Taiwo Johnson

Providing advisory and implementation support to scaling organizations on GRC program design, ISO 27001 readiness, and GDPR compliance operations.

• Advising 3+ client organizations on risk register design, control frameworks, and audit preparation aligned to ISO 27001 and NIST CSF; reducing average time-to-certification readiness by 6 weeks per engagement.

• Conducting ISO 27001 and NIST CSF compliance gap assessments; mapping control deficiencies to phased remediation roadmaps with prioritized owner actions.

• Supporting GDPR operations across 2 client engagements including data mapping, DPIA facilitation, and Article 30 records of processing activities.

• Supporting clients on SOC 2 readiness and control gap analysis covering 40+ Trust Service Criteria controls

• Spearheaded comprehensive GRC implementation adhering to ISO 27001, NIST CSF, and GDPR standards, enhancing organizational compliance.

• Executed detailed risk assessments and control mapping for over 50 business processes, identifying vulnerabilities and strengthening security posture.

• Developed robust governance workflows and accountability frameworks, producing audit-ready documentation that facilitated seamless third-party audits.

• Instituted effective control testing protocols and evidence collection methodologies, ensuring operational readiness and continuous compliance monitoring.

Led enterprise compliance transformation covering ISO 27001, PCI-DSS, and GDPR across governance, information security,
and third-party risk. Delivered zero audit findings across all certification cycles.
• Managed 200+ operational controls spanning governance, information security, and regulatory domains across all
business units
• Produced quarterly board governance reports that directly informed capital project prioritization, contributing to $2M
in annual cost savings
• Embedded compliance processes into daily operations, reducing issue resolution time by 40% organization-wide
• Managed third-party risk program for 15+ strategic vendors; renegotiated contract terms reducing estimated
contractual liability exposure by 30%
• Designed control testing procedures that reduced repeat audit findings by 40%
• Coordinated annual audits; maintained 100% on-time findings closure with zero overdue items
• Established enterprise risk assessment methodology across 50+ critical business processes
• Conducted DPIAs and maintained records of processing activities in line with GDPR Article 30 requirements
Tools: ServiceNow GRC/IRM, Vanta, Secureframe, Drata, OneTrust
◦ Frameworks: ISO 27001, PCI-DSS, GDPR

• Spearheaded the design and implementation of a comprehensive GRC program across five key frameworks: ISO 27001, PCI-DSS v4.0, GDPR, NDPR, and NIST CSF, focusing on risk assessment, policy development, internal audit readiness, and compliance monitoring.
• Executed thorough enterprise risk assessments, pinpointing threats and vulnerabilities while assessing their likelihood and impact, leading to informed treatment decisions and an up-to-date risk register across all control domains.
• Formulated and critically reviewed information security policies, ensuring alignment with regulatory requirements and best practices to enhance organizational compliance and security posture.

Concurrent contract alongside primary role. Built ISO 27001 compliance program from scratch, aligned to NIST CSF and GDPR, achieving full operational readiness 2 months ahead of an 8-month planned schedule.

• Conducted enterprise risk assessments across 35+ critical business processes within SaaS product and engineering functions using NIST RMF; prioritized remediation by risk severity.

• Mapped 150+ controls to ISO 27001 Annex A requirements; delivered clean mapping audit with zero deficiencies.

• Achieved 100% control documentation completion ahead of certification audit.

• Delivered full operational readiness in 6 months against a planned 8-month timeline
Tools: ServiceNow GRC ◦ ISO 27001, NIST GDPR

• Developed and managed comprehensive risk registers encompassing regulatory, operational, and information security risks, directly informing senior governance and management reviews over four years.
• Created and maintained audit-ready compliance documentation to facilitate internal audits, regulatory inspections, and compliance assessments, ensuring adherence to industry standards.
• Analyzed compliance incidents and control failures, executing thorough root-cause analysis and implementing corrective and preventive measures, achieving verified closure on identified issues.
• Collaborated with cross-functional teams to enhance risk management frameworks and compliance strategies, contributing to a robust governance, risk, and compliance (GRC) environment.

• Multi-site agricultural operation: 3 farms, 2 operational sites, 1 central warehouse, 27 employees, 20-50 active vendors Dual mandate leading GRC and compliance functions alongside operational oversight. Responsible for enterprise risk register management, certification readiness, incident management, vendor risk, and supply chain resilience across a multi-site agricultural enterprise operating under GRC and compliance governance standards.

• Designed and maintained enterprise risk registers covering operational, supply chain, vendor, compliance, and business continuity risks across 8 categories; achieved first-submission certification success with zero documentation rejections.

• Led incident investigations and root-cause analyses; preventive controls reduced incident recurrence and annual incident costs by 35% (from ₦2M to ₦950k annually).

• Managed vendor ecosystem of 20-50 active suppliers; implemented vendor risk scoring and quarterly performance reviews reducing third-party exposure.

• Coordinated annual compliance audits; delivered 100% of required evidence ahead of deadlines across two audit cycles.

• Developed and delivered compliance training across 12+ topics; achieved 90% post-training pass rate and reduced compliance-related operational issues by 25%.

• Strengthened supply chain resilience across logistics, procurement, and vendor management processes through operational risk controls Frameworks: ISO 27001, PCI-DSS, ISO 31000, NIST RMF.

• Collaborated with cross-functional teams to navigate regulatory enforcement actions, identifying incident patterns and systemic control weaknesses.
• Developed and executed validation controls and compliance frameworks, enhancing overall inspection readiness and risk mitigation.
• Streamlined compliance documentation processes, fostering proactive stakeholder engagement to minimize regulatory enforcement challenges.
• Leveraged analytical skills to assess compliance risks, ensuring alignment with industry standards and best practices in governance, risk, and compliance (GRC).
• Championed initiatives to promote a culture of compliance and security awareness across the organization, contributing to improved information security posture.

• Regulatory compliance role focused on inspection readiness and compliance infrastructure.

• Led the organizations first compliance tracking build and delivered zero violations on regulatory inspection.

• Implemented validation controls and inspection-readiness procedures; achieved zero violations on regulatory authority inspection and earned a 6-month compliance extension versus the standard 3-month review cycle.

• Established monthly compliance reporting cadence to regulatory authorities, reducing communication friction and improving transparency.

• Built automated regulatory compliance tracking systems, achieving a 100% on-time filing rate

• Delivered comprehensive risk analysis to organizations navigating operational uncertainties and financial vulnerabilities.

• Leveraged historical data to pinpoint critical risk drivers, enhancing the understanding of potential threats.

• Collaborated with cross-functional teams to implement risk-informed controls, improving overall organizational resilience.

• Developed actionable insights that contributed to informed decision-making and strategic planning.

• Fostered a culture of compliance by aligning risk management practices with industry standards and regulatory requirements.

• Enhanced information security posture through effective risk assessment methodologies, ensuring robust protection against potential breaches.