Clarity, structure, and practical judgment for complex GRC challenges.
Twelve years turning regulatory complexity into controls that hold up under real scrutiny — not just paperwork that says they should.
I lead multi-framework audit and certification programs for a high-growth cloud platform, with a record of zero findings across consecutive external audit cycles.
For more than a decade, I've worked both sides of the audit table — first testing other companies' controls as an IT auditor, now owning a program that answers to real external scrutiny every cycle. That dual view shapes how I work: I don't just interpret a requirement, I translate it into a control that survives contact with engineers, auditors, and growth.
At MongoDB, I lead SOC 2 and HITRUST Type 2 reporting end to end, direct ISO 27001 and ISO 9001 certification across the cloud platform, and coordinate multi-framework regulatory readiness whenever the company acquires or ships something new.
I'm also a builder. I designed and shipped eGuard, an internal GRC automation tool now used company-wide — because I'd rather build the tool that makes a control repeatable than manage it by hand forever.
Outside of GRC, I co-organize an annual youth cricket tournament that runs 40+ games over four days, and have volunteered in event operations for FIFA — the same logistics discipline, applied to a different kind of system.
What I bring to a GRC program
Five areas where I spend most of my time — and where I tend to add the most value fastest.
Multi-framework audit & certification leadership
I own the full lifecycle — planning, evidence, the auditor relationship, remediation — not just the paperwork around it.
Risk & control architecture
A repeatable method: identify the risk, define the control objective, assign an accountable owner, automate the evidence, monitor effectiveness, remediate what breaks.
M&A & new-product compliance integration
When MongoDB acquired Voyage AI, I drove multi-framework readiness from scratch — coordinating security, privacy, vendor risk, and product teams around one evidence model.
Compliance technology & automation
Hands-on with AuditBoard, Vanta, and Jira-based evidence workflows — and I built eGuard because a tooling gap is a control gap, not just an inconvenience.
Cross-functional & executive engagement
Primary point of contact for auditors and customers on compliance topics. I build the dashboards that give leadership real visibility into control effectiveness — not just a status update during audit season.
How I work
The same method, applied to every framework and every new product: it's not about which standard is in scope, it's about whether the control holds.
Identify the risk
Name what could actually go wrong, in plain terms.
Define the control
Set a clear objective the control is meant to satisfy.
Assign an owner
Every control belongs to a person, not a policy document.
Automate the evidence
If it can't be sampled and verified, it isn't a control yet.
Monitor effectiveness
Track what matters, on a cadence someone actually reviews.
Remediate
Fix what breaks, and close the loop with the auditor or the business.
Programs I've built and defended
A few examples of the work behind the zero-findings track record.
SOC 2 + HITRUST Type 2, MongoDB Cloud Platform
Own reporting end to end with our external assessor — draft-review cycles, management representation letters, final sign-off — across multiple consecutive audit cycles.
→ Zero findings, multiple cycles runningISO 27001 & ISO 9001 certification
Lead the full ISQMS documentation suite, audit and assessment procedures, and certification scope across the cloud platform and newer product lines.
→ Certification maintained across expanding scopeVoyage AI acquisition readiness
Drove multi-framework compliance readiness — SOC 2, HITRUST, HIPAA, ISO, PCI DSS, GDPR — coordinating security, privacy, vendor risk, and product teams from day one.
→ Gap assessment to audit-ready, cross-functionallyeGuard — internal GRC automation platform
Designed and shipped a compliance application now used company-wide, connecting governance requirements to identity, data, and workflow controls.
→ From policy document to deployed, auditable workflowB.S., Cyber Security — Pennsylvania State University
Prior: Comcast (Senior IT Auditor) · Protiviti (Technology Consultant) · Philadelphia Gas Works (Information Security Analyst)