Morgan Example
GRC Analyst | ISO 27001 | Risk Assessment
morgan.example@example.com | +971 50 000 0000 | Riyadh, Saudi Arabia | linkedin.com/in/morgan-example | github.com/morgan-example
Summary
GRC analyst with 2 years supporting internal audit at a bank. Prepared evidence for ISO 27001 surveillance audits and kept a risk register of 60 risks. CompTIA Security+ and ISO 27001 Foundation.
Skills
- Frameworks: ISO 27001, NIST, PCI DSS
- Practice: Risk Assessment, Policy writing, Audit evidence
- Tools: Jira, Confluence, Excel
Certifications
- CompTIA Security+ (2025)
- ISO 27001 Foundation (2025)
Projects
ISMS starter kit (github.com/morgan-example/isms-kit)
- Wrote a risk register template with 40 sample risks scored by likelihood and impact, and a treatment plan for the top 10
- Mapped 93 ISO 27001 Annex A controls to NIST CSF functions in one table anyone can reuse
- Wrote a one-page guide on how to score a risk, with 3 worked examples taken from a small online shop
Policy pack for a small company (github.com/morgan-example/policies)
- Drafted 6 short policies on access, passwords, backups, incidents, vendors and remote work, each one page with an owner and a review date
Experience
Internal Audit Assistant, Example Bank
Mar 2023 - Present
- Collected evidence for 40 controls ahead of an ISO 27001 surveillance audit and closed 6 gaps before the auditor arrived
- Maintained a risk register of 60 risks and chased 14 overdue actions with their owners
- Reviewed 10 vendor security questionnaires against PCI DSS requirements and reported 3 open items
- Tracked every audit action in Jira and reported the open items to the head of internal audit each week
Education
BSc Business Information Systems, Example University
2019 - 2023
Languages
Arabic, English