GRC Analyst · Controls Assurance · Security Compliance · TPRM · AI & Agent Governance

Open to: remote GRC / security compliance / IT risk / supplier assurance positions and clearly scoped B2B contractor engagements. I work from Malaysia and can discuss lawful cross-border contracting arrangements. My independent portfolio uses synthetic examples; it is not presented as prior client employment.

Recruiter quick review: 30-second work overview · Control evidence and audit readiness · AI governance case · Supplier-risk case · Professional profile

AI use-case review packs, supplier decision packs and control evidence readiness — defined inputs, traceable findings, accountable actions and an editable handover. Inspect the domain-specific calculations and source before scoping an engagement or discussing role fit.

Interactive Executive GRC Control Center · Three executed scenario previews · Decision brief · Live governance workspace · Delivery evidence · Continuous GRC suite

• 29 connected domain projects spanning AI governance, third-party risk, audit readiness, privacy, technology risk and assurance.
• 29 GRC operating domains, 16 shared record types and 132 register/reporting views in the continuous GRC suite.
• Editable browser-local records, transparent scoring rules, evidence states, human review gates and exportable decision memos.
• Versioned source, validation workflows and recorded delivery checks tied to exact commits.

AI agents can gather evidence, draft registers, cross-check documents and prepare audit work. This portfolio focuses on the control boundary above that automation: evidence validity, control effectiveness, exceptions, risk acceptance, authorization and accountable sign-off.

External benchmark: grcskills.com publishes 60 open GRC agent skills across readiness, risk, evidence, audit, vendors, privacy, AI systems and continuity. I treat that library as an automation reference—not delegated authority or automatic compliance.

Inspect the agentic assurance model · Agent/tool/data authorization · Evidence integrity & provenance

NIST AI RMF 1.0 and NIST AI 600-1 · ISO/IEC 42001:2023 · ISO/IEC 27001:2022 · SOC 2 · NIST CSF 2.0 · GDPR processor governance · EU AI Act transparency

AI governance review sprint — bounded AI inventory, oversight, evaluation evidence, release gates and change review.

AI vendor & supplier assurance — structured review of SaaS, LLM and external AI vendors with evidence requests, treatment decisions and remediation ownership.

Continuous assurance review — evidence expiry, exceptions, retest ownership and concise management reporting.

Agentic GRC & AI assurance review — automation inventory, decision-rights mapping, evidence/provenance checks, agent/tool/data authorization boundaries and human-accountability gates.

Send a scope brief if you have one defined AI use case, vendor set or assurance backlog to review.

Public portfolio scenarios use synthetic data so methods, decision logic and guardrails can be inspected without exposing confidential records.

Regulatory obligations, policy governance, internal audit, corrective actions, cyber controls, resilience, KRIs, program oversight, privacy lifecycle and control effectiveness extend the specialist AI, supplier and assurance workflows. Explore coverage.

Start with an AI use-case review pack, supplier decision pack or control evidence readiness pack. Each dedicated domain uses its own inputs and calculations: coverage, tolerance, elapsed deadline or recovery objective. Shared evidence provenance connects the outputs; human reviewers retain decision authority.

Review enterprise delivery · Inspect all domain workflows · Discuss a role

29 dedicated domain projects · 16 typed records · 132 register/reporting views.

flowchart TD
 H["Personal hub"] --> G["Work catalogue"]
 H --> C["Contact brief"]
 G --> P["Dedicated domain projects"]
 P --> W["Typed operating workspace"]
 P --> R["Readiness inspector"]
 W --> E["Evidence and linked records"]
 E --> D["Human review and treatment"]
 D --> W
 G --> L["Supplier and AI Decision Lab"]
 L --> X["Memo, CSV and JSON exports"]
 R --> X
 H --> A["Native architecture and docs"]
 A --> P
 P --> V["Recorded delivery checks"]

flowchart TD
 S["Owned content and review contracts"] --> B["Python static build"]
 B --> U["Project pages and route index"]
 B --> J["Typed schemas and JSON definitions"]
 J --> F["Browser metadata validation"]
 F --> M["Evidence joins and risk calculations"]
 M --> Q["Reviewer decision and export"]
 Q --> F
 F --> O["Explicit device save"]
 B --> N["Generated DOCS and README map"]
 T["Source fingerprint and CI checks"] --> N
 K["Configured tenant identity"] --> API["Optional evaluation API"]
 API --> DB["Tenant quota and report storage"]
 API --> PR["Configured processing provider"]

Executable domain scenario library — three reproducible delivery scenarios per domain.

flowchart TD
  Sample["Scenario JSON"] --> Validate["Shared validator"]
  Validate --> Domain["Domain review"]
  Validate --> Typed["Typed workspace"]
  Validate --> Lab["Decision Lab"]
  Domain --> Pack["Decision package"]
  Typed --> Pack
  Lab --> Pack

Complete operating and client guide · Terms and conditions · License

• D01 Corporate governance & accountability → project → workspace
• D02 Enterprise risk & appetite → project → workspace
• D03 Regulatory applicability & change → project → workspace
• D04 Policy lifecycle → project → workspace
• D05 Control implementation & ownership → project → workspace
• D06 Internal audit & independence → project → workspace
• D07 External audit & certification readiness → project → workspace
• D08 Continuous assurance & remediation → project → workspace
• D09 Supplier lifecycle & concentration → project → workspace
• D10 Procurement & customer assurance → project → workspace
• D11 Privacy & individual rights → project → workspace
• D12 Processors & cross-border transfers → project → workspace
• D13 Data classification & retention → project → workspace
• D14 AI inventory & lifecycle authorization → project → workspace
• D15 AI fairness, safety & oversight → project → workspace
• D16 AI transparency & content provenance → project → workspace
• D17 Shadow AI & acceptable use → project → workspace
• D18 Continuity, recovery & crisis readiness → project → workspace
• D19 Incident governance & reporting → project → workspace
• D20 Workforce, physical & organizational security → project → workspace
• D21 Financial, fraud & ethical conduct risk → project → workspace
• D22 Sector, market & contractual obligations → project → workspace
• D23 Security scope & authorization boundary → project → workspace
• D24 Identity, least privilege & segregation → project → workspace
• D25 Cloud configuration & change → project → workspace
• D26 Threat, vulnerability & supply-chain assurance → project → workspace
• D27 Logging, evidence integrity & provenance → project → workspace
• D28 Agent, tool & data authorization → project → workspace
• D29 Assessment, authorization & ongoing monitoring → project → workspace

The connected governance core is open source under AGPL-3.0. Paid scopes cover AI governance readiness, supplier assurance, control-to-evidence mapping, deployment, integration and scheduled support. Review the enterprise delivery boundary or request an implementation scope. Managed SaaS features require a contracted deployment; no active subscription is claimed.