John K

Deliver assurance and GRC advice for client integration projects, producing prioritised control recommendations aligned with risk appetite and compliance obligations. Provide security design and architecture assurance for SAML-based identity integrations.

Provide ICT security consulting and practical GRC advice for integration projects, translating vulnerabilities and risks into prioritised control recommendations. Utilise AI orchestration for product development and apply analytical tooling to improve GRC delivery efficiency.

Owned cyber security governance, risk and assurance responsibilities for the New Zealand National Ticketing System, a nationally significant critical infrastructure programme. Conducted compliance assessments and security audits aligned with multiple frameworks.

Led and delivered cyber risk assessments, compliance assessments, governance assurance and security architecture workstreams for government and financial services clients. Completed C&A and Security Risk Assessments for GitHub Copilot and Snowflake.

Delivered ICT, cyber security, C&A, GRC, test management and programme delivery services across government and private-sector engagements. Led stakeholder engagement, policy and standards development, governance framework implementation and delivery improvement.

Delivered All-of-Government security accreditation, architecture and cyber risk analysis for enterprise systems including Genesys Cloud and Atlassian. Conducted enterprise cyber risk assessments through stakeholder engagement, evidence review, threat modelling and architectural review.

Delivered security architecture, GRC consulting and control assurance across critical financial infrastructure, cloud, identity, HR and enterprise systems. Owned and supported C&A activities for NZClear, ESAS, Terraform, HR systems, Microsoft Azure, Microsoft 365, Azure Landing Zone and identity services.

Delivered internal cyber risk assessments and C&A for enterprise systems including Oracle FMIS, engaging stakeholders, reviewing evidence, identifying vulnerabilities and producing control assurance artefacts aligned with government security standards. Performed inter-application data migration security assurance.

Led teams of four to ten staff delivering programme testing, delivery quality assurance, risk management and senior stakeholder reporting in a regulated financial services environment. Fulfilled GRC responsibilities and mandatory C&A obligations, including security control identification and regulatory compliance.

Held progressively senior software quality assurance, test engineering, automation and test leadership roles, building a foundation in structured test planning, evidence traceability, defect and risk management, quality reporting and communication.

Microsoft Certified: Azure Fundamentals, current since 2020.

ITIL v3 Foundation certified, current since 2018.

Certified Professional in Agile Project and Delivery Management, current since 2021.

ISTQB Certified Tester, current since 2009.

Microsoft Certified: Azure Administrator Associate and Azure Fundamentals, current since 2020.

Certified ScrumMaster, current since 2018.

Completed Korn Ferry Leadership Architect Training in 2019.

Completed SANS SEC560: Network Penetration Testing Boot Camp in 2015.

Completed SANS SEC401: Security Essentials Boot Camp in 2014.

Bachelor of Science in Marketing from West Chester University, Pennsylvania, USA, completed in 1993.

Certified as a Technology Risk and Compliance Professional by OneTrust.