Muhammad Hafizhuddin

I’m an information security professional with 4+ years of experience across GRC and technical security operations in Indonesian financial services. I currently advise on IAM, Secure SDLC, and cloud security architecture for a digital bank on Google Cloud Platform.

I serve as a security champion and primary cybersecurity liaison across squads, translating group-level information security frameworks into operational controls, exception tracking, and management/regulatory reporting. I’m also a Certified Lead Auditor across ISO/IEC 27001, 27701, and 42001, which guides how I assess governance and evidence quality.

In Secure SDLC and security governance, I review and embed security requirements through Functional & Technical Specification Documents (FSD/TSD), perform threat modeling, and support Secure SDLC gates. I coordinate end-to-end VAPT for GCP and application environments, including scoping DAST testing prerequisites to ensure accurate coverage of the application attack surface.

Across cloud security and operations, I define secure cloud architecture patterns and baseline controls aligned to GCP Well-Architected and the GCP shared-responsibility model, and I validate cloud security posture against ISO 27001, NIST, and OWASP (including OWASP Top 10). Previously, I reviewed privileged access and firewall change controls, supported major migrations and remediation governance, and improved evidence-collection processes for ISO 27001, PCI-DSS, and OWASP alignment—earning a Certificate of Recognition for DBank Pro 2.0.