Open to opportunities

Janet Ooko

@janetooko

Message

Senior GRC Analyst driving compliant security controls across regulated healthcare.

Zimbabwe

Message

What I'm looking for

I’m looking to advance in GRC and IT compliance roles where I can run security risk assessments, keep risk registers current, coordinate audit readiness, and improve control maturity across healthcare and regulated environments.

I’m a Senior Governance, Risk & Compliance (GRC) Analyst with 5+ years of experience executing security compliance programs, risk assessments, and audit readiness in regulated healthcare environments. I guide stakeholders through SOC 2, ISO 27001, HIPAA, PCI-DSS, and NIST CSF initiatives by translating security requirements into practical controls, remediation plans, and governance improvements.

In my roles, I’ve managed governance activities across 50+ systems, applications, vendors, and business processes, leveraging GRC platforms to streamline evidence collection, risk tracking, control mapping, and continuous compliance. I coordinate audits, validate compliance artifacts, develop policies and procedures, and communicate complex requirements clearly to technical and non-technical partners.

Experience

Work history, roles, and key accomplishments

Current

IT Compliance Specialist

Current

Montana State Hospital

Dec 2024 - Present (1 year 7 months)

Advised IT, security, privacy, and business stakeholders on SOC 2, ISO 27001, HIPAA, PCI-DSS, and NIST CSF requirements, translating them into control improvements. Managed security risk assessments across 50+ systems and coordinated audit readiness through compliance evidence collection and documentation in ServiceNow GRC.

GRC SOC ISO 27001 HIPAA PCI DSS NIST CSF Security Assessments Control Evidence Collection Audit Preparation ServiceNow GRC Policy Governance

HIPAA Compliance Analyst

Providence Mother Joseph Care Centre

Mar 2023 - Nov 2024 (1 year 8 months)

Performed healthcare security risk assessments against HIPAA and related compliance frameworks including SOC 2, ISO 27001, PCI-DSS, and NIST CSF. Supported audit preparation by coordinating evidence requests and validating compliance artifacts, and created policy/procedure updates to strengthen security governance.

HIPAA SOC ISO 27001 PCI DSS NIST CSF Security Assessments Audit Preparation Policy Updates

Vendor Risk Analyst

Eastern State Hospital

Nov 2020 - Feb 2023 (2 years 3 months)

Conducted third-party security assessments for 50+ vendors by reviewing security questionnaires, SOC reports, and compliance documentation. Maintained vendor risk registers and remediation trackers using RSA Archer and ServiceNow GRC to support security due diligence.

Third Party Risk Management SOC ISO 27001 HIPAA PCI DSS remediation RSA Archer ServiceNow GRC Procurement Legal and IT Stakeholder Collaboration

Junior IT Auditor

Polyflex Industries Ltd

Feb 2018 - Oct 2020 (2 years 8 months)

Executed IT control assessments across 25+ systems and business processes by reviewing access controls, operational procedures, and governance documentation. Prepared audit workpapers and evidence packages for audit readiness and helped identify control gaps through walkthroughs and stakeholder communication.

Access Control Evidence Packages Audit Readiness Control Reviews Walkthroughs Policy Reviews Continuous Improvement