As a privacy lawyer and founder of NormShift, I don't hand off the hard parts. From privacy law to packet captures, the whole stack is mine to own.
GDPR & DPDP Act programmes from policy to practice — privacy governance, data encryption, access control, secure data disposal and vendor data-processing controls that hold up under scrutiny.
ISO 27001, SOC 2 and NIST implemented and maintained through real audits. Risk assessment, policy development and internal audit that turn frameworks into operating reality.
Stood up and ran Security Operations Centres — SIEM, threat intelligence, VAPT and end-to-end incident response, plus business continuity and disaster recovery with measurable RPO/RTO targets.
AWS hardened with zero-trust principles, IAM least-privilege and continuous compliance monitoring. Architecture reviews across IAM, VPC, S3, Lambda and RDS with documented remediation.
Third-party / vendor risk management, security-awareness training delivered to 900+ staff including senior management, and clear board- and stakeholder-level reporting that turns risk into informed decisions. I chair the committees and own the outcome.
Understand the regulatory surface & current posture
Design controls that fit the business
Stand up the function & run it
Prove it — to auditors and the board