Jason Moseley

Acted as lead GRC advisor on a major transformation, designing and delivering a unified GRC operating model and TPRM framework that improved control assurance and regulatory compliance (ISO 27001, NIST CSF, NIS2).

Conducted independent audits of organisations' ISMS against ISO 27001 and assessed documentation, controls, and operational practices to determine certification readiness and continued compliance.

Provided audit and consultancy services for ISO27001 certifications, delivering gap analyses, control implementation guidance, ISMS documentation, internal audits, and audit preparation.

Led transformation initiatives to strengthen information security, implemented risk management and TPRM processes, and reduced vendor-related vulnerabilities by 40% while cutting high-risk vendors by 25%.

Managed IT risk registers, chaired the Top Risk Working Group, conducted gap analyses and risk treatment planning, and closed outstanding audit actions to prepare for ISO27001 recertification.

Led IT and information security risk activities including RCSAs, CBEST remediation, control testing (COBIT 5), and management of risk registers to align cybersecurity controls with business objectives and NIS2 obligations.

Developed audit plans and performed internal audits for ISO9001 and ISO27001, maintained ISO9001 and SOC 2 certifications, and supported international certification efforts including Hong Kong locations.

Maintained ISO9001, ISO27001, ISO14001 and OHSAS/18001 standards across the business and managed internal audit and systems compliance activities.

Performed audits against ISO27001 and ISO9001 standards as a certified lead auditor, evaluating organisational compliance and recommending improvements.

Managed IT helpdesk operations, implemented ISO27001, resolved technical issues, and oversaw IT assets to ensure reliable IT service delivery.