Christina Ross

I’m a results-driven GRC & compliance program leader with 14+ years building and scaling enterprise governance, risk, and compliance programs in highly regulated industries. I architect and operate third-party risk management that supports 125+ active vendors and ~60 annual onboardings.

I’ve achieved zero findings across SOX ITGC/ICFR, NIST CSF, and NY DFS external audits by owning end-to-end evidence collection, audit walkthroughs, control testing, and auditor coordination. I translate complex regulatory requirements into practical, scalable controls trusted by executive leadership, legal, and technical stakeholders.

My depth spans NIST CSF 1.0 & 2.0, NIST 800-53, SOX, CCPA, NY DFS 23 NYCRR 500, HIPAA, and SOC 1/2. I lead vulnerability management program development, conduct M&A security and risk diligence, drive regulatory attestation, and design security awareness programs mapped to the threat landscape—backed by measurable execution.

I also strengthen organizational resilience through CSIRP and BCP support, disaster recovery planning and facilitation, and cross-functional tabletop exercises. Today, I’m expanding into business analytics (Springboard, 2025-2026 / In Progress, 2026) to bring data-driven risk intelligence to compliance programs.