Ranti Adeyiga

Accomplished GRC Analyst with 5+ years of experience implementing and optimizing enterprise-wide risk and compliance programs across financial, technology, and consulting sectors. Skilled in cybersecurity governance, third-party risk management, audit readiness, and privacy compliance using frameworks such as NIST, ISO 27001, SOC 2, HIPAA, PCI-DSS, and COBIT. Proficient in Archer, ServiceNow, OneTrust, Axio, and LogicGate for automating risk assessments and control testing, with expertise in ITGC controls, FAIR-based risk quantification, and regulatory alignment.

Adept at leading SOX, SOC 2, and ISO 27001 readiness and ensuring GDPR, CCPA, and FedRAMP compliance. Recognized for collaborating with Legal, Procurement, and Engineering teams to strengthen security controls and enhance enterprise resilience.

Governance Risk and Compliance Analyst (GRC) at McKinsey & Company (2023-07 – Present)

• Implemented enterprise-wide risk and compliance frameworks aligned with NIST CSF, ISO 27001, and COBIT, strengthening internal contr
• Executed 50+ control assessments annually within RSA Archer GRC, identifying control gaps and reducing repeat findings across business u
• Performed cyber risk quantification using FAIR and Axio, translating technical threats into financial impact metrics to guide executive decis
• Maintained a centralized Risk Register leveraging FAIR-based scoring to prioritize enterprise risks by likelihood and impact.
• Developed and enforced data governance and privacy policies in alignment with GDPR, CCPA, and global data protection standards.
• Managed SOX ITGC testing cycles, including walkthroughs, evidence collection, and remediation tracking for timely compliance reporting.
• Partnered with Procurement and Vendor Risk teams to integrate cybersecurity standards into vendor onboarding, reducing onboarding time b
• Facilitated annual Business Impact Analyses (BIA) for 45+ critical systems, defining RTOs/RPOs and enhancing business continuity plannin
• Led ISO 27001 certification readiness, preparing documentation and validating evidence, resulting in zero major nonconformities.
• Conducted phishing simulations and security awareness training, improving detection rates by 60% and reducing social engineering risk.
• Evaluated third-party vendors using AICPA Trust Services Criteria and SIG Lite, supporting vendor selection and security due diligence.
• Collaborated with Legal, Privacy, and Procurement teams to draft and review Data Processing Agreements (DPAs) ensuring compliance wit
• Monitored emerging SEC, FTC, and industry compliance updates, advising leadership on evolving risk and regulatory strategy adjustments.

Information Security Risk Analyst at DXC Technology (2021-07 – 2023-07)

• Executed enterprise-wide cybersecurity risk assessments using NIST SP 800-30 and ISO 27005, identifying and mitigating critical risk expo
• Built interactive Power BI dashboards and risk heatmaps to visualize trends, highlight high-impact risks, and deliver actionable insights to le
• Managed the full SOC 2 Type II audit lifecycle, including gap analysis, remediation tracking, and evidence management, ensuring successfu
• Enhanced third-party risk management through OneTrust, expanding assessment coverage and cutting review cycle times by 40%.
• Partnered with Legal and Procurement to close contractual data protection gaps and refine security/privacy clauses in vendor agreements.
• Led ransomware simulation and tabletop exercises, strengthening response readiness and clarifying stakeholder roles.
• Worked with Engineering and DevOps teams to embed secure coding and automated security gates in CI/CD pipelines, reducing vulnerabili
• Conducted HIPAA Security Rule assessments for healthcare clients, identifying PHI exposure risks and implementing mitigation strategies.

Bachelor's degree in Computer Science – University of Ilorin (Unilorin) (2015-05 – 2019-05)