Open to opportunities

Sikander Shah

@sikandershah1

Information security and GRC analyst improving ISMS compliance, risk posture, and security awareness through measurable training.

Zimbabwe

Message

What I'm looking for

I’m looking for a role where I can own ISMS/GRC work, strengthen ISO27001 compliance, run measurable security awareness and phishing campaigns, and partner with IT and security teams to reduce real risk through practical controls and documentation.

I’m a Governance, Risk & Compliance Analyst with a strong focus on maintaining and improving an Information Security Management System (ISMS). I manage the day-to-day upkeep of information security policies, standards, and procedures, while ensuring risks, exceptions, and non-conformities are properly documented and handled through formal processes.

Across my roles, I’ve helped organizations strengthen their information security posture through targeted training and phishing simulation campaigns, including analysing user behaviour and driving follow-up actions. I also support governance and compliance by performing control testing, evidence collection, and gap analysis for recertification reviews, and by aligning activities across business units with internal policies, regulatory requirements, and industry best practice.

I bring hands-on audit and assurance experience from ISO27001 internal and external audit support, supplier assurance due diligence, vulnerability assessments and penetration test collaboration, and incident triage and response support. I’ve also contributed to access review and least-privilege practices, cyber security impact analysis for IT changes, and ongoing process documentation, helping teams adopt secure practices in BAU and project environments.

Experience

Work history, roles, and key accomplishments

Current

Governance & Risk Analyst

Current

N Brown Group

Aug 2025 - Present (9 months)

Managed day-to-day ISMS governance by maintaining security policies, standards, and procedures to support regulatory alignment and compliance. Performed control testing and evidence collection for IAM recertification, supported supplier assurance, and ran phishing simulation and training follow-ups to improve security awareness.

ISMS ISO 27001 GRC Risk Assessment Controls Testing IAM Recertification Policy Management

Information Security Analyst

Irwin Mitchell

Sep 2023 - May 2024 (8 months)

Improved information security practices through targeted awareness training, documentation audits, and phishing simulation testing. Conducted risk assessments and security testing, including vulnerability assessments and penetration tests, and supported incident triage and response.

Security Awareness Risk Assessment Vulnerability Assessment Penetration Testing Security Audits Triage

Information Security Auditor

Clarke Willmott

Jan 2023 - Jun 2023 (5 months)

Supported ISO 27001 compliance by conducting internal IT-focused audits and assisting internal/external audit activity to maintain certification. Completed risk acceptance reviews and third-party assurance activities, and shared practical security guidance across the firm to improve awareness.

ISO 27001 Auditing Information Security Governance Risk Reviews Security Reviews Security Awareness Training

ISMS Administrator

Commify Ltd

Apr 2022 - Nov 2022 (7 months)

Contributed to group information/cyber security strategy and ensured IT changes complied with security standards through security impact analysis. Led access reviews and least-privilege evaluations, supported security policies and business continuity planning, and ran phishing simulations using SIEM and vulnerability management tools to reduce security risk.

Information Security Strategy Security Policies SIEM Vulnerability Management Business Continuity Planning

Application Support Analyst

FirstGroup

Oct 2019 - Dec 2020 (1 year 2 months)

Administered and monitored application and software infrastructure, including provisioning access for starters and removing access for leavers. Managed Microsoft 365 (Active Directory, Azure Active Directory, and SharePoint), resolved IT support tickets in JIRA and Spiceworks, and provided advanced troubleshooting for end-user application access in the public transport sector.

Application Support Microsoft 365 Administration Azure Active Directory SharePoint Troubleshooting IT documentation