Architecture authority, decision governance and audit-readiness for institutions where every material design call needs an evidence trail. Most recent measured outcome: −35% audit findings within 1 year at a UN OICT programme.
Decision-governance build-out for CIOs, CTOs and programme sponsors facing supervisors, internal audit or rating-agency review. Engagement window 6–18 months. Output: a governance system the institution can defend to its regulators after handover.
UN OICT (2016–2019) — Zero Trust + security awareness programme reduced audit findings by 35% in 1 year across ISO 27001 / PCI DSS / GDPR / SOC 2. NATO / NCIA NDW (2023–2024) — Section-head accountability with SLA / OLA evidence discipline. Société Générale (BRD) — ICFR / COSO control alignment across 848-component portfolio.
Four offers recur on governance and audit-readiness work.
Methods are scoped, not decorative. Each mandate runs against a defined framework stack so decisions remain defensible to internal audit, external supervisors and donors.
ADR template, exception logging, decision-authority matrix. The institution gets a system that captures every material design decision with its trade-offs.
Map regulatory frameworks to actual platform controls. Audit-grade evidence the supervisory function can read.
Evidence discipline, CAB practice and supervisor-facing reporting that turn audits into operational baseline.
Decision-rights, evidence and CAB practice reset for portfolios that have lost defensibility. Re-establishes line of sight from supervisor to platform.
Standard artefact set on a governance mandate.
Governance holds at audit when decision-rights, evidence and control-mapping are designed as a system the institution owns — not as an annual fire-drill the architect leaves behind.
Engagements filtered by primary domain from the full 270+ project record. Full detail and NDA-gated evidence packs available on request.
Oversaw all InfoSec policies tied to Content Collaboration lifecycle management. Designed and led phishing / social-engineering exercises and awareness training. Managed privacy complaints and internal risk registers. Conducted internal audits and served as escalation point for incidents affecting PII.
Frameworks: ISO 27001 · GDPR · NIST CSF · NATO information-handling directives
—
Advise, implement and manage the Cyber Crisis Management programme — strategic crisis decision-making, large-scale crisis response. One of the largest, most respected teams of crisis and continuity management professionals.
—
Oversee Global SOC positions in daily tasks and projects. Selection of technology (cloud, SOA, etc.), devices and software for the network and information security infrastructure. Cryptographic key management in support of CIO function as Single Point of Authority.
—
Defined UN cyberspace concept and influenced UN member states to recognise UN as Single Point of Authority for UN and member-state cyberspace. Stakeholder management with budget secured to develop the collective cyberspace, cyber-security programme planning, and cyber-risk implementation.
US$125M (2015) + US$124M (2016) member-state budgets
Smart-Outsourcing programme covering SOC, infrastructure and DevSecOps operations. Delivered USD 3.2M OPEX savings while maintaining PCI DSS Level 1 compliance.
Frameworks: ITIL v3 · PCI DSS · ISO 27001 · COBIT 5
USD 3.2M OPEX savings
Negotiated enterprise agreements with Microsoft and AWS embedding performance and security KPIs. Yielded ~20% annual cost optimisation across UN workloads.
Frameworks: Vendor governance · Microsoft Cloud Adoption Framework · AWS Well-Architected · ITIL v3
~20% annual cost optimisation
Enterprise-wide Zero Trust programme combined with security-awareness training, improving organisational resilience and compliance maturity. ISO 27001 / PCI DSS / GDPR / SOC 2 audit findings reduced by 35% within one year.
Frameworks: Zero Trust (NIST 800-207) · ISO 27001 · PCI DSS · GDPR · SOC 2
-35% audit findings within 1 year
Member of expert advisory group defining the National Cyber Security Strategy (NCSS) framework and action plan to improve security and resilience of EU national infrastructures and services. Part of the task force ensuring that national eIDs work for cross-border public-service access in EU.
—
