Governance, Risk, Compliance and Cybersecurity
Governance, risk and compliance is the lead focus: security policies, ISO 27001 and GDPR readiness, risk assessments, awareness training and compliance reporting that keeps every team on track. Alongside it, Ian works across the wider cybersecurity field, from AI security and security operations to web and email security. Works remotely. Available for consulting, contract and full-time engagements worldwide.
Ways to work together
A permanent remote role in a security, GRC or compliance team, owning a programme and driving it forward with the rest of the organisation.
A fixed-term remote engagement to deliver a defined outcome, such as an ISO 27001 programme, an audit, a policy refresh or extra capacity for a security team.
Scoped reviews and ongoing advisory work, from a one-off gap assessment to a regular governance, risk and compliance check-in.
Open to roles across cybersecurity, including Cybersecurity Consultant (AI Security & GRC), Security Governance & Compliance Lead, GRC Analyst, Information Security Officer, Cybersecurity Analyst, SOC Analyst, Cybersecurity Researcher, AI Risk Research Analyst.
Services
Each service has its own page with deliverables and FAQs: see all GRC and cybersecurity services.
Information security policies, standards and procedures written for the way your organisation works, with owners, review cycles and an exceptions process.
A gap review against ISO/IEC 27001, GDPR and the NIST Cybersecurity Framework, with a prioritised risk register, PII protection measures and a plan to close the gaps.
A role-based awareness programme with onboarding content, phishing simulations done fairly, policy acknowledgements and metrics that show behaviour change.
Control matrices, evidence collection and audit preparation, plus clear compliance reporting for management, clients and committees.
A review of how your team uses AI tools and LLM features, with the risks that matter most, such as prompt injection, data leakage and over-broad access, and practical controls for each.
A clear AI acceptable use policy and governance process aligned with the NIST AI Risk Management Framework, written for the way your organization actually works.
A passive review of security headers, TLS, DNS and email authentication (SPF, DKIM and DMARC), with fixes ranked by impact.
The essentials put in place: multi-factor authentication, backups, device hygiene, phishing awareness and a simple incident plan.
Help with log review, detection rules and first-response triage, so alerts turn into clear decisions.
How it works
Want a quick view of where your organisation stands first? Try the free GRC Compliance Readiness Assessment or the Cyber Risk Register.
- Send a request with the form below, whether it is a role, a contract or a consulting project.
- Ian replies by email to discuss the role or agree the scope, deliverables and timeline in writing.
- Work is delivered remotely, with a written report and clear next steps.
Work is defensive and authorized only. Please don't include passwords, keys or other secrets in your request.