Skip to content
View cyberzeshan's full-sized avatar

Block or report cyberzeshan

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
cyberzeshan/README.md
Typing SVG

LinkedIn Email GitHub GitHub followers

🔐 About Me

"Security is not a product, but a process; and governance is the architecture that makes it sustainable."

I am a Governance, Risk & Compliance (GRC) Engineer and cybersecurity subject matter expert with deep specialization in designing, implementing, and maturing enterprise security programs across highly regulated industries including finance, healthcare, and critical infrastructure.

My work bridges the gap between executive risk strategy, regulatory compliance obligations, and technical security control implementation — translating complex frameworks into actionable, auditable programs that survive scrutiny from both regulators and adversaries.

📍 Domains    →  Enterprise Risk · Compliance Engineering · Security Architecture · Audit & Assurance
🏛️ Frameworks →  NIST CSF/RMF · ISO 27001/27002 · SOC 2 · PCI-DSS v4 · HIPAA · FedRAMP · CIS v8
🎯 Focus      →  Control Design · Compliance Automation · Third-Party Risk · Policy Governance

🛡️ Core Competencies

🏛️ Governance

  • Security Program Design & Maturity
  • Policy, Standard & Procedure Development
  • Board-Level Risk Reporting & Communication
  • Security Architecture Review (SAR)
  • Third-Party Risk Management (TPRM)
  • Vendor Risk Assessment & Due Diligence
  • Security Awareness Program Design
  • GRC Platform Implementation (Archer, Aravo, ServiceNow, Drata, Vanta)

⚠️ Risk Management

  • Enterprise Risk Frameworks (ISO 31000, NIST RMF)
  • Threat Modeling (STRIDE, PASTA, LINDDUN)
  • FAIR Quantitative Risk Analysis
  • Risk Register Development & Maintenance
  • Business Impact Analysis (BIA)
  • Residual Risk Acceptance & Tracking
  • Control Gap Analysis & Remediation Planning
  • Risk Appetite & Tolerance Framework Design

✅ Compliance & Audit

  • SOC 2 Type I & II Readiness & Audit Support
  • ISO 27001 ISMS Implementation & Certification
  • FedRAMP Authorization Package Development
  • PCI-DSS v4 Scope Definition & Gap Analysis
  • HIPAA Security Rule Risk Assessment
  • Internal Audit Program Design & Execution
  • Control Testing & Evidence Collection
  • Regulatory Mapping & Cross-Framework Analysis

🧰 Frameworks, Standards & Tools

Regulatory & Compliance Frameworks

NIST CSF NIST RMF ISO 27001 ISO 27002 SOC 2 FedRAMP PCI DSS HIPAA GDPR CCPA COBIT CIS

Threat Intelligence & Attack Frameworks

MITRE ATT&CK MITRE D3FEND STRIDE PASTA FAIR Kill Chain

GRC & Security Tools

Archer ServiceNow Vanta Drata Qualys Splunk Jira Python

📌 Featured Repositories

Repository Description Focus
🔧 grc-framework-toolkit End-to-end implementation guides for NIST CSF 2.0, ISO 27001:2022 & RMF — with gap analysis templates, implementation roadmaps, and control mapping matrices NIST ISO-27001 FedRAMP
⚠️ risk-management-playbook Enterprise risk register templates, FAIR quantitative models, STRIDE/PASTA threat modeling playbooks, and BIA frameworks ready for production use FAIR Threat-Modeling Risk-Register
🤖 compliance-automation Python-based compliance scanners, SOC 2 & ISO 27001 automated checklists, evidence collection scripts, and continuous compliance monitoring pipelines SOC2 Python Automation
📋 security-policy-library 40+ enterprise-grade security policy templates mapped to NIST CSF, ISO 27001 & CIS Controls — including AUP, ISMS Policy, Access Control, IR, and Vendor Risk Policy Governance Templates
🔍 cybersecurity-audit-toolkit Internal audit programs, control testing workpapers, SOC 2 evidence request lists, and audit report templates aligned to IIA standards Audit SOC2 Control-Testing
🗺️ mitre-attack-grc-mapping Comprehensive mapping of MITRE ATT&CK Enterprise techniques to NIST SP 800-53, ISO 27001 Annex A, and CIS Controls v8 — with detection and mitigation guidance MITRE ATT&CK Control-Mapping

📊 GitHub Analytics

GitHub Streak

🎓 Certifications & Credentials

Certification Issuing Body Domain
Certified Information Security Manager (CISM) ISACA Security Management
Certified Information Systems Auditor (CISA) ISACA Risk Management
ISO/IEC 27001:2013 Lead Auditor TUV-SUD ISMS Auditing
ISO/IEC 42001:2023 Lead Auditor TUV-SUD AIMS Auditing

📬 Let's Connect

I am always open to discussing enterprise GRC strategy, security program design, compliance automation, and the intersection of cybersecurity with business risk. Reach out for collaboration, speaking engagements, or advisory work.

LinkedIn Email

Profile Views

"Governance without risk management is blind. Risk management without governance is powerless."

Popular repositories Loading

  1. cyberzeshan cyberzeshan Public

  2. grc-framework-toolkit grc-framework-toolkit Public

    End-to-end implementation guides for NIST CSF 2.0, ISO 27001:2022 & RMF

  3. risk-management-playbook risk-management-playbook Public

    Enterprise risk registers, FAIR quantitative models & threat modeling playbooks

  4. compliance-automation compliance-automation Public

    Python-based SOC 2, ISO 27001 & PCI-DSS automated compliance scanners

  5. security-policy-library security-policy-library Public

    40+ enterprise-grade security policy templates mapped to NIST, ISO & CIS

  6. cybersecurity-audit-toolkit cybersecurity-audit-toolkit Public

    Internal audit programs, control testing workpapers & SOC 2 evidence request lists