Edward Legbedion

Security compliance consultant with 8+ years of experience executing ISO 27001, PCI DSS, and NIST-aligned assessments across cloud, on-premises, hybrid, payment, and regulated environments. Certified CISM, CISA, and AWS Certified Security - Specialty, with PCI QSA renewal in progress. Experienced in engagement planning, scoping calls, control testing, evidence review, client interviews, gap identification, assessment reporting, and remediation follow-up.

Known for clear client communication, organized project management, and dependable delivery across multiple deadlines in fast-paced, distributed consulting environments.

Lead PCI DSS Consultant - Cognitor Consulting

(2025-01)

• Plan and execute client-facing security compliance engagements from kickoff through final delivery, including scoping, assessment schedules, evidence requests, control testing, findings, remediation follow-up, and reporting.
• Lead remote scoping calls and working sessions to understand client environments, business processes, cloud services, system boundaries, data flows, third-party relationships, and applicable compliance requirements.
• Review policies, procedures, screenshots, configurations, tickets, reports, and technical records; document testing results in organized workpapers and maintain clear traceability from requirements to supporting evidence.
• Interview control owners and test administrative, technical, and physical controls covering access management, change management, logging, vulnerability management, encryption, network security, and incident response.
• Identify control gaps, explain their business and compliance impact, and provide realistic corrective actions that clients can implement and demonstrate through closure evidence.
• Communicate project status proactively to clients and management, including completed testing, evidence gaps, open questions, emerging risks, upcoming deadlines, and items requiring escalation.
• Prepare client-ready assessment reports, executive summaries, findings, evidence matrices, remediation trackers, ROC/AOC/SAQ support, and clear recommendations for technical and non-technical audiences.
• Manage multiple concurrent assessments across distributed teams and time zones, balancing priorities and maintaining quality, responsiveness, and dependable delivery in a fast-paced consulting environment.
• Partner with security, infrastructure, cloud, application, operations, business, and third-party teams to resolve evidence issues and confirm controls are appropriately designed, implemented, and operating.
• Contribute to consistent assessment delivery by refining evidence requests, workpapers, testing approaches, status trackers, report language, security policies, standards, and procedures.

PCI Program Lead & Senior Risk Consultant - Verizon Business

(2022-08 - 2024-12)

• Executed enterprise ISO 27001, PCI DSS, and NIST CSF risk and compliance activities across large cloud and on-premises environments, supporting assessment planning, testing, reporting, and remediation.
• Led assessment scoping and status discussions with business units and technical teams; confirmed systems, applications, processes, service providers, data flows, responsibilities, timelines, and evidence expectations.
• Performed control interviews and evaluated design and operating effectiveness for access control, change management, logging and monitoring, vulnerability management, encryption, firewalls, segmentation, and incident response.
• Coordinated evidence collection, auditor requests, stakeholder interviews, testing questions, issue escalation, remediation timelines, closure validation, and assessment deliverables.
• Documented assessment procedures, evidence reviewed, test results, exceptions, risks, and recommendations in clear workpapers, control narratives, issue logs, dashboards, and client-ready reports.
• Translated ISO 27001, PCI DSS, and NIST CSF expectations into practical actions for security, engineering, infrastructure, application, operations, internal audit, leadership, and service-provider teams.
• Monitored project milestones, open evidence, dependencies, risks, and corrective actions; communicated status early and clearly to keep assessments moving and protect delivery dates.
• Worked independently and collaboratively across global teams, producing executive summaries, risk reports, remediation dashboards, training guidance, and concise updates for clients and management.

Cloud Security & Compliance Analyst - Cloudticians

(2016-06 - 2022-08)

• Supported ISO 27001, PCI DSS, NIST-aligned, and cloud-security assessments across SaaS, cloud, and hybrid environments containing payment applications, customer data, and regulated systems.
• Assisted with assessment planning, scope documentation, evidence requests, control interviews, workpapers, gap analysis, findings, remediation trackers, and audit-readiness records.
• Reviewed ISMS documentation, security policies, procedures, asset inventories, risk records, network and data-flow diagrams, control narratives, and technical standards for completeness and alignment with requirements.
• Tested AWS and security controls involving IAM, VPC, security groups, CloudTrail, encryption, logging, vulnerability management, segmentation, secure configuration, and shared-responsibility expectations.
• Evaluated evidence using Qualys, Nessus, Splunk, Microsoft Sentinel, cloud-native security services, and ServiceNow; documented exceptions and worked with owners on practical remediation.
• Prepared assessment notes, evidence packages, compliance summaries, risk findings, customer-ready reports, and status updates for technical teams, management, clients, and auditors.