Looking for a job

Derick Dmello

@derickdmello

Message

Cybersecurity & GRC analyst specializing in risk management, compliance audits, and incident response leadership.

India

Message

What I'm looking for

I’m looking to strengthen GRC and security programs across Indian enterprises—using risk management, regulatory frameworks, incident response, and AI/ML security governance to improve control effectiveness, audit readiness, and measurable compliance outcomes.

I’m a Cybersecurity & GRC professional with 3+ years of experience translating technical security risk into business impact. I align security and compliance programs to NIST CSF, ISO 27001, and regulatory requirements—so teams can move faster with stronger governance.

I’ve managed 65+ enterprise risk assessments and led 30+ compliance audits, while also driving 70+ incident response investigations using telemetry, CTI, and SIEM detection. I’m focused on control effectiveness—building risk registers, mapping controls to frameworks, validating evidence, and strengthening audit readiness.

In my roles across state and security environments, I improved outcomes through automation and operational rigor: 90% workflow governance improvement across risk management projects and an 80% reduction in processing time using automated compliance reporting workflows. I also led digital forensics initiatives to accelerate detection and insider-risk workflows.

I bring strong security operations depth (threat detection, MDR/SIEM monitoring, forensics tools, vulnerability assessment) and cloud/GRC coverage (AWS/Azure, IAM, vendor risk, ISMS build-outs). Certified in ISO 27001 Lead Auditing, ISO 42001 Lead Auditing, PCI compliance, and SOC/ethical hacking credentials, I’m excited to strengthen GRC and security programs using emerging AI/ML security and AI governance principles like NIST AI RMF concepts.

Experience

Work history, roles, and key accomplishments

Current

US Cybersecurity Associate

Current

Virtual Testing Foundation

Jun 2025 - Present (1 year)

Built SDLC-governed C2 server and UBA behavioral analytics to strengthen organizational security posture and improve operational efficiency. Led MITRE ATT&CK-based threat assessments using Palo Alto Cortex XDR to enhance detection and response.

SDLC Governance C2 Server Anomaly Detection Palo XDR Threat Assessment Security Analytics

Information Security Analyst

New York State Office of Information Technology Services

Feb 2025 - May 2025 (3 months)

Managed 65+ statewide risk management projects across agencies, improving workflow management and governance by 90%. Conducted risk-based security assessments using RSA Archer and supported third-party/vendor due diligence and emerging AI vendor risk evaluation.

Risk Management Security Assessments RSA Archer Due Diligence Regulatory Compliance Audit Readiness

Cyber Security Analyst

New York State Education Department

Sep 2023 - May 2025 (1 year 8 months)

Led 70+ incident response investigations using SIEM detections, CTI, and NGFW telemetry to rapidly mitigate threats and secure 35,000+ endpoints. Conducted 30+ security and compliance audits aligned to NIST CSF and 800-53R5, directed SOC digital forensics using Autopsy and CrowdStrike, and reduced compliance processing time by 80% via automated reporting workflows.

Incident Response SIEM CTI Next Generation Firewall (NGFW) Telemetry Digital Forensics Autopsy Crowdstrike NIST CSF NIST 800 53 Compliance Automation

GS Cybersecurity Researcher

National Security Agency (NSA)

Sep 2023 - Dec 2023 (3 months)

Developed a security framework to improve cloud observability and accelerate threat detection and response for cloud-native environments. Led a 5-member research team, translating findings into actionable detection improvements and presenting executive reporting to technical directors and program leaders.

Cloud Observability Threat Intelligence Detection Engineering Security Frameworks Team Leadership Executive Reporting Security Research

DFCS Intern

Cyber Secured India

Apr 2023 - Aug 2023 (4 months)

Performed dynamic application security testing (DAST) with Burp Suite to assess and remediate OWASP Top 10 web application vulnerabilities. Conducted endpoint hardening via privilege escalation assessments and supported forensic investigations using Autopsy and Redline to analyze volatile memory for faster incident response.

DAST Burp suite OWASP Top 10 Web Application Security Digital Forensics Autopsy Volatile Memory Analysis