Amisha Khanal

I have a strong interest in Governance, Risk, and Compliance (GRC), with hands-on experience working on ISMS (Information Security Management System) and PIMS (Privacy Information Management System) under ISO/IEC 27001. I actively review and analyze policies to ensure they align with organizational needs and industry expectations. I also work with the NIST framework to document and present policies and frameworks that support compliance.

In my ISMS and PIMS experience, I conduct ISO/IEC 27001 policy review, work with the NIST framework, and document and present the policy and framework. I also support internal audit activities for ISO/IEC 27001:2022 through evidence collection and compliance verification. I perform gap assessments for ISO/IEC 27001 implementation and prepare detailed audit reports with findings and recommendations, so teams can close control gaps effectively.

I’m equally comfortable supporting broader audit work, including NTA audit activities for an Internet Service Provider (ISP), reviewing security controls and compliance with regulatory guidelines. Beyond documentation and reporting, I strengthen my security mindset through practical projects such as developing a cost-effective SEIM tool using Wazuh, Zeek, Graylog, and Grafana, and demonstrating SQL injection attack techniques to communicate real application risks. I’m looking to grow in GRC and security assurance where clear reporting, critical thinking, and continuous improvement directly strengthen organizational controls.