Most companies don’t fail at compliance because they don’t care. They fail because they try to manage it as a checklist instead of a system.

I work at the intersection of security, privacy, and AI governance—helping organizations turn compliance into something operational, scalable, and actually useful.

Over the past 15+ years, I’ve worked with startups and growing companies navigating the hardest part of the journey: moving from early-stage experimentation to production, where risk, accountability, and regulatory expectations start to matter.

That’s where things usually break.

My focus is designing governance models that don’t just exist on paper—systems that integrate risk management, controls, and decision-making into how a company actually runs.

Today, a big part of my work is centered around Infosec and AI governance: ISO 27001 & 42001, EU AI Act readiness, and NIST AI RMF—helping organizations structure how they build, deploy, and oversee AI systems responsibly.

In parallel, I’m building AI-native compliance tools designed to automate and scale GRC processes—from risk assessments and policy generation to continuous compliance and audit readiness.

How I approach things:

• I think in systems, not checklists
• I optimize for usability, not just audit outcomes
• I bridge technical, legal, and business perspectives
• I care about making governance something teams can actually live with

Core areas:
Security • Privacy • AI Governance • GRC • Risk Management • ISO 27001 • ISO 42001 • SOC 2 • EU AI Act • NIST AI RMF

If you’re trying to bring structure to security, privacy, or AI—and need something that works beyond documentation—I’m always open to exchanging ideas.