Enterprise Compliance & GRC
CJIS Security Policy, NIST SP 800-37 Rev. 2, HIPAA Security Rule, GDPR, SOC 2, HUD HMIS Data Standards, PCI DSS.
Security leadership for regulated cloud environments
Golam Ryan
Security & GRC Lead, Azure Cloud Security
Securing regulated cloud infrastructure and building practical governance controls for cybersecurity, privacy, and AI risk.
Cybersecurity and compliance practitioner with 8+ years across network, infrastructure, cloud security, and public-sector regulatory environments. I translate frameworks like CJIS, HIPAA, GDPR, SOC 2, NIST SP 800-37, NIST AI RMF, and ISO/IEC 42001 into enforceable technical controls, audit evidence, and operating practices.
Capability matrix
Core Competencies
A practical mix of regulatory control design, cloud hardening, vulnerability management, and evidence-driven security operations.
AI Risk & Privacy Alignment
NIST AI RMF 1.0, ISO/IEC 42001 alignment, AI security incident handling, model risk awareness, and data leakage guardrails.
Cloud Security & Engineering
Microsoft Defender for Cloud, Azure Policy, Key Vault, custom RBAC, PIM, AKS, PostgreSQL Flexible Server, and perimeter security.
Vulnerability & SecOps
CVSS triage, Snyk SCA, Jira remediation tracking, Nmap, Wireshark, Burp Suite, Wazuh SIEM, Grafana, Splunk, and Snort.
Featured public work
Project Case Studies
Two live repositories are featured now. The project system is ready for three more case studies when you add them.
GRC Copilot
Automated evidence collection, control gap analysis, and evidence-grounded questionnaire drafting for SOC 2 and ISO 27001.
What it demonstrates
A compact Python proof of concept that collects source-system evidence, hashes and timestamps it, maps it to controls, and produces audit-ready gap reports and questionnaire drafts with citations.
Impact
Shows how manual screenshot-based compliance work can become a repeatable, verifiable evidence pipeline where stale, missing, and tampered evidence are surfaced as control findings.
SOC 2
ISO 27001
Python
Azure evidence
Control mapping
AI Governance Pack
Controlled document set for governing AI features in a B2B SaaS company across policy, assessment, mapping, vendor risk, and regulatory review.
What it demonstrates
Seven governance documents with owners, approvers, effective dates, review cadence, cross-references, and practical control positions for secure AI deployments.
Impact
Bridges NIST AI RMF, ISO/IEC 42001, SOC 2, NIST SP 800-53, CJIS, vendor risk, AI feature assessment, and acceptable use into an auditable operating model.
NIST AI RMF
ISO/IEC 42001
SOC 2
CJIS
Vendor risk
Continuous Compliance-as-Code Engine
Automated compliance monitoring for AWS infrastructure against SOC 2 and NIST 800-53 controls with SHA-256 evidence hashing, parallel check execution, and AI-assisted control mapping.
What it demonstrates
A production-ready engine evaluating 24 compliance controls across IAM, S3, CloudTrail, and EC2. Features declarative YAML control definitions, pure Python check functions, cryptographic evidence integrity, and LLM-assisted control drafting using Claude API.
Impact
Mirrors Vanta/Drata evidence collection architecture. Eliminates manual screenshot-based audits with continuous monitoring that detects drift in minutes. One check function simultaneously satisfies multiple framework requirements, reducing redundant testing.
SOC 2
NIST 800-53
Python
AWS boto3
Evidence Collection
49 tests passing
NIST RMF Risk Assessment Automation
Automated NIST Risk Management Framework implementation covering FIPS 199 categorization, SP 800-53 control selection, risk scoring, and POA&M generation.
What it demonstrates
Python CLI tool automating RMF phases from system categorization through authorization. Features 5×5 risk matrix scoring, baseline control selection from 28 SP 800-53 controls, risk register tracking, and automated SSP and POA&M document generation.
Impact
Transforms manual RMF documentation from weeks to hours. Enforces structured risk assessment methodology with consistent likelihood × impact scoring. Generates audit-ready artifacts meeting federal ATO requirements.
NIST RMF
SP 800-53
Risk Assessment
FIPS 199
POA&M
Python
Security Testing & Guardrail Lab
Reserved for a future lab project covering Wazuh, pfSense or OPNsense, Nagios, Snort, telemetry validation, and data leakage controls.
Career evidence
Recent Experience
Nov 2025 - Present
Lead Security Engineer - Application & Security Infrastructure
NECX Inc. Ltd - Dhaka, Bangladesh
- Owns compliance and audit work across CJIS, HIPAA, GDPR, and SOC 2 for regulated Azure environments.
- Authored CJIS audit checklist and GDPR documentation with evidence requirements, control owners, and pass/fail criteria.
- Managed vulnerability remediation workflows across CVSS severity tiers with root-cause analysis and sign-off tracking.
- Migrated application secrets into Azure Key Vault and designed least-privilege RBAC for administrative access.
Jul 2024 - Nov 2025
Deputy Manager - IT & Network Engineering
Fareast Islami Life Insurance Co. Ltd - Dhaka, Bangladesh
- Deployed Wazuh for host-based intrusion detection and file-integrity monitoring.
- Stood up Nagios monitoring for critical resource thresholds across distributed infrastructure.
- Maintained hybrid workloads across AWS EC2 and Azure with backup, replication, and traffic log retention.
2021 - 2024
Network, Datacom & Application Engineering Roles
Robi Axiata Limited and Huawei Technologies (BD) Ltd
- Delivered application management projects, QMS access governance, and carrier network operations.
- Configured VLANs, subnets, VRRP, customer-edge routing, ADDS, DNS, and Group Policy in live environments.
Credentials
Certifications & Training
In progress
AZ-500
Microsoft Azure Security Engineer Associate
In progress
AZ-104
Microsoft Azure Administrator Associate
Completed
CCNA
Cisco Certified Network Associate
Completed
RHCE
Red Hat Certified Engineer
Completed
AI Security & Governance
Incident Handler training
Contact