Open to opportunities

Gustavo Martins

@gustavomartins1

I build global security governance, third-party risk, and controls assurance programmes for regulated organizations.

At Wise, I own third-party assurance methodology, control libraries, and risk-tiering for 150+ vendors across 30+ markets, reducing assessment cycle time from 25 to 14 days while achieving 100% tier-1 supplier coverage. Previously at Johnson & Johnson, I led global security contract governance across 900+ supplier contracts annually and set the security risk position for 200+ applications across 12 Latin American countries.

I've built and led security, GRC, and audit teams of up to 22 people across global regulated environments, including healthcare, fintech, assurance, and technology. My work spans ISO 27001, SOC 2, NIST, SOx, GDPR, DORA, HIPAA, security contracting, audit leadership, and executive risk decisions.

Experience

Work history, roles, and key accomplishments

Current

Third-Party Assurance Manager

Current

Wise

Apr 2026 - Present (4 months)

Owns the assurance methodology, control library, and risk-tiering criteria for 150+ third parties across 30+ markets. Directs vendor remediation and rebuilt assessment intake, cutting cycle time from 25 to 14 days.

Third Party Risk Management ISO 27001 NIST GDPR DORA Risk Assessment Vendor Management AI

SOC / HIPAA Audit Manager

Insight Assurance

Feb 2025 - Apr 2026 (1 year 2 months)

Led an audit team of 8 across SOC 2 and HIPAA engagements, directing IT audit execution end to end. Owned client relationships at executive level and built a coaching model for junior auditors.

SOC HIPAA Audit Management Team Leadership Client Relationship Management AI Coaching

Senior Manager, Global Security Controls Governance

Johnson & Johnson

Jun 2024 - Apr 2026 (1 year 10 months)

Owned global security contract governance end to end, leading a team of 6 and managing security terms across 900+ supplier contracts annually. Set the global security contract language standard and approved all deviations.

Security Governance Contract Management Third Party Risk Management AI Metrics Reporting

Senior Manager – Business Information Security Officer

Johnson & Johnson

Aug 2019 - Jun 2024 (4 years 10 months)

Accountable for information security strategy, budget, and risk across Corporate Affairs and Medical Devices systems in Latin America. Owned SOx IT controls testing and data classification with no significant deficiencies.

Information Security Strategy Risk Management SOX Data Classification Audit Compliance Project Management Budget Management

Staff GRC Engineer

Loadsmart

Oct 2021 - Jan 2023 (1 year 3 months)

Sole owner of the GRC function, setting security strategy and building policy set, risk framework, and internal controls from zero. Owned SOC 2 readiness end to end, achieving Type II report in 9 months.

GRC SOC II Risk Management Policy Development Security Strategy Due Diligence

Governance, Risk and Compliance Lead

Wipro Limited

Jan 2018 - Aug 2019 (1 year 7 months)

Led a GRC team of 22 supporting IT delivery, owning risk identification, tracking, and executive reporting. Established governance framework for system deliverables across Privacy, SOx, and GxP regulated scope.

GRC Risk Management Team Leadership Privacy SOX GxP Budget Management

IT Service Delivery Coordinator – Risk Operations

Embraer

Jun 2016 - Jan 2018 (1 year 7 months)

Owned Change Management for 250+ changes monthly, chairing CAB review for compliance, risk, and scheduling. Directed vendor teams and automated privileged access review, cutting manual effort by 40%.

Change Management Risk Operations Vendor Management Automation Privileged Access Management