Open to opportunities

Nikita Joshi

@nikitajoshi2

Message

I’m an IT GRC specialist translating regulations into actionable security controls.

Germany

Message

What I'm looking for

I want a second-line IT GRC role where I translate ISO/NIS2/DORA into practical controls, automate evidence collection, and partner with stakeholders to prioritize risk and drive remediation.

I’m an IT GRC specialist with an M.Sc. in Cyber Security and around 2.5 years of hands-on governance, risk and compliance experience in payments and global enterprise environments. I translate ISO/IEC 27001:2022, DORA, NIS2, GDPR and PCI DSS into policies, controls, and evidence that operational teams can follow.

In my recent work, I executed enterprise User Access Reviews (UAR), ran phishing simulations, and supported security awareness training to reinforce defense postures. I’ve managed complex risk management workflows independently, prioritizing vulnerabilities and negotiating remediation action plans across international stakeholders.

I also led the drafting of 30+ audit-ready ISMS policies and SOPs and streamlined compliance evidence collection using scripting and Hyperproof automation. I’m comfortable in second line of defence work—risk registers, control testing, audit preparation, and remediation tracking—backed by clear stakeholder communication and continuous improvement.

Experience

Work history, roles, and key accomplishments

Junior IT GRC Specialist

Epay - transact Zahlungssysteme GmbH

Jan 2026 - Jul 2026 (6 months)

Executed enterprise User Access Reviews and phishing/awareness activities, managing risk workflows and negotiating remediation action plans with international stakeholders. Drafted 30+ audit-ready ISMS policies and SOPs and streamlined compliance evidence collection using scripting and Hyperproof.

Security Awareness Training Risk Workflow ISO 27001 DORA ISMS Audit Policies SOPs Hyperproof Jira Confluence remediation Scripting Stakeholder Management

Cyber Security Governance WorkingStudent

Siemens Energy GmbH

Apr 2024 - Oct 2025 (1 year 6 months)

Assessed data quality and availability in a GRC platform, focused on Risk Treatment Plan record accuracy, and advised asset owners on compliance gaps. Supported development of a global cybersecurity governance framework and a GRC platform migration by validating rule configurations, mapping external laws to internal controls, and assisting exception-handling workflow migration.

GRC Platforms Cybersecurity Framework Rules Configuration

Cyber Security Analyst Intern

ITKRAFTZ

May 2023 - Jan 2024 (8 months)

Created and secured AWS cloud environments using access control, encryption, and network segmentation best practices. Performed vulnerability assessments and supported remediation in line with NIST CSF and ISO 27001 guidance.

AWS Access Control Encryption Segmentation Vulnerability Assessment Vulnerability Remediation NIST CSF ISO 27001