Rashidat Idrees

GRC & Cybersecurity Analyst with over 7 years of experience supporting enterprise Governance, Risk, and Compliance (GRC), cybersecurity, information security, IT auditing, and regulatory compliance initiatives across complex enterprise environments. Extensive experience performing enterprise risk assessments, security control evaluations, third-party/vendor risk assessments, vulnerability management, incident response support, user access reviews, and compliance monitoring while partnering with cross-functional stakeholders to strengthen organizational security posture. Possess a comprehensive understanding of NIST Cybersecurity Framework (CSF), SSAE 18 (SOC 1 & SOC 2), ISO/IEC 27001, PCI-DSS, GDPR, SANS Critical Security Controls, and PHIPA, with hands-on experience supporting compliance initiatives, internal and external audits, evidence collection, security control assessments, remediation tracking, and governance programs.

Risk Analyst - Cognizant

(2025-09)

• Conduct risk assessments to identify and evaluate information security risks across business operations and third-party environments.
• Review vendor security documentation and assessment questionnaires to evaluate security controls and compliance requirements.
• Monitor security events and incidents using Microsoft Sentinel and Microsoft Defender for Endpoint, escalating findings as appropriate.
• Support vulnerability management activities by reviewing scan results and collaborating with stakeholders to address identified risks.
• Track incidents, risk remediation activities, and change requests using ServiceNow and Jira.
• Prepare risk reports and dashboards using Microsoft Excel and Power BI to support management decision-making.
• Collaborate with business, security, and technology teams to support compliance initiatives and strengthen organizational risk management practices.
• Conducted enterprise-wide cyber risk assessments and documented mitigation strategies.
• Reviewed third-party vendor security questionnaires, SOC reports, and risk documentation.
• Participated in vendor risk assessments and third-party security reviews.
• Performed periodic user access reviews ensuring least-privilege access and regulatory compliance.
• Supported incident investigations and post-incident corrective actions.

Information Systems Audit - Themesoft Inc.

(2020-01 - 2025-09)

• Conducted enterprise IT risk assessments to identify security, operational, and compliance risks across business applications, infrastructure, and cloud environments.
• Spearheaded the development and implementation of NIST Cybersecurity Framework (CSF) compliance measures, contributing to successful audits and continued adherence to security standards.
• Provided crucial support for internal and external audits by coordinating evidence collection, managing audit artifacts, reviewing findings, and contributing to successful SOC 2 Type II audit engagements.
• Supported the enhancement and maintenance of compliance management programs for internal controls, ensuring continued compliance with SOC 2 and ISO/IEC 27001 security requirements.
• Evaluated IT General Controls (ITGCs), logical access controls, change management processes, and system configurations to strengthen the organization's security posture.
• Performed security control assessments against NIST CSF, ISO 27001, SOC 1, SOC 2, PCI-DSS, GDPR, SANS Critical Security Controls, and PHIPA requirements.
• Conducted vendor and third-party risk assessments by reviewing SOC reports, security questionnaires, policies, and compliance documentation.
• Evaluated identity and access management controls using Microsoft Entra ID (Azure AD) and Active Directory, including periodic user access reviews and privileged access validation.
• Supported vulnerability management activities using Nessus, Tenable.io, and security assessment tools by identifying, prioritizing, and tracking remediation of security weaknesses.
• Collaborated with infrastructure, security, and business teams to implement corrective actions and strengthen governance, risk, and compliance programs.

Risk Analyst (Contract) - Nestlé

(2018-10 - 2020-01)

• Conducted enterprise risk assessments to identify cybersecurity, operational, and compliance risks affecting business processes and technology environments.
• Supported governance, risk, and compliance initiatives by evaluating security controls and recommending improvements aligned with organizational risk objectives.
• Assisted with implementation and maintenance of NIST Cybersecurity Framework (CSF) compliance measures to support audit readiness and strengthen security governance.
• Supported internal and external audit activities by coordinating audit evidence, collecting artifacts, responding to auditor requests, and tracking remediation efforts.
• Assisted in maintaining compliance programs supporting SOC 2, ISO/IEC 27001, and internal control requirements.
• Performed vendor and third-party risk assessments by reviewing security documentation, compliance reports, and security questionnaires.
• Maintained enterprise risk registers, documenting identified risks, mitigation strategies, and remediation status.
• Collaborated with stakeholders to evaluate business risks and prioritize remediation activities based on organizational risk tolerance.
• Assisted with vulnerability management activities by tracking remediation efforts and validating corrective actions.
• Participated in user access reviews and identity governance activities to ensure compliance with least-privilege principles.
• Supported incident response activities by documenting security incidents, coordinating follow-up actions, and assisting with root cause investigations.
• Prepared executive risk reports, compliance dashboards, and risk metrics for management review.
• Monitored compliance with corporate security policies, regulatory requirements, and industry best practices.
• Worked with business, security, and technology teams to improve security controls and strengthen enterprise risk management processes.
• Contributed to continuous improvement initiatives that enhanced governance, audit readiness, and overall cybersecurity maturity.

Master of Business Administration - MBA - University Canada West

Bachelor of Science - Accounting and Auditing - Kyiv National University of Construction and Architecture