Aim Osagie

Highly impactful Cybersecurity GRC professional with 7+ years of experience across governance, risk management, third-party risk, audit, and regulatory compliance. Proven ability to build scalable compliance programs, strengthen risk governance, support audits, and partner across teams to enable secure business growth and operational resilience.

Information Security Specialist - TD Bank - Canada

(2023-10)

• Maintained and reviewed security policies, standards, and procedures aligned with PCI-DSS, NIST CSF, NIST SP 800-53, ISO/IEC 27001/27002, and banking regulatory requirements (OSFI B-13 Guidelines).
• Led 25+ cybersecurity and vendor risk assessments across infrastructure environments, identifying control deficiencies and driving remediation efforts that reduced high-risk findings by 30%.
• Partnered with Engineering, Infrastructure, Legal, Audit, and Business stakeholders to interpret regulatory requirements, assess scope applicability, and implement scalable controls that strengthened governance and audit readiness.
• Developed and maintained risk registers and Power BI governance dashboards supporting 50+ technology risks, improving remediation visibility and reducing risk reporting preparation effort by 35%.
• Interpreted regulatory and industry requirements, translating obligations from OSFI B-13, PCI-DSS, NIST, and ISO 27001 into actionable control requirements and governance processes.
• Conducted regulatory applicability and scoping assessments to determine which systems, processes, vendors, and business functions were subject to specific compliance obligations.
• Coordinated audit walkthroughs, evidence collection, and stakeholder engagements across technology teams, reducing audit response timelines and improving quality of audit deliverables.
• Led IT General Controls (ITGC) and IT Application Controls (ITAC) assessments across critical banking applications and infrastructure, identifying control deficiencies and driving remediation activities that improved audit readiness and reduced compliance risk.
• Performed design and operating effectiveness testing of access management, change management, system development lifecycle, and operational controls, strengthening SOX compliance and supporting successful internal and external audit outcomes.
• Designed and implemented TPRM and information risk frameworks, standardizing vendor risk intake, assessment methodologies, and escalation workflows across multiple business units, thereby improving consistency and regulatory alignment with OSFI B-10 Guidelines and internal risk standards.
• Conducted security and vendor risk assessments across systems, infrastructure, and third-party environments, identifying control gaps and driving remediation activities that reduced residual risk exposure.
• Reviewed third-party SOC 1 and SOC 2 reports supporting critical banking services, assessing complementary user entity controls (CUECs) and ensuring third-party risks were appropriately managed and documented.
• Developed reusable assessment templates, control mappings, and reporting workflows that improved consistency across risk and compliance activities.
• Developed executive-ready audit and risk reporting materials, translating complex technical findings into actionable recommendations for senior leadership and governance committees.

Risk & Compliance Consultant - KPMG (Jedidy Consulting) - Canada

(2020-02 - 2023-09)

• Led ISMS design and continuous improvement initiatives for regulated clients, aligning security governance, risk management, control monitoring, and compliance activities with ISO 27001 standards, resulting in improved certification readiness, audit outcomes, and organizational security maturity.
• Managed the end-to-end risk management lifecycle, including risk identification, analysis, prioritization, and treatment, by maintaining enterprise risk registers, leveraging GRC platforms (ServiceNow, OneTrust) to document risks, assign ownership, track remediation actions, monitor residual risk, and report risk posture and trends to governance and leadership forums.
• Delivered technology risk, cybersecurity, and compliance advisory engagements for financial services clients, evaluating governance frameworks, operational controls, and regulatory compliance obligations with PIPEDA, GDPR and OSFI Guidelines for FRFIs.
• Conducted IT risk assessments and control evaluations aligned with NIST, ISO 27001, COBIT, and SOX requirements, improving visibility into key risk exposures and remediation priorities.
• Developed centralized compliance mapping and control inventory processes that reduced duplicate testing efforts across multiple frameworks and improved audit readiness.
• Led ITGC and ITAC security control assessments for financial services and regulated industry clients, evaluating access management, change management, system operations, and financial reporting controls to support SOX compliance objectives.
• Executed Tests of Design (ToD) and Tests of Operating Effectiveness (ToE) across critical IT controls, identifying deficiencies and providing risk-based remediation recommendations that improved control maturity.
• Coordinated management walkthroughs, evidence validation, and audit testing activities, contributing to successful external audit engagements and regulatory examinations.
• Performed 40+ third-party risk assessments and due diligence reviews for vendors supporting critical business processes, identifying control deficiencies and recommending mitigation strategies.
• Evaluated SOC 1 and SOC 2 reports, vendor security questionnaires, and supporting control evidence to assess third-party compliance with regulatory and contractual requirements.
• Supported the implementation and enhancement of third-party risk management programs in line with OSFI B-10 Guidelines, strengthening vendor governance, risk monitoring, and compliance oversight.
• Collaborated with Procurement, Legal, Risk, and Technology teams to assess vendor risks and establish remediation plans for identified control gaps.
• Developed and maintained risk registers, control documentation, and governance reports, improving visibility into enterprise risk exposure and supporting executive decision-making.
• Standardized evidence collection workflows and centralized compliance documentation repositories, reducing manual audit preparation effort and improving assessment efficiency.
• Owned business continuity and disaster recovery governance in line with OSFI E-21 Guidelines, by reviewing BCP/DR documentation, validating testing evidence, identifying control gaps, and working with technology and business owners to improve recovery readiness and audit defensibility.
• Led enterprise PCI-DSS scoping exercises across infrastructure, applications, payment systems, and third-party service providers for regulated clients, validating Cardholder Data Environment (CDE) boundaries and reducing scope.

MSc.