Moses Uchenna Victor

Cyber security professional with experience supporting secure enterprise transformation across cloud, infrastructure, networking, identity and access management (IAM), and enterprise technology environments within regulated organisations. Experienced in defining security requirements, conducting security architecture reviews, threat modelling, security risk assessments, and embedding Secure by Design principles into solution delivery. Skilled at translating business and technical requirements into secure, resilient, and scalable architectures aligned with ISO 27001, NIST CSF, CIS Controls, Zero Trust, and GDPR.

Digital Project Manager (Secure by design Assurance, Pen-testing & Cyber & Infrastructure Transformation) - MHRA

(2025-02)

• Supported security architecture assurance across enterprise infrastructure, cloud and digital transformation programmes by coordinating High-Level Design (HLD) reviews, identifying security risks, tracking remediation activities and ensuring security requirements were addressed before implementation.
• Supported security assurance activities for the HPE Hybrid Cloud adoption programme by coordinating design reviews, assessing security risks and contributing to security requirements relating to identity and access management, network security, infrastructure resilience and governance.
• Supported security governance and assurance activities for Microsoft Purview Information Protection, Data Loss Prevention (DLP) and Insider Risk Management initiatives, contributing to policy implementation, information protection and secure handling of sensitive organisational data.
• Coordinated security assurance for the CLUE–Police National Database (PND) integration by supporting penetration testing, tracking remediation activities, reviewing security findings and contributing to governance approval before production deployment.
• Supported cyber risk assessments across cloud, infrastructure, supplier and technology transformation initiatives by challenging technical assumptions, identifying delivery risks and contributing to risk treatment planning aligned with the organisation's risk appetite.
• Supported security governance activities aligned with the Cyber Assessment Framework (CAF), DSPT, operational resilience and internal risk management practices, contributing to governance reviews, executive reporting and audit readiness across regulated technology programmes.
• Collaborated with Solution Architects, Infrastructure Engineers, Cyber Security teams, suppliers and senior stakeholders to support architecture assurance, governance forums, remediation tracking and secure-by-design decision-making throughout the project lifecycle.

Project Manager – EPR, Cyber, Risk Governance & Operational Resilience - Royal Cornwall Hospitals NHS Trust

(2024-09 - 2025-02)

• Supported governance oversight across EPR transformation activities within a regulated NHS environment
• Supported cyber governance and assurance across the Electronic Patient Record (EPR) transformation programme by coordinating governance activities, identifying programme risks and supporting secure delivery within a regulated NHS environment.
• Supported risk assessments relating to operational, technology, GDPR and UK Data Protection Act requirements, contributing to risk mitigation and governance decisions throughout the EPR programme lifecycle.
• Supported Information Governance and DSPT assurance activities, contributing to compliance, information protection and governance reviews across digital healthcare transformation initiatives.

Security Architect - XtraTechNG

(2021-12 - 2022-05)

• Defined security requirements for the implementation of a Salesforce SaaS CRM platform, reviewing solution architectures and integration designs to ensure identity, encryption, API security, audit logging and data protection controls were incorporated before deployment.
• Designed and implemented an ISO/IEC 27001 Information Security Management System (ISMS) by developing security policies, standards, risk assessment methodologies, Statement of Applicability (SoA), risk treatment plans and governance artefacts that improved organisational security maturity and audit readiness.
• Conducted Security Architecture and Design Assurance reviews of an AWS-hosted mobile banking solution, identifying architectural risks, challenging design assumptions, performing STRIDE threat modelling, defining security requirements, and producing Security Architecture Review (SAR) reports with recommendations aligned to NIST CSF and NIST SP 800-53 before implementation.
• Produced Security Architecture Review (SAR) reports, Security Requirements Specifications (SRS), Control Gap Assessments and executive risk recommendations, enabling stakeholders to make informed design and investment decisions before solution implementation.
• Defined secure integration requirements for SaaS platforms and third-party services, ensuring authentication, encryption, API security, logging and least-privilege access controls protected sensitive business information throughout the integration lifecycle.
• Partnered with business stakeholders, Solution Architects and technical teams to translate business objectives into secure solution designs, embedding Secure by Design principles while balancing compliance, operational resilience and delivery objectives.
• Provided security architecture assurance for Secure SDLC and CI/CD pipeline designs by defining security requirements for source code repositories, branch protection, code review, build pipelines, software supply chain security, SAST, DAST, SCA, SBOM generation, container and Kubernetes security, IaC scanning, secrets management, artifact signing, deployment security and security approval gates, ensuring security controls were embedded throughout the software development lifecycle before product
• Performed Security Architecture Reviews for enterprise AI/LLM solutions, defining security requirements and controls for Azure OpenAI, RAG, IAM, API security, AI governance, data protection, and Zero Trust architectures.

Cyber Security Architect (Cloud, Infrastructure & Secure Design) - Vatrac Consulting

(2018-01 - 2021-12)

• Defined security requirements for an enterprise Azure cloud migration programme, reviewing High-Level Designs (HLDs), cloud architectures and security patterns to ensure identity, network segmentation, encryption, monitoring and resilience controls were embedded before implementation, enabling the secure migration of business-critical workloads.
• Conducted Security Architecture and Design Assurance reviews of AWS, Azure and hybrid cloud solutions, reviewing High-Level Designs (HLDs), Data Flow Diagrams (DFDs), interface tables and solution architectures; identifying architectural risks, challenging design assumptions, performing STRIDE threat modelling, defining security requirements, and producing Security Architecture Review (SAR) reports with recommendations aligned to NIST CSF and NIST SP 800-53 before implementation.
• Performed architecture risk assessments and STRIDE-based threat modelling across cloud, infrastructure, network and application designs, identifying security risks, validating compensating controls and recommending pragmatic remediation aligned with business objectives and organisational risk appetite.
• Produced Security Requirements Specifications (SRS), Security Architecture Review (SAR) reports, Threat Models and Control Gap Assessments, providing clear design recommendations to Solution Architects, Infrastructure Engineers and project teams before implementation.
• Reviewed and assured identity, network and application security architectures, defining requirements for MFA, RBAC, privileged access, network segmentation, WAF, VPN, logging and API security to strengthen defence-in-depth and reduce architectural risk.
• Collaborated with Enterprise Architects, Solution Architects, Cloud Engineers and delivery stakeholders to challenge design decisions, provide architecture assurance, justify security controls and balance security, resilience, cost and delivery priorities.
• Provided architecture assurance throughout the solution lifecycle, presenting security risks, design decisions and remediation recommendations to architecture governance forums, ensuring solutions aligned with ISO 27001, NIST CSF, NIST SP 800-53, CIS Controls, Zero Trust and GDPR principles.
• Led end-to-end Security Architecture for a cloud-hosted Patient Care Management Platform, conducting Security Architecture Reviews (SARs), security requirements engineering, HLD/LLD reviews, STRIDE threat modelling, architecture risk assessments, stakeholder engagement and security approval across the project lifecycle.