Chia Gareth Leku

Highly skilled GRC specialist experience in governance, risk, and compliance. Competent in security operations, incident response, vulnerability management, policy management cycle, third-party risk management. Proficient in reporting, regulatory compliance, and security operations.

Capable of lowering risk, enhancing security posture, and ensuring industry compliance with regulations (NIST-800-53, NIST CSF, ISO 27001, HIPPA, PCI DSS, SOX, SOC 1&2, and FedRAMP) and best practices. Proficient and experienced in a variety of cybersecurity technologies to streamline security processes within the organization. Possesses the ability to work well in a team, is detail-oriented, and has strong communication skills.

A swift learner and environment adapter who works well in cross-functional teams to improve organizational resilience and apply risk reduction strategies.

Internal Auditor (Remote) - Zillow GROUP - Seattle, USA

(2022-03)

• Conduct risk-based IT audits aligned with frameworks such as NIST CSF, ISO 27001, and PCI DSS to ensure the effectiveness of controls and compliance with regulatory requirements.
• Evaluate IT General Controls (ITGCs) across areas like access management, change control, and system operations for SOX compliance.
• Prepare and present detailed meeting agendas, audit plans, audit reports, including executive summaries, audit findings, and remediation plans, to stakeholders and senior management.
• Collaborate with IT and business teams to design and test controls to mitigate risks identified during internal audits to prepare for external audits.
• Review and validate third-party audit reports, including SOC 1 and SOC 2, for vendor risk management purposes.
• Perform data privacy audits, assessing compliance with GDPR, HIPAA, and CCPA.
• Collaborate with various teams to implement automated testing tools, effectively reduce audit cycle times by 20%.
• Identify and mitigate high-risk vulnerabilities, improving overall system security.
• Conduct security risk assessments, identifying gaps and providing actionable recommendations to enhance compliance.
• Evaluate compliance with PCI DSS standards, including payment processing systems and encryption practices.
• Support incident investigations and provided forensic analysis of affected systems.

Compliance/Third party risk Analyst - Pure Finance - Laurel, Maryland

(2020-11 - 2022-02)

• Built a comprehensive compliance program from the ground up, including policy creation, control library development, and regulatory alignment (GLBA, ISO 27001, NIST CSF).
• Streamlined risk assessments using ServiceNow GRC, automating workflows and improving policy management, compliance tracking, and vendor risk management.
• Created and standardized forms for vendor onboarding, risk assessments, and due diligence, ensuring data consistency and regulatory compliance.
• Developed privacy impact assessment (PIA) forms to evaluate third-party data processing risks and ensure adherence to GDPR and CCPA.
• Collaborated with IT, legal, and procurement teams to create contract review checklists, embedding data protection and incident notification clauses.
• Implemented vendor tiering strategies, categorizing vendors into Critical, High, Medium, and Low risk levels.
• Conduct vendor security reviews to evaluate cloud providers' compliance with SLA and regulatory requirements.
• Reduced vendor onboarding time by 20% through process automation and enhanced risk triage.
• Integrated Power BI to create dynamic dashboards for real-time monitoring of risk and compliance activities.
• Conducted training on ServiceNow GRC module usage, fostering a risk-aware culture across departments.
• Increased alignment with industry standards by conducting gap analyses and updating control implementations.
• Manage identity and access policies, ensuring secure configurations and adherence to least-privilege principles.

Vulnerability/compliance specialist - Aprio - Atlanta, Georgia

(2018-08 - 2020-10)

• Performed vulnerability assessments using Nessus and Qualys, identifying and mitigating risks in IT infrastructure.
• Conducted risk analyses, prioritizing vulnerabilities based on exploit likelihood and business impact.
• Supported compliance audits (SOC 2, ISO 27001, HIPAA) by aligning vulnerability management activities with industry standards.
• Collaborated with engineering teams to remediate vulnerabilities, documenting findings, and addressing false positives.
• Monitored enterprise applications for suspicious activity and escalated potential intrusion incidents.
• Conducted studies on emerging risks and vulnerabilities, keeping the team updated weekly on cybersecurity developments.
• Improved remediation rates by creating actionable reports and facilitating cross-departmental collaboration.
• Enhanced vulnerability management processes, leading to a 15% reduction in open vulnerabilities.

Master's in Business Administration - Business Administration

Master's in Business Management - Business Management

Master's in cyber security - Cyber Security

Bachelor of Computer Science - Cyber Security Technology

Bachelor of Business - Management

Bachelor of Economics - Economics