GRC · solutions engineering · systems
I’ve done this work representing government economic-development organizations, inside a startup I helped build, and now in compliance technology. The setting changes. The job is always translation. Usually the problem is not a lack of effort. It is that the operating model has not caught up with the work.
Now
GRC Solutions Engineer and ControlMap SME working across technical discovery, tailored demonstrations, solution design, implementation planning, and complex customer engagements.
Before ScalePad
Helped build a route-planning SaaS company as one of the founding members.
Earlier career
Represented economic-development organizations across Europe, Asia, and the United States.
How I work
I tend to sit between the people describing the problem and the people who have to make the answer work. That might mean turning framework logic into an implementation method, taking patterns from customer conversations back to product, or building an operating model while the product itself is still taking shape.
Customer problem→Technical discovery→Implementation design→Product feedback
Selected work
The full stories stay on this page, but they do not need to occupy the page until you want to read them.
One partner runs more than 100 operating companies through a single ControlMap environment. Before we built a real process, every company was treated like a fresh implementation. There was no shared starting point, no consistent order of operations, and escalations were handled case by case.
I designed and implemented a base-tenant, or golden-tenant, methodology: a compliance environment structured around framework logic, then cloned and adjusted for each operating company instead of rebuilt from zero. The initial fully structured template takes approximately 8 hours to configure. Cloning it and running the sanity checks for each operating-company tenant takes approximately 15 minutes, compared with roughly fourteen hours when every tenant started from scratch.
CIS Controls v8.1
NIST CSF 2.0
ISO 27001
Framework structure, evidence model, order of operations, and sanity checks.
Clone the established base, validate it, then adjust for company-specific requirements.
I paired the model with recurring group sessions so questions were answered once instead of repeatedly, plus a defined escalation path so issues stopped landing wherever was loudest. Thirteen MSPs now use the same methodology across more than 100 operating companies.
Feedback from these implementations has contributed to more than 20 shipped ControlMap product and content changes, including two net-new frameworks I own end-to-end: NIST 800-53 Rev 5 and UK Cyber Essentials v3.3. I also influenced and helped define the cloning capability behind the repeat-tenant model.
Before ScalePad, I spent almost four years as one of the founding members behind a route-planning SaaS company, a spin-off from a larger business. More than 80 percent of my time went into it: the original product idea, design, customer onboarding, go-to-market, and the operating model underneath all of it. There was no existing playbook. We were building the plan and running it at the same time.
In an average month, the product served approximately 250 paying business customers and between 1,000 and 1,600 paying individual users across two pricing tiers.
Three businesses invited us to film a day of their operations without being asked. We then began reaching out to others, with nothing offered in exchange, and ultimately published twelve case studies featuring seven businesses, including a meal-prep company, a pharmacy, and a food-delivery service.
Before this
Earlier in my career, I worked in international business, investment attraction, and market entry through Maeflower Consulting. I represented economic-development organizations connected to Switzerland, Belgium, Thailand, Germany, and the United States, including Cincinnati and the State of Missouri.
The work involved representing unfamiliar markets, understanding what companies needed before expanding, and helping both sides decide whether there was a serious fit.
This followed an MBA in International Business and earlier education and work in India. The industries have changed since then. The recurring work has not: learn the system, find the constraint, and help people move.
The Translation Layer · writing
Cross-mapping buys speed on the way in. Costs you isolation on the way out. Both, for free, isn’t really on the table.Read on Substack ↗