Information Security & GRC Consultant
Suganeswaran
Palanichamy
Helping organisations strengthen security,
manage risk, and build resilient
governance frameworks.
Scroll
Information Security & GRC Consultant
Helping organisations strengthen security,
manage risk, and build resilient
governance frameworks.
Security by design —
not checkbox compliance
As founder and security lead of a UK technology company for over six years, I designed and owned the complete information security function from zero — no external consultants, no dedicated security team. Cloud infrastructure, governance frameworks, third-party risk management, data protection, and incident response. All of it.
What that experience produced is rare: the ability to think like a business owner and act like a security professional simultaneously. Security decisions are business decisions — and I treat them as such.
My approach is security-by-design rather than checkbox compliance. I translate technical risk into language that boards and senior stakeholders act on — and I take ownership of outcomes, not just advice.
Hands-on security and governance experience across technology, logistics, healthcare, and education — building and operating complete security functions without external support.
End-to-end GRC programmes built from zero. ISO 27001 implementation and audit readiness. Risk register design, likelihood × impact scoring, treatment planning, and management reporting. Policy architecture across information security, data protection, and acceptable use. Regulatory compliance mapping across UK, EU, and international requirements.
Microsoft Azure security architecture and hardening. Sentinel SIEM deployment and alert engineering. Microsoft Defender suite configuration and management. Entra ID identity governance and access control. Zero Trust architecture principles. Secure cloud infrastructure and ongoing security posture management across hybrid environments.
Designated Data Protection Officer (DPO) experience — overseeing full GDPR compliance, managing data subject rights, and maintaining ICO regulatory reporting. ISO 27701 privacy framework implementation. Data Protection Impact Assessments. Records of Processing Activities. Privacy-by-design integration into operational workflows.
Cisco network security design and implementation including SCOR-level threat defence. Fortinet firewall deployment and security fabric integration. Network segmentation and secure remote access. Infrastructure hardening across on-premise, cloud, and hybrid environments. Layered technical controls aligned to identified risk.
Vendor and supplier security assessment programmes. Contractual security requirements and ongoing third-party monitoring. Supply chain risk identification and treatment. Due diligence frameworks for technology, data processing, and critical service providers. Vendor oversight documentation and review cycles.
Awareness of AI-related risks across organisational, regulatory, and technical dimensions. Familiar with the EU AI Act risk classification framework and its governance implications. Able to identify AI risk exposure within existing GRC programmes and support organisations in understanding their obligations under emerging AI regulation.
Structured engagements designed around your organisation's specific risk profile, regulatory obligations, and governance maturity. Each delivered with clear scope, defined deliverables, and measurable outcomes.
GRC ConsultingProject-based · Remote or On-siteGovernance, risk, and compliance programme design and implementation for organisations building or maturing their security posture.
|
Risk & Compliance AssessmentsFixed-scope · Defined DeliverablesStructured assessments identifying risk exposure, evaluating control effectiveness, and mapping regulatory obligations — with clear findings and recommendations.
|
Security AdvisoryOngoing · Strategic InputIndependent advisory support for organisations navigating security decisions, regulatory change, or programme direction — without the overhead of a full engagement.
|
Nine active professional certifications spanning security leadership, risk management, cloud architecture, privacy, and network security — each validated through rigorous independent examination.
University of Sunderland · United Kingdom
Enquiries regarding consulting engagements, risk assessments, and advisory work are welcome.