Aamir Islam Kaazim

• Developed and maintained comprehensive IT cybersecurity
controls and governance aligned with NIST CSF, NCA
frameworks, NDMO/SDAIA, Saudi PDPL, and Aramco
cybersecurity standards across enterprise infrastructure
• Conducted compliance reviews and assessments of cybersecurity
programs, guidelines, and documentation to ensure adherence to
regulatory and internal governance requirements
• Conducted NDMO Data Governance maturity assessments across
governance dimensions (ownership, classification, data quality,
master data management); mapped control gaps and developed
phased remediation roadmaps with audit-ready evidence and
compliance documentation
• Led and coordinated cybersecurity risk assessments for IT and
data projects, identifying and addressing data-related risks,
exceptions, and workflows in line with NDMO, NCA ECC/DCC,
and NIST CSF
• Supported critical infrastructure protection programs by
implementing defense-in-depth security architecture and layered
controls across cloud, network, and enterprise environments,
ensuring secure operations for business-critical systems and
services in alignment with NIST CSF and NCA requirements
• Embedded NDMO and NCA requirements into project lifecycles
by reviewing and validating cybersecurity controls, exceptions,
and technical change requests from early project stages through
implementation
• Led cloud security governance and risk assessments across AWS
and Azure environments, supporting SaaS security reviews, cloud
compliance alignment (NIST CSF / NCA), and cloud posture
management initiatives.
• Assessed third-party cybersecurity controls, providing strategic
recommendations to improve vendor security posture and
contractual security requirements
• Reviewed and updated organizational data privacy and security
policies to maintain compliance with Saudi PDPL, NDMO, NCA,
NIST CSF, and Aramco standards; reported key findings to senior
stakeholders
• Experience collaborating with OT security teams on risk
assessments, compliance
roadmaps, and strategic planning for operational technology
environments. Collaborated with cloud security teams on cloud
governance frameworks, multi-cloud compliance strategies, and
cloud security posture assessments across AWS and Azure
environments. Supported cross-functional OT/IT security
initiatives ensuring alignment with cybersecurity frameworks
Designed cybersecurity target operating models and
transformation roadmaps for enterprise clients, defining
governance structures, roles and responsibilities (RACI matrices),
and key performance indicators aligned with business objectives
and regulatory requirements
Provided executive advisory services to C-level stakeholders on
cybersecurity investment priorities, risk-based decision making,
and strategic cybersecurity initiatives, translating complex
technical concepts into actionable business insights
Established data governance frameworks integrating master data
and data quality strategies aligned with NDMO/SDAIA guidelines
and NCA standards; developed governance rule engines and
workflows for automated data classification, lineage tracking, and
compliance monitoring

• Developed and maintained comprehensive IT cybersecurity controls and governance
aligned with NIST CSF, NCA frameworks, NDMO/SDAIA, Saudi PDPL, and
Aramco cybersecurity standards across enterprise infrastructure
• Conducted compliance reviews and assessments of cybersecurity programs,
guidelines, and documentation to ensure adherence to regulatory and internal
governance requirements
• Conducted NDMO Data Governance maturity assessments across governance
dimensions (ownership, classification, data quality, master data management);
mapped control gaps and developed phased remediation roadmaps with audit-ready
evidence and compliance documentation
• Led and coordinated cybersecurity risk assessments for IT and data projects,
identifying and addressing data-related risks, exceptions, and workflows in line with
NDMO, NCA ECC/DCC, and NIST CSF
• Supported critical infrastructure protection programs by implementing defense-in
depth security architecture and layered controls across cloud, network, and
enterprise environments, ensuring secure operations for business-critical systems
and services in alignment with NIST CSF and NCA requirements
• Embedded NDMO and NCA requirements into project lifecycles by reviewing and
validating cybersecurity controls, exceptions, and technical change requests from
early project stages through implementation
• Led cloud security governance and risk assessments across AWS and Azure
environments, supporting SaaS security reviews, cloud compliance alignment (NIST
CSF / NCA), and cloud posture management initiatives.
• Assessed third-party cybersecurity controls, providing strategic recommendations to
improve vendor security posture and contractual security requirements
• Reviewed and updated organizational data privacy and security policies to maintain
compliance with Saudi PDPL, NDMO, NCA, NIST CSF, and Aramco standards;
reported key findings to senior stakeholders
• Experience collaborating with OT security teams on risk assessments, compliance
roadmaps, and strategic planning for operational technology environments.
Collaborated with cloud security teams on cloud governance frameworks, multi
cloud compliance strategies, and cloud security posture assessments across AWS
and Azure environments. Supported cross-functional OT/IT security initiatives
ensuring alignment with cybersecurity frameworks
Designed cybersecurity target operating models and transformation roadmaps for
enterprise clients, defining governance structures, roles and responsibilities (RACI
matrices), and key performance indicators aligned with business objectives and
regulatory requirements
Provided executive advisory services to C-level stakeholders on cybersecurity
investment priorities, risk-based decision making, and strategic cybersecurity
initiatives, translating complex technical concepts into actionable business insights
Established data governance frameworks integrating master data and data quality
strategies aligned with NDMO/SDAIA guidelines and NCA standards; developed
governance rule engines and workflows for automated data classification, lineage
tracking, and compliance monitoring

Riyadh Airports Company (STC Solutions)
• Developed and implemented a comprehensive cybersecurity GRC framework aligned with industry best practices and regulatory requirements.
• Developed and implemented a comprehensive cybersecurity GRC framework aligned with industry standards and regulatory requirements.
• Conducted regular risk assessments and gap analysis to prioritize cybersecurity vulnerabilities and risks.
• Collaborated with cross-functional teams to establish and document cybersecurity policies, standards, and procedures.
• Conducted advisory reviews for cybersecurity designs and provided recommendations for effective control implementation.
• Implemented and maintained an efficient cybersecurity risk management program, including risk identification, analysis, mitigation, and monitoring.
• Led compliance assessments to ensure adherence to relevant cybersecurity regulations (NCA ECC, CSCC, TCC, OSMAC, CCC, NCA OTCC, NCA DCC) and industry standard ISO 27001.
• Conducted critical infrastructure assessment for OT and IT systems.
• Integrated RSA Archer to enhance cybersecurity compliance and streamline risk management processes.
• Developed and delivered cybersecurity training programs to raise awareness and promote best practices.
• Stayed updated on emerging cybersecurity trends, threats, and regulations, recommending adjustments to security controls and practices.
• Collaborated with infrastructure teams to integrate cybersecurity controls into systems and infrastructure.
• Played an active role in incident response activities, investigating and resolving security incidents, and implementing preventive measures.
• Conducted periodic audits of cybersecurity controls, processes, and systems to identify vulnerabilities and areas for improvement.
• Established KPIs and KRIs to assess the effectiveness of cybersecurity controls.
• Prepared and presented comprehensive reports on cybersecurity GRC activities, including risk assessments, compliance status, and recommendations to senior management.
• Conducted vulnerability scanning on technology assets to identify weaknesses.
• Utilized security testing and code scanning tools for code reviews and secure development practices.
• Contributed to authorized penetration testing to identify vulnerabilities in infrastructure and assets.
• Employed social engineering techniques to uncover security gaps and vulnerabilities.
• Provided support in administering cybersecurity governance systems.
• Conducted cybersecurity reviews and identified security gaps in existing architecture.
• Conducted periodic reviews of cybersecurity strategy, policies, and related documents to maintain compliance with applicable legislation and regulations.
• Conducted cybersecurity risk assessments to identify and address potential risks.
• Conducted regular cybersecurity compliance reviews to assess adherence to requirements, policies, standards, and controls.
• Ensured cybersecurity decisions were based on robust risk management principles.
• Developed and updated the cybersecurity framework, assessing and improving the companys ability to prevent, detect, and respond to cyber-attacks.
• Applied cybersecurity resilience requirements to business continuity management, minimizing the effects of interruptions and vulnerabilities.

• Supported and delivered IT security and compliance initiatives including ISO
27001, PCI DSS, ERM, and ISMS, covering risk assessments, control reviews, and
remediation tracking
• Performed security risk and threat assessments for business units; documented gaps
against required controls and contributed to improvement plans and executive
dashboards
• Developed security program dashboards and executive communications to report on
risk, compliance status, and key initiatives to senior stakeholders
• Examined and enhanced Disaster Recovery and Business Continuity plans to
address critical business requirements and cybersecurity resilience needs
• Managed vulnerability and antivirus compliance across infrastructure; monitored for
attacks and intrusions; coordinated incident response and escalation procedures
• Developed and maintained standard operating procedures and governance
documentation for IT security and compliance processes
• Led and managed incident response and escalation for security incidents, including
investigations and responses to IT security events
• Liaised with stakeholders on cybersecurity issues; performed vulnerability
assessments; supported projects with planning, scheduling, risk management, and
documentation

• Developed comprehensive cyber and information security risk
management framework based on NIST and ISO 27001, covering
processes, policies, and controls
• Reviewed and aligned existing cyber and information security
policies with defined risk framework, updating controls and
procedures where required
• Conducted risk and control assessments using structured risk
taxonomy; defined detailed cybersecurity risk scenarios and
maintained risk register to prioritize remediation
• Defined key risk indicators (KRIs) and designed executive
reporting dashboards for cyber and information security risks to
support strategic management decision-making
• Performed ISO 27001 audits and facilitated certification activities,
including gap analysis, remediation planning, and audit evidence
collection
• Led development of Data Classification and Retention Policy,
including RACI roles; performed Data Loss Prevention and
information protection control reviews

• Achieved 96.5% NCA ECC compliance for airport critical infrastructure by
developing and implementing comprehensive cybersecurity GRC framework
aligned with NCA ECC/DCC, NDMO, NIST CSF, ISO 27001, and Saudi regulatory
requirements, establishing Riyadh Airports Company as a cybersecurity compliance
leader in the aviation sector
• Collaborated with cross-functional teams to establish and maintain cybersecurity
policies, standards, and procedures, including data classification, cataloging, and
metadata management in line with NDMO requirements
• Performed recurring cyber and data security risk assessments, gap analyses, and
control reviews for data-related requests, exceptions, and technical change requests,
prioritizing remediation actions based on risk appetite
• Secured critical infrastructure operations including airport management systems,
passenger data platforms, baggage handling systems, and operational technology
environments through implementation of defense-in-depth security architecture,
network segmentation, and continuous security monitoring programs
• Reviewed NDMO roadmap levels and maturity requirements, coordinating
alignment of NDMO standards with NCA ECC/DCC and NIST frameworks and
defining phased adoption plans
• Integrated RSA Archer as central GRC platform, designing workflows, KPIs, and
KRIs to track compliance status, risk posture, audit findings, and remediation
progress for executive visibility
• Conducted periodic audits and cybersecurity compliance reviews of controls,
processes, and systems, identifying vulnerabilities and recommending
improvements to strategy, arc
• hitecture, and operational practices
• Prepared and presented comprehensive reports on cybersecurity GRC activities,
including risk assessments, compliance status, and mitigation plans to senior
management and stakeholders
• Advised airport executive leadership on cybersecurity investment priorities,
strategic initiatives, and multi-year compliance roadmap development, presenting
risk-based recommendations to support data-driven decision-making and resource
allocation
• Supported ISMS re-certification and surveillance audits; applied cybersecurity
resilience requirements to business continuity management to minimize operational
impact of interruptions

CyberSec Consulting
• Developed a comprehensive cyber and information security risk framework based on NIST and ISO 27001.
• Reviewed current cyber and information security policies and recommended amendments to align them with the defined security risk framework in line with NIST and ISO 27001.
• Conducted reviews of cyber and information security risks and controls in the risk taxonomy, identifying detailed relevant cyber security risk scenarios aligned to relevant threats.
• Reviewed and developed a risk register to prioritize risks effectively.
• Identified key risk indicators and built an executive reporting capability for cyber and information security risks.
• Conducted current state assessments and gaps analysis to develop the future target state, defining cyber and information security risk management processes, policies, and procedures.
• Planned and supervised the implementation of cyber and information security risk management processes.
• Conducted ISO 27001 audits and facilitated certification processes.
• Led the development of Data Classification and Retention Policy and performed Data Loss Prevention audits.
• Defined and developed the Data Classification and Retention Policy, as well as roles and responsibilities in support with a RACI Matrix.
• Conducted gap assessments and diagnostic reviews of controls implemented to address information protection.

2018-06 - 2020-09 Cyber Security Consultant
IT Butler
• Managed information security risk management for ISO 27001, NCA, NIST, COBIT, COSO, ISMS, OWASP, and SANS frameworks.
• Maintained and extended the Information Security Management System based on SAMA and ISO 27001 frameworks.
• Designed and implemented robust security architectures using SABSA and COBIT frameworks.
• Provided PCI DSS consulting and assessment services for retailers, ensuring increased security of cardholder data processing environments and reduced overall scope.
• Conducted PCI assessments, gap assessments, remediation consulting, and security architecture consulting for retail organizations and healthcare providers.
• Prepared risk assessment reports, identified improvement opportunities, and provided feedback to senior management.
• Built relationships with stakeholders, aligning business needs with processes and practices while monitoring progress and results.
• Conducted vulnerability assessments and penetration testing of data center network devices and servers.
• Prepared written reports explaining vulnerabilities and providing recommendations for mitigation.
• Utilized security testing and code scanning tools to conduct code reviews and ensure secure development practices.
• Defined, implemented, and maintained corporate security policies, standards, and procedures according to SAMA and ISO 27001 framework standards.
• Conducted periodic implementation reviews and ensured vulnerability assessment scan reports were implemented.
• Assisted with the development of processes and procedures to improve incident response times, analysis of incidents, and overall SOC functions.

• Managed information security risk management and compliance
programs across ISO 27001, NCA, NIST, COBIT, COSO, SAMA,
and related ISMS frameworks for multiple client organizations
• Maintained and enhanced Information Security Management
Systems (ISMS) based on SAMA and ISO 27001, including
policies, standards, and procedures
• Designed and implemented security architectures using SABSA
and COBIT, aligning security controls with business requirements
and regulatory mandates
• Delivered PCI DSS consulting and assessments for retail and
healthcare clients, performing gap assessments, remediation
planning, and security architecture reviews for cardholder data
environments
• Conducted vulnerability assessments and penetration testing of
data center network devices and servers; produced
comprehensive risk reports with actionable mitigation
recommendations
• Supported incident response and SOC process improvements by
defining procedures to enhance detection, analysis, and response
times

Monitored, analyzed, and remediated IT security risks and vulnerabilities adhering to ISMS and defined procedures.
•Supported projects with planning, scheduling, risk management, stakeholder communication, and documentation.
•Prepared and conducted security risk and threat assessments for business units.
•Created project plans and monitored cyber security solution offerings.
•Examined disaster recovery and business continuity plans and addressed critical business requirements.
•Developed security program dashboards and contributed to ITSM quality improvement initiatives.
•Led and managed incident response and escalation for security incidents.
•Researched and evaluated emerging cyber security threats and planned for disaster recovery.
•Monitored for attacks and intrusions, identified potential weaknesses, and implemented security measures.
•Liaised with stakeholders on cyber security issues and performed vulnerability assessments.
•Documented processes and identified gaps between current processes and certifiable state of controls.

Provided project management support including planning, risk management, stakeholder communications, release management, and documentation.
•Conducted inventory of operational security controls and supported internal service catalog.
•Examined Disaster Recovery and Business Continuity plans and addressed critical business requirements.
•Managed and delivered IT security and compliance initiatives such as ERM, PCI, and ISO 27001.
•Developed security program dashboards and executive level communications.
•Conducted investigations and responses to IT security events.
•Maintained and managed security for devices, vulnerability assessment systems, and antivirus compliance.
•Developed and maintained standard operating procedures and protocols for IT governance and security compliance.
•Coordinated multiple concurrent projects and benchmarked, analyzed, reported on, and made recommendations for IT infrastructure and systems growth.

Assisted in gathering and documenting project requirements and success criteria.
•Evaluated project progress and developed metrics, procedures, and methods.
•Coordinated with project sponsors and vendors on project status and improvements.
•Supported technical teams in post-project reviews to understand performance and critical areas.
•Managed and performed various IT security tasks including HBSS deployments and managing identities/access policies.
•Performed SCCM application deployment and multi-site software deployments.
•Analyzed log files, provided patch management support and maintenance window operations.

My Job role included below:
•Responsible for managing email and web security using Cisco IronPort appliance, tracking email traffic, and connections to external mail gateways.
•Creating and implementing email filters, adding servers to email relay lists, and generating reports on email traffic.
•Ensuring the filtering of emails through the gateway by implementing size limits, blocking spam emails and sender domains, and configuring anti-malware/virus and anti-spam systems and services.
•Managing mailbox services including quotas for mailbox size limits, message queues, and creating, maintaining, and deleting authorized user and administrative mailboxes, shared and resource mailboxes, and calendars, as well as distribution lists and Exchange public folders.
•Successfully reduced spam by 90% by implementing firewall filtering with real-time spam blacklists for incoming emails using Network Spam and Firewall Software.

• Managed enterprise email and web security using Cisco IronPort
and related security gateways, including policy configuration,
filtering, and monitoring of mail traffic
• Administered Exchange messaging services (mailboxes, quotas,
distribution lists, shared resources) and maintained secure,
reliable email operations
• Reduced spam volume by approximately 90% by implementing
firewall filtering and real-time blacklist controls for incoming
email traffic
• Created and implemented email filters, added servers to relay
lists, and generated comprehensive reports on email traffic
patterns and security incidents
• Ensured effective filtering of emails through gateway by
implementing size limits, blocking spam and malicious sender
domains, and configuring anti-malware/virus and anti-spam
systems
• Managed mailbox services including quotas, message queues, and
creation/maintenance of authorized user and administrative
mailboxes, shared and resource mailboxes, calendars, and
Exchange public folders

• Implemented and supported enterprise network infrastructure,
including DHCP/DNS, equipment installation, and change
management in line with defined standards and best practices
• Configured and administered network security and firewalls;
provided Windows server/client and network troubleshooting
support to enterprise users
• Handled OS and application deployment, system management
tools, and patch management for core infrastructure services
• Installed, configured, tested, and maintained operating systems,
application software, and system management tools across
enterprise environment
• Developed and tailored enterprise processes and best practices
for applications and infrastructure management
• Managed patch management, functional updates, and bug fixes
for File Services, Print Services, and other critical software
systems