Mushtaq Ahmed

• Implement and maintain security controls aligned with SOC 2 Trust Services Criteria, ensuring
continuous compliance across the organization.
• Gather, organize, and manage audit evidence for internal and external SOC 2 assessments,
maintaining complete and accurate workpaper documentation.
• Document security processes, control procedures, and remediation plans in line with audit and
regulatory requirements.
• Configure and monitor security tools including IDS/IPS systems and vulnerability scanners; review
outputs and escalate findings.
• Participate in incident response activities — investigating security events, documenting timelines,
and coordinating remediation.
• Collaborate with engineering, IT, and operations teams to align existing workflows with SOC 2
control requirements.
• Identify control deficiencies, assess risk impact, and track remediation activities through to
closure.

I am currently engaged in performing IT audit assignments focused on ISO 27001 and SOC 2
frameworks for clients across the US and EU regions. My role includes conducting readiness
assessments, evaluating the design and operational effectiveness of IT controls, and analysing client
submitted policies and evidence to ensure compliance with control requirements. I regularly identify
gaps in documentation or implementation, communicate findings clearly to management, and
suggest actionable remediation steps. I work closely with platforms such as Vanta, Drata, and
Secureframe to manage compliance workflows and evidence tracking. Additionally, I lead client
meetings, provide weekly status updates, and proactively report any potential issues or risks to team
leads. This role has further strengthened my ability to manage audit timelines, maintain accuracy in
documentation, and align client environments with international security standards.

• Performed SOC 2 control testing across security, availability, and confidentiality criteria for US and
EU clients.
• Gathered and reviewed audit evidence — system reports, configurations, screenshots, and policy
documents — to support testing conclusions.
• Utilised Vanta, Drata, and Secureframe for control mapping, evidence collection, population and
sample selection, and continuous compliance monitoring.
• Supported penetration testing engagements by coordinating scope documentation, reviewing
findings, and tracking remediation.
• Drafted audit reports, management comments, compliance findings, and remediation
recommendations for client delivery.
• Led client kickoff meetings and coordinated evidence collection activities across multiple
concurrent engagements.

• Conducted SOC 2 compliance audits, analysing security policies and technical evidence against
Trust Services Criteria.
• Documented process walkthroughs, identified control gaps, and communicated findings to
engagement leads.

• Implemented ISO 27001 ISMS from the ground up, achieving certification within 12 months and
establishing a repeatable security management framework.
• Configured and maintained network security systems including Fortinet firewalls, Cisco
infrastructure, VPN, and IDS/IPS — monitoring alerts and responding to incidents.
• Conducted periodic risk assessments, managed internal audit cycles, and tracked remediation of
identified vulnerabilities.
• Designed and enforced security policies and procedures aligned with ISO 27001 and applicable
regulatory requirements.
• Led organization-wide security awareness training — delivered 20+ sessions, achieving a 40%
improvement in policy compliance.
• Managed vendor security assessments and maintained continuous compliance monitoring across
business systems.
• Reduced organizational information security risk exposure by 30% through structured risk
assessment and mitigation programmes.

• Policy Development: Designed, documented, and updated comprehensive security policies,
procedures, and guidelines in line with ISO 27001 requirements.
• Risk Assessment: Conducted regular risk assessments to identify vulnerabilities, assess
impact, and implement mitigation strategies.
• Audit Management: Facilitated internal audits and prepared for external certification audits,
addressing non-conformities effectively.
• Incident Response: Developed and executed incident response plans, ensuring rapid
resolution and minimizing operational disruptions.
• Security Awareness: Conducted regular training sessions and awareness programs to instill a
culture of security among employees.
• Vendor Security Management: Ensured third-party vendors adhered to organizational
security policies through assessments and monitoring.
• Compliance Monitoring: Established a continuous monitoring process to track compliance
with ISO 27001 standards and other applicable regulations.

• Collaborated with the IT team to enhance network security and resolve vulnerabilities.

• Assisted in implementing security protocols and controls to safeguard organizational data and
systems.
• Supported audit record maintenance, policy documentation, and network security improvements.