Russell Broad

Cybersecurity GRC, IT audit, and compliance professional with 20+ years of experience leading risk assessments, compliance reviews, audit evidence collection, corrective-action management, policy development, third-party oversight, and executive reporting in regulated commercial, defense, and federal-contractor environments. Combines cybersecurity education, active CompTIA Security+ certification, military IT administration experience, and hands-on GRC project work with established leadership in enterprise risk governance and regulatory compliance. Familiar with NIST SP 800-53, NIST SP 800-30, NIST CSF, NIST SP 800-171, ISO 27001, SOC 2, HIPAA, risk registers, control testing, security-policy development, and SOC 2 readiness activities in VANTA.

Regional EHS Manager at CAE USA (2025-11 – 2026-08)

• Led multi-site risk and compliance initiatives in a regulated, defense-adjacent environment, maintaining risk registers, assigning mitigation ownership, and driving corrective-action plans through closure.
• Planned and led internal compliance assessments; coordinated stakeholders, collected and organized evidence, documented findings, and delivered risk-based recommendations to leadership.
• Managed contractor and third-party compliance expectations, including qualification reviews, documentation assessment, access-related requirements, and corrective-action follow-up.
• Developed policies, standard operating procedures, internal controls, and training that translated regulatory and operational requirements into repeatable field processes.
• Prepared leadership reporting on compliance status, audit findings, remediation progress, risk trends, and emerging operational issues.
• Maintained an active U.S. Secret security clearance while supporting a regulated aerospace and defense organization.

GRC Analyst / IT Auditor at Inteligy Tampa Bay LLC (2020-03 – Present)

• Assessed security controls, access-management practices, operational policies, and governance processes supporting telephony and communications environments.
• Performed third-party integration risk reviews for APIs, CRM synchronizations, and soft phone deployments, evaluating control considerations affecting data integrity and operational resilience.
• Reviewed disaster-recovery, business-continuity, and automated-fax security processes to identify gaps and support continuity and compliance objectives.
• Tested access policies and centralized network configurations, documenting control gaps and recommending risk-mitigation actions.
• Partnered with technical and business stakeholders to gather evidence, clarify control ownership, and support remediation of identified issues.

GRC Analyst / Governance, Risk & Compliance Analyst at Roers Companies (2023-11 – 2025-05)

• Partnered with IT and project stakeholders during deployment of a cloud-based management platform, supporting secure-access practices and identity-and-access-management control considerations.
• Maintained compliance evidence supporting regulatory reviews, enterprise risk assessments, and third-party audit activity; improved reporting accuracy by 20% through standardized governance workflows.
• Identified operational and compliance risks, documented control gaps, assigned corrective actions, and tracked remediation with cross-functional stakeholders.
• Translated complex regulatory requirements into audit-ready documentation, repeatable procedures, and leadership-ready risk reporting.
• Supported governance processes across field operations, vendor relationships, training, documentation, and corrective-action tracking.

GRC Intern at Lemonav (2024-05 – 2025-02)

• Coordinated control-evidence collection for compliance audit activities; documented testing results, maintained audit-ready records, and tracked corrective-action plans.
• Conducted vendor due-diligence and third-party risk assessments by reviewing control documentation, identifying operational risks, and maintaining risk-register updates.
• Drafted information-security policies and standard operating procedures aligned with NIST, SOC 2, HIPAA, and ISO 27001 principles.
• Supported risk and compliance stakeholders with control documentation, policy research, remediation tracking, and governance reporting.

Information Systems Administrator, IT-2735 | Petty Officer Second Class (E-5) at United States Navy (1996-09 – 2006-10)

• Administered and supported Navy networks, operating systems, servers, messaging infrastructure, and site services.
• Performed troubleshooting, technical support, corrective actions, system maintenance, and end-user instruction in operational IT environments.
• Completed Second Class Petty Officer Leadership School and earned multiple Navy and service awards.

Master of Science in Information Technology — Cybersecurity – Florida Institute of Technology

Bachelor of Science in Occupational Safety & Health