Compliance built on evidence
I work in compliance and information security for regulated digital services. That means ISO/IEC 27001 compliance across an information security management system, and meeting the requirements of the UK Digital Identity and Attributes Trust Framework.
It also means audit, policy and assurance across a business, and working alongside product development to translate regulatory requirements into practical product controls, so that compliance is built into the roadmap rather than bolted on afterwards.
Before compliance I spent nearly a decade as a biomedical scientist in a hospital biochemistry laboratory. That is where the discipline comes from: internal quality control and external quality assurance, validating software before it went live, managing change to analysers and systems, and documentation that had to stand up to inspection. In a laboratory, evidence is not paperwork, it is the work.
I bring that same standard to compliance. Controls that are tested rather than assumed, records that hold up when someone independent looks at them, and findings explained clearly enough that the people who have to act on them understand why.