IT Audit & Security Compliance Professional

ISABEL ANTONIO Vancouver, BC 780-***-**** ***************@*****.***

https://www.linkedin.com/in/isabel-antonio-7361a659/

PROFESSIONAL SUMMARY:

IT Auditor, Governance, Risk and Compliance professional with 3+ years of experience evaluating, developing, and maintaining security compliance frameworks across enterprise environments. Proven track record conducting security control assessments and IT audits, performing risk assessments, and driving corrective action plans to remediate control and compliance gaps. Skilled in leveraging security technologies to support risk mitigation whilst working with like-minded professional teams to ensure everyone has balance.

PROFESSIONAL CERTIFICATIONS:

CISA, ISACA Jun 2025

ISO 27001 LA, PECB, Jan 2022

SAP, GRC Access Control, Security Authorization and Activate Project Management

CISSP, ISC2 - Pending

AREAS OF EXPERTISE:

COBIT, ITGC, Systems and Application Audits, SAP ERP, GRC, Security Authorizations and Project Management Azure Cloud Security Governance Security Compliance Programs & Frameworks Security Control Assessment Security Policies Development Risk Assessments Risk Treatment Plans SIEM & Security Monitoring Vulnerability Management Audit Readiness & Evidence Management Corrective Action Planning (CAPA) Remediation Tracking Monitoring & Technical Safeguards Oversight IAM Logging Metrics & Reporting

Compliance Frameworks: SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS

Programming-Scripting: Python, JavaScript, PHP

Databases: PostgreSQL, MySQL

Protocols: TCP/IP, FTP, HTTPS, SFTP, SMTP, POP3, VMware, Telnet, VNC, VPN

Networking: TCP/IP and OSI model, Ethernet, LAN, IP Subnetting, IP Sec

Devices: router, switches, Firewalls, Anti DDOS, Load balancers Servers

Enterprise Systems: SAP, Sage Pastel, CRM

Tests: Kali Linux, Shell Scripting, Penetration Testing

Tools: Nmap, Metasploit, Nessus, Splunk, Wireshark, Burp Suite, OWASP

PROFESSIONAL EXPERIENCE:

Security Compliance Analyst:

Insignia Software Corporation, Edmonton, AB Mar 2024 - Oct 2025

FedRAMP authorization Project:

Conducted recurring assessments of security controls and compliance requirements aligned to SOC 2 / ISO 27001, including evidence collection, control testing coordination, and gap identification.

Evaluated compliance against applicable frameworks not limited to NIST SP 800-53, partnering with business and technical stakeholders to ensure audit-ready implementation.

Developed and maintained security compliance documentation, including policies, standards, procedures, control descriptions, and risk registers, BIA, SIA, and other artifacts as required by FedRAMP authorization.

Led risk assessments to identify security vulnerabilities and compliance gaps; recommended prioritized mitigation strategies and established measurable remediation timelines, assigning responsible individuals for progress feedback.

Supported audit cycles by coordinating with internal teams to remediate findings, validate corrective actions, and maintain accurate records of compliance activities.

Produced executive-ready compliance reporting summarizing control effectiveness, risk trends, audit outcomes, and progress against remediation plans.

Improved compliance governance by standardizing evidence requirements and strengthening control ownership and verification processes.

Reduced repeat findings by 60% through improved evidence workflows and corrective action verification.

Improved risk visibility by implementing standardized risk scoring and remediation tracking dashboards used by leadership.

PROFESSIONAL EXPERIENCE:

IT Audit Consultant:

Governance Management Consulting, Durban, Republic of South Africa Jun 2019 – May 2023

Role & Contributions:

Led planning, execution, and reporting on internal control audits, compliance reviews and other advisory projects for various clients.

Performed audit and compliance assessments of security policies and operational procedures, identifying control deficiencies and providing actionable recommendations.

Conducted structured reviews of security monitoring and detection capabilities, including log ingestion, alerting coverage, and incident reporting alignment to compliance objectives.

Supported security program improvements by designing control procedures and technical safeguard recommendations in coordination with engineering and IT teams.

Managed compliance documentation lifecycle, conducted ongoing risk monitoring and reporting, communicating risk status and control effectiveness to leadership and relevant stakeholders.

Assisted with cloud security governance efforts, ensuring alignment between cloud configuration practices and compliance control requirements.

IT Internal Auditor:

EmpowerBank, Harare, Zimbabwe Jan 2020 - Dec 2022

Role & Contributions:

Supported vulnerability management and remediation by reviewing scan results, validating risk severity, and tracking closure for security findings. Maintained security tooling and workflows utilizing SIEM dashboards and alert rules, firewall/IDS/IPS monitoring routines.

Documented compliance requirements and translating audit findings into measurable control changes. Assisted with the documentation of security incidents and lessons learned processes, ensuring proper logging, reporting, and improvement actions.

ICT Internal Auditor:

Zimbabwe Open University, Harare, Zimbabwe May 2018 - Dec 2019

Role & Contributions:

Assessed IT systems, cybersecurity, applications, and technology controls to ensure secure, reliable, compliant, and effective delivery of the institution’s mandate - offering online learning in a safe and secure IT environment, additionally offering robust systems in support of the institution’s strategic goals.

SAP – GRC Access Control and Security Authorization Consultant:

Freelance, Zimbabwe 2015 – 2023

Role & Contributions:

Under Security Authorizations - Designed, implemented, and maintained complex SAP security roles across diverse environments (including ECC and S/4HANA), utilizing PFCG and SU24 to enforce granular access controls and streamline user lifecycle management. Efficiently resolved critical authorization bottlenecks using advanced tracing tools while proactively supporting large-scale system upgrades and audit compliance.

Under GRC Access Control - Engineered and managed automated compliance workflows within SAP GRC, utilizing MSMP, BRFplus, and BRM to streamline user provisioning and standardize the role lifecycle. Expertly administered Emergency Access Management (EAM/Firefighter) while continuously maintaining the SoD risk matrix (Ruleset) to conduct risk analysis (ARA) and ensure audit-ready compliance.

Developed and assigned mitigating controls for valid business exceptions where SoD conflicts could not be eliminated through role remediation.

Led quarterly and annual User Access Reviews and Role Re-certifications using GRC compliance workflows to meet SOX and internal audit mandates.

Partnered closely with internal and external auditors to provide necessary documentation, security reports, and change logs, ensuring zero major non-compliance findings.

EDUCATION:

Diploma in Cybersecurity, ABM College, Calgary, AB 2024 - 2026

MSc in Management Information Systems, National University of Science & Technology, Zimbabwe 2013 - 2015

BSc in Management Information Systems, Women’s University in Africa, Zimbabwe 2006 - 2009

Contact this candidate