# John K John K is a remote worker on Himalayas, Principal Security Advisor at ThunderLabs Australia, based in New Zealand. Source: https://himalayas.app/@johnk1 ```text Cyber security assurance advisor at ThunderLabs Australia, assessing SAML identity integrations and translating risks into control recommendations. ``` | Detail | Value | | --- | --- | | Availability | Looking for a job | | Location | New Zealand | | Authorized to work in | New Zealand | | Salary expectations | 120k+ NZD | | Job categories | Cybersecurity Assurance Specialist, Cybersecurity Analyst, Cyber Security Architect, Security Consultant, Security Advisor, GRC Analyst | | Skills | Cybersecurity Assurance, Governance Risk and Compliance (GRC), Security Risk Assessment, Certification and Accreditation, Security Control Assessment, Security Architecture Review, Risk Management, Control Gap Analysis, Residual Risk, Risk Register, Remediation Planning, Threat Modeling, Cloud Security, Third Party Risk Management | | LinkedIn | https://linkedin.com/in/johnklitgaard-cybersecurityadvisor | ## About ```text At ThunderLabs Australia, I deliver assurance and GRC advice for client integration projects, with prioritised control recommendations aligned to risk appetite and compliance obligations. I also assess security design for SAML-based identity integrations, including Okta, Auth0, Microsoft 365 and Entra ID. At Career Intelligence Technologies Ltd, I provide ICT security consulting and practical GRC advice for integration projects. I also work on architecture and AI orchestration for OrgCheck.io and Jobhunterapp.io. At CyberCX New Zealand Limited, I led cyber risk and compliance assessments, governance assurance and security architecture work for government and financial services clients. My work included C&A and Security Risk Assessments for GitHub Copilot and Snowflake for the Guardians of New Zealand Superannuation, and an Azure Landing Zone assessment for the Ministry of Social Development. Across New Zealand government, central banking, financial services and critical infrastructure, I’ve assessed systems against NZISM requirements and NIST-aligned guidance. Earlier, I built a foundation in software testing and quality assurance, and at SBS Bank I led programme testing teams of four to ten staff. ``` ## Experience ### Principal Security Advisor (current) ThunderLabs Australia. Nov 2025 - Present ```text Deliver assurance and GRC advice for client integration projects, producing prioritised control recommendations aligned with risk appetite and compliance obligations. Provide security design and architecture assurance for SAML-based identity integrations. ``` Skills: GRC, Security-Assurance, SAML, Okta, Auth0, Microsoft-365, Entra-ID, Risk-Assessment ### AI Developer / AI Security Consultant (current) Career Intelligence Technologies Ltd. Nov 2025 - Present ```text Provide ICT security consulting and practical GRC advice for integration projects, translating vulnerabilities and risks into prioritised control recommendations. Utilise AI orchestration for product development and apply analytical tooling to improve GRC delivery efficiency. ``` Skills: GRC, AI, Claude-Code, Security-Consulting, Policy-Development, Compliance-Assessments ### GRC Senior Security Analyst – Asia Pacific [Cubic Corporation](https://himalayas.app/companies/cubic). Jan 2025 - Aug 2025 ```text Owned cyber security governance, risk and assurance responsibilities for the New Zealand National Ticketing System, a nationally significant critical infrastructure programme. Conducted compliance assessments and security audits aligned with multiple frameworks. ``` Skills: GRC, Risk-Assessment, Compliance, NZISM, ISO-27001, PCI-DSS, NIST-CSF, ACSC-Essential-Eight, Australian-ISM ### Principal Security Consultant CyberCX New Zealand Limited. Jan 2023 - Aug 2024 ```text Led and delivered cyber risk assessments, compliance assessments, governance assurance and security architecture workstreams for government and financial services clients. Completed C&A and Security Risk Assessments for GitHub Copilot and Snowflake. ``` Skills: Security-Risk-Assessment, Compliance, Governance, Security-Architecture, NZISM, NIST, Stakeholder-Engagement ### Principal Consultant / Director Silver Fern Consulting Ltd. Feb 2011 - Jan 2023 ```text Delivered ICT, cyber security, C&A, GRC, test management and programme delivery services across government and private-sector engagements. Led stakeholder engagement, policy and standards development, governance framework implementation and delivery improvement. ``` Skills: ICT, Cybersecurity, C&A, GRC, Test-Management, Programme-Delivery, Stakeholder-Engagement ### Cyber Security Architect Ministry of Business, Innovation and Employment. Jul 2022 - Nov 2022 ```text Delivered All-of-Government security accreditation, architecture and cyber risk analysis for enterprise systems including Genesys Cloud and Atlassian. Conducted enterprise cyber risk assessments through stakeholder engagement, evidence review, threat modelling and architectural review. ``` Skills: Security-Architecture, Security-Risk-Assessment, Threat-Modeling, NZISM, Genesys-Cloud, Atlassian ### Cyber Security Analyst Reserve Bank of New Zealand. Oct 2021 - Jun 2022 ```text Delivered security architecture, GRC consulting and control assurance across critical financial infrastructure, cloud, identity, HR and enterprise systems. Owned and supported C&A activities for NZClear, ESAS, Terraform, HR systems, Microsoft Azure, Microsoft 365, Azure Landing Zone and identity services. ``` Skills: Security-Architecture, GRC, Controls-Assurance, NZISM, Azure, Microsoft-365, Identity-Services, Risk-Assessment ### Security Assurance Consultant Statistics New Zealand. Nov 2020 - Oct 2021 ```text Delivered internal cyber risk assessments and C&A for enterprise systems including Oracle FMIS, engaging stakeholders, reviewing evidence, identifying vulnerabilities and producing control assurance artefacts aligned with government security standards. Performed inter-application data migration security assurance. ``` Skills: Security-Risk-Assessment, C&A, NIST-CSF, NIST-Information-Technology-Security-Special-Publications-(SP)-800-Series, Oracle-FMIS, Jira, Data-Migration-Security ### Programme Test Manager SBS Bank. Mar 2019 - Jul 2020 ```text Led teams of four to ten staff delivering programme testing, delivery quality assurance, risk management and senior stakeholder reporting in a regulated financial services environment. Fulfilled GRC responsibilities and mandatory C&A obligations, including security control identification and regulatory compliance. ``` Skills: Test-Management, Quality-Assurance, Risk-Management, GRC, C&A, RBNZ, Open-Bank-Resolution ### Technical Testing & Test Leadership Various organisations. Jun 1997 - Feb 2011 ```text Held progressively senior software quality assurance, test engineering, automation and test leadership roles, building a foundation in structured test planning, evidence traceability, defect and risk management, quality reporting and communication. ``` Skills: Software-Quality-Assurance, Test-Engineering, Testing-Automation, Test-Leadership, Defect-Management, Risk-Management ## Education ### Microsoft Microsoft Certified: Azure Fundamentals, Azure Fundamentals. 2020 - Present ```text Microsoft Certified: Azure Fundamentals, current since 2020. ``` ### AXELOS ITIL v3 Foundation, IT Service Management. 2018 - Present ```text ITIL v3 Foundation certified, current since 2018. ``` ### ICAgile ICAgile Certified Professional, Agile Project and Delivery Management. 2021 - Present ```text Certified Professional in Agile Project and Delivery Management, current since 2021. ``` ### ISTQB ISTQB Certified Tester, Software Testing. 2009 - Present ```text ISTQB Certified Tester, current since 2009. ``` ### Microsoft Microsoft Certified: Azure Administrator Associate, Azure Administration. 2020 - Present ```text Microsoft Certified: Azure Administrator Associate and Azure Fundamentals, current since 2020. ``` ### Scrum Alliance Certified ScrumMaster, Scrum. 2018 - Present ```text Certified ScrumMaster, current since 2018. ``` ### Korn Ferry Korn Ferry Leadership Architect Training, Leadership. 2019 - 2019 ```text Completed Korn Ferry Leadership Architect Training in 2019. ``` ### SANS Institute SANS SEC560: Network Penetration Testing Boot Camp, Network Penetration Testing. 2015 - 2015 ```text Completed SANS SEC560: Network Penetration Testing Boot Camp in 2015. ``` ### SANS Institute SANS SEC401: Security Essentials Boot Camp, Security Essentials. 2014 - 2014 ```text Completed SANS SEC401: Security Essentials Boot Camp in 2014. ``` ### West Chester University Bachelor of Science, Marketing ```text Bachelor of Science in Marketing from West Chester University, Pennsylvania, USA, completed in 1993. ``` ### OneTrust OneTrust Certified: Technology Risk and Compliance Professional, Technology Risk and Compliance ```text Certified as a Technology Risk and Compliance Professional by OneTrust. ``` ## Tech stack - Snowflake - Microsoft Azure - GitHub - Okta - Auth0 - Microsoft 365 To contact John, message them from this profile with a Himalayas employer account: [Hire on Himalayas](https://himalayas.app/hire). ## People also viewed - [Juan Herbst](https://himalayas.app/@juanherbst): Head of Engineering, M EGA THE PRIVACY COMPANY - [Lachlan "skooch" Temple](https://himalayas.app/@skooch): Staff Security Operations Engineer, Blinq - [Marty Lindsay](https://himalayas.app/@martylindsay): Lead Site Reliability Engineer, Kiwibank - [Sasitha Peiris](https://himalayas.app/@sasithapeiris): Senior Security Specialist, KiwiBank - [Andrew Simmonds](https://himalayas.app/@andrewsimmonds): Cyber Security Specialist, Ember Technology - [Gaurav T](https://himalayas.app/@gauravt): Salesforce Platform Architect, Te Whatu Ora (Health NZ) - [Farai Mbira](https://himalayas.app/@mbiraf): Project Manager Cybersecurity, Alfred Health - [David Ok](https://himalayas.app/@davidok): SOC Technical Lead, Fujitsu - [Daniel Roberts](https://himalayas.app/@danielroberts2): Senior Business Analyst, University of Canterbury - [Manoj Singh](https://himalayas.app/@manojsingh8): Associate Manager Cloud & DevOps, DXC Technology