Shay Holder

I'm leading AI governance implementation at Milliman, aligning AI use-case risk assessments, system inventories, and control mapping with ISO/IEC 42001.

I lead ISO 27001, HITRUST CSF, and SOC 2 certification readiness, managing audit timelines, evidence, auditor interviews, control validation, and remediation plans. I also conduct risk and compliance assessments across NIST CSF, HIPAA, GDPR, NIS2, and CMMC requirements.

Previously at American Airlines and Piedmont Healthcare, I managed third-party risk, internal audits, vendor assessments, risk registers, and regulatory audit support across healthcare, aviation, and federal environments.

I'm a CISA-certified GRC professional with 7+ years of experience translating security and regulatory requirements into actionable controls, executive risk reporting, and practical process improvements.