down.
Day to day, that means leading cybersecurity delivery at OGIS Philippines: running security assessments, building out ISMS and governance structures, and helping teams get audit-ready. It also means working across adjacent areas as they intersect with security — AI governance, privacy, cloud security, and third-party risk. Earlier in my career, that same focus took shape at Accenture, leading global security assessments across hosting sites and cloud services, and at N-able, running third-party and vendor security assessments.
Alongside my current role, I take on independent consulting engagements — through Upwork and direct client relationships — supporting organizations on ISO 27001 implementation, GRC-as-a-Service, privacy compliance, and security assessments.
I start by understanding the organization's environment, objectives and actual risks before recommending controls or frameworks.
Compliance should improve security rather than simply check boxes for certification.
I work across governance, frameworks, risk management, cloud security, and hands-on implementation.
