Engineering automated assurance and resilient governance across global borders.
Bridging cross-border regulatory strategy with technical GRC engineering in international financial services. At Zepz, I design unified control baselines, continuous compliance workflows, and supply chain risk frameworks across 10+ regulatory regimes. This transitions organisations from periodic manual audits to continuous, telemetry-backed assurance.
About
Where regulatory intelligence meets systems engineering.
Modern compliance cannot scale on static spreadsheets and manual checklists alone. Operating within high-velocity international FinTech at Zepz, my work sits at the intersection of Regulatory Strategy and GRC Engineering—aligning third-party risk, operational resilience, and audit readiness with automated evidence pipelines and continuous control monitoring.
A Postgraduate Certificate in Cyber Security from Harvard University and a Distinction-graded International Master's in Security, Intelligence and Strategic Studies—combined with hands-on IT and computer science teaching foundations—underpin a rigorous, analytical approach to governance. Having distilled complex software architectures for students and engineered enterprise controls alike, I evaluate technical risk accurately, translate statutory mandates into engineering requirements, and build controls that hold under scrutiny from engineering teams to the Boardroom.
Regulatory
Translating global mandates into unified controls.
Rather than treating every regulation as an isolated silo, overlapping statutory mandates across global jurisdictions are mapped into unified control baselines — a single "test-once, comply-many" engineering standard.
- ISO/IEC 27001 & 27002
- NIST CSF 2.0 & 800-53
- SOC 2 (Type I & II)
- PCI-DSS v4.0
- CIS Controls
- EU DORA & NIS2
- FCA / PRA Operational Resilience
- EU AI Act
- ISO/IEC 42001 (AI)
- ISO 22301 (BCMS)
- UK & EU GDPR
- US State Privacy (CCPA/CPRA)
- DPIA & RoPA Lifecycle
- Cross-Border Data Transfers
- NYDFS (23 NYCRR 500)
- EBA Outsourcing Guidelines
- PSD2 / PSR / EMR
- SWIFT CSP
- APAC & Americas (RMiT, RPAA, BAC)
Case Studies
GRC delivery in action.
Eliminating manual compliance toil through agentic workflows
Replaced static spreadsheet tracking with automated, API-driven compliance workflows and multi-agent AI architectures. Built custom orchestration pipelines that ingest security telemetry, automate initial vendor questionnaire triage, and map technical evidence directly to control frameworks in real time.
Harmonising DORA and global frameworks across 10+ regimes
Spearheaded cross-functional resilience programmes across Engineering, Legal, and Operations to align business continuity and disaster recovery (BCP/DR) with strict international mandates. Engineered a "test-once, comply-many" unified control matrix bridging DORA, NYCRR 500, RMiT, and NIST CSF.
Securing the global payment supply chain at scale
Overhauled end-to-end third-party risk management (TPRM) for critical payment rails, banking partners, and cloud infrastructure providers. Designed quantitative inherent-to-residual risk scoring models, streamlined due diligence triage, and embedded strict security SLAs into vendor contracts.
Driving zero-finding audits and metric-led governance
Directed end-to-end internal and external audit cycles alongside formal regulatory examinations across multiple financial jurisdictions. Replaced reactive, last-minute evidence scrambles with structured assurance repositories, defensible control narratives, and executive risk appetite dashboards.
Areas of Expertise
Strategic capabilities.
Third-Party & Supply Chain Risk
End-to-end vendor risk lifecycle governance across critical payment rails, banking partners, and cloud infrastructure. Structuring inherent-to-residual risk scoring, technical due diligence triage, concentration risk tracking, and contractual security SLAs.
Internal Controls & GRC Engineering
Architecting unified "test-once, comply-many" control baselines and replacing manual compliance toil with automated, API-driven evidence pipelines, agentic triage workflows, and continuous control monitoring (CCM).
Operational Resilience & Continuity
Designing and executing enterprise resilience, AI governance, and business continuity and disaster recovery (BCP/DR) programmes across global operations. Conducting statutory gap analyses, regulatory horizon scanning, and embedding compliance-by-design into product workflows.
Audit Assurance & Board Governance
Steering internal and external audit cycles alongside formal regulatory examinations. Building defensible assurance repositories, maintaining enterprise policy lifecycles, and translating technical telemetry into executive KRI and risk appetite dashboards.
Technology stack.
Automation & AI Stack
Model Context Protocol (MCP) · Multi-Agent Orchestration · Python & JavaScript · REST APIs & Webhooks
Cloud & Infrastructure
Google Cloud Run · Docker Containers · Cloudflare Edge Routing · GitHub Actions CI/CD
GRC & Telemetry Tooling
Continuous Control Monitoring (CCM) · Jira / Slack Workflows · OSCAL Schema Validation
Experience
Professional experience in information security and technology.
- Executed comprehensive third-party risk management (TPRM) and supply chain evaluations across global payment partners, establishing inherent-to-residual risk models and enforcing contractual security SLAs.
- Architected and deployed agentic GRC workflows and custom API integrations, utilizing orchestrator and worker models to automate internal control monitoring and evidence collection.
- Steered cross-border regulatory harmonisation across 10+ jurisdictions, aligning international financial mandates with internal operational resilience frameworks, Business Continuity Plans (BCP), and Disaster Recovery (DR) strategies.
- Translated complex regulatory mandates into accessible technical requirements for engineering, legal, and operations teams, embedding "compliance-by-design" into product lifecycles and daily operations.
- Directed end-to-end internal and external audit cycles and regulatory examinations, replacing reactive evidence gathering with continuous, telemetry-backed assurance repositories.
- Refreshed enterprise policy and procedure lifecycles, ensuring ongoing organisational adherence and defensible control narratives.
- Supported cross-border payment operations connecting to multiple international banking and payment partners.
- Contributed to board-level risk reporting on control effectiveness, executive KRI dashboards, risk appetite, and remediation velocity.
- Distilled complex computer science and software engineering principles into accessible, structured curricula for students aged 11 to 18, developing the pedagogical frameworks necessary to communicate highly technical concepts clearly.
- Designed and implemented continuous assessment metrics to track subject knowledge progression against strict internal and national standards, adapting delivery methods to bridge knowledge gaps.
- Completed rotational placements across multiple corporate IT service departments, supporting enterprise infrastructure and security governance.
- Executed a large-scale post-acquisition network integration in Canada, securely provisioning hundreds of users while maintaining strict corporate security baselines.
- Managed the end-to-end migration and deployment of a new enterprise content management system for the corporate website, ensuring data integrity and system availability throughout the transition.
- Defined functional and non-functional engineering requirements for upcoming enterprise IT initiatives, ensuring security baselines were embedded directly into technical solutions from day one.
- Operated within high-pressure environments across the United Kingdom, specializing in secure aviation communications and developing a strong foundation in operational resilience, threat awareness, and strict procedural discipline.
- Coordinated large-scale hardware and software upgrades across enterprise endpoint technology assets, minimizing operational downtime during critical infrastructure changes.
Credentials
A foundation in theoretical and practical knowledge.
Education
- Developed knowledge of the tools and protocols needed to navigate, use, and manage security technologies, as well as gained insight into the legal, social, and political dynamics of the cyber universe.
- Combined theoretical learning with two school placements which led to Qualified Teacher Status (QTS) that certified the knowledge necessary to become a secondary school teacher.
- Examined the causes of conflicts and contemporary security challenges while exploring the strategic approaches used by governmental and non-governmental actors to combat these threats.
- This degree was studied at the University of Glasgow, Dublin City University, and Charles University in Prague.
- Thesis: Shadow Warrior: The Outsourcing of the United States' Offensive Cyber Capabilities
- Researched the multidisciplinary nature of business studies and computer science while developing technical competencies required for the business environment.