Femi Daramola

Cybersecurity and AI governance professional with 7+ years of experience across security operations, incident response, identity and access management, vulnerability management, cloud security, IT audit, and responsible AI governance. Experienced in enterprise AI risk assessments, use-case intake, third-party risk reviews, control design, and continuous monitoring using ISO/IEC 42001, ISO/IEC 27001, NIST AI RMF, NIST, GDPR, HIPAA, and the EU AI Act. Skilled in Microsoft Sentinel, Microsoft Defender, CrowdStrike Falcon, Microsoft Purview, Azure, AWS, SIEM, EDR, and cross-functional risk remediation.

Senior AI Ethics and Governance Analyst at ARCOVA (2024-02 – Present)

• Execute enterprise AI risk and readiness assessments using ISO/IEC 42001, ISO/IEC 27001, NIST AI RMF, and internal control requirements; identified 20% of regulatory vulnerabilities and strengthened remediation tracking.
• Manage AI use-case intake, risk classification, impact assessments, solution reviews, and governance evidence from initial scoping through approval, deployment, and ongoing monitoring.
• Evaluate internal and third-party AI solutions, including machine learning, generative AI, LLM, GAN, and RAG use cases, for explainability, accountability, security, transparency, privacy, fairness, and human oversight.
• Align AI governance decisions, enterprise policies, data practices, and risk mitigation plans with the EU AI Act, HIPAA, GDPR, America's AI Action Plan, NIST AI RMF, and applicable state and federal requirements.
• Lead scoping sessions with business owners and cross-functional stakeholders to assess business purpose, contractual restrictions, data use, vendor credibility, failure modes, monitoring obligations, and control ownership.
• Established risk-tiering procedures, security questionnaires, due-diligence reviews, and governance checkpoints for legal, privacy, information security, procurement, compliance, and stakeholder approval.
• Integrated model risk management and governance checkpoints into the SDLC and AI lifecycle, covering model documentation, validation records, testing, risk acceptance, incident escalation, and quality controls.
• Developed AI policies, standards, guidelines, playbooks, model cards, intake processes, exception criteria, escalation paths, and controls to disable, pause, or restrict AI functionality when required.
• Implemented continuous monitoring controls for model drift, hallucinations, bias, data quality, control effectiveness, user acceptance, and remediation status to support timely corrective action.
• Created and delivered governance training for executives, business teams, platform owners, and control functions on generative AI compliance, shadow AI, regulatory sensing, inventory management, and responsible AI practices.
• Manage AI inventories, data products, business glossaries, data owners, lineage, governance workflows, and a centralized SharePoint site to improve traceability, ownership, and audit readiness.
• Develop executive dashboards, scorecards, KPIs, KRMs, milestone tracking, and management reports covering AI risk trends, approvals, control performance, adoption, outstanding issues, and remediation progress.
• Partner with engineering, legal, privacy, security, procurement, internal audit, and the Siemens AI Governance Consortium to review AI security posture, vendor models, contractual controls, and ethical AI requirements.
• Improved governance workflows and decision models, reducing compliance gaps by 25% while strengthening documentation, portfolio oversight, stakeholder engagement, and operational efficiency.

Information Security Analyst, IAM and Incident Response at ELLITS GROUPS (2023-02 – 2024-01)

• Monitor and investigate security alerts across endpoint, cloud, identity, and network environments using Microsoft Sentinel, CrowdStrike Falcon, and Microsoft Defender.
• Analyze logs, endpoint telemetry, authentication activity, VPN records, and network events to identify threats, determine impact, and establish incident timelines.
• Perform incident triage, containment, eradication, recovery, and post-incident review; correlate SIEM, EDR, Azure AD, email security, and network data for root cause analysis.
• Support IAM reviews, vulnerability remediation, security audits, case documentation, escalation, and control improvements with IT and engineering teams.

Incident Responder / Threat Analyst / Vulnerability Management Analyst at Mt SINAI (2020-09 – 2023-01)

• Performed Tier II/III monitoring and investigations involving phishing, malware, credential compromise, brute-force attempts, and suspicious user activity across SIEM and EDR platforms.
• Analyzed Windows event logs, authentication records, endpoint telemetry, and network traffic to identify indicators of compromise and manage incidents through remediation.
• Applied MITRE ATT&CK to strengthen detection coverage and response effectiveness; conducted vulnerability assessments and coordinated remediation with infrastructure teams.
• Supported compliance assessments and security control reviews aligned with NIST and ISO 27001 while maintaining accurate case and investigation records.

Information Security Systems Analyst at Nuance Communications (2019-09 – 2020-08)

• Administered Active Directory accounts, access controls, and least-privilege practices across Windows environments.
• Monitored system activity, investigated security anomalies, and escalated incidents based on risk and established procedures.
• Supported network security controls, firewalls, access management processes, and ServiceNow incident and request documentation.

M.S. in Cybersecurity – Utica University (2020-07)