GRC & Third-Party
Risk Analyst
I validate vendor security postures for Fortune 500 enterprises, mapping controls against HITRUST, HIPAA, SOC 2, ISO 27001, and GDPR. Based in Kathmandu, Nepal. Working globally.
The work I do.
Bridging vendor compliance claims with what the evidence actually shows.
I am a GRC and Third-Party Risk Management professional based in Kathmandu, Nepal. For the past year I have been working as a contractor supporting a Fortune 500 healthcare enterprise through SecurityPal, conducting end-to-end vendor risk assessments against HITRUST CSF, CRF, HIPAA, SOC 2, ISO 27001, and GDPR.
My job is essentially to stress-test what vendors say about themselves. I go through policies, map controls to regulatory requirements, identify gaps, and present findings to senior leadership for approval. I have done this across 20+ vendors including some of the most well-known names in enterprise technology.
Before GRC I worked in SOC operations, vulnerability assessment, and network security. I also spent a year in AI data annotation where I was promoted to Quality Auditor within 2 months of joining as a fresher.
Vendor Risk Assessment
Validating HITRUST CSF and CRF submissions, reviewing evidence packages, and identifying misrepresentations across 20+ vendors.
Compliance Documentation
Producing audit-ready risk reports, risk scorecards, and compliance mapping documents aligned to HIPAA, SOC 2, ISO 27001, and GDPR.
PHI/PII Governance
Evaluating vendor data classification, retention policies, encryption standards, and HIPAA breach notification obligations.
Security Operations
Background in SOC log analysis, threat detection using Splunk SIEM, and vulnerability assessment with CVSS-based prioritization.
Where I've worked.
- Conduct end-to-end TPRM assessments for a Fortune 500 healthcare enterprise, validating vendor-submitted HITRUST CSF and CRF assessments across a portfolio of 20+ technology vendors.
- Validate vendor compliance posture against HIPAA/HITECH, SOC 2 Type II, ISO 27001, GDPR, and NIST CSF through evidence review and policy analysis.
- Perform detailed security policy reviews, mapping vendor controls and identifying gaps in PHI/PII handling, access management, and incident response.
- Prepare audit-ready risk reports and scorecards, presenting findings to senior GRC leadership for formal approval.
- Reduced average remediation closure timelines by 25% through cross-functional collaboration with engineering and legal teams.
- Maintain internal AI-powered compliance knowledge library, reducing downstream errors by 30%.
- Perform data collection, evaluation, and annotation tasks supporting AI/ML model development across audio, video, image, and text modalities.
- Execute pairwise comparisons, object tagging, and content classification with strict adherence to project guidelines.
- Annotated and validated 10,000+ data points for AI/ML model training across education and content intelligence projects.
- Maintained 98%+ accuracy rate in data labeling through rigorous quality control.
- Promoted to Quality Auditor within 2 months of joining as a fresher, reviewing and grading the work of experienced peers.
- Assisted in SOC operations including log analysis, vulnerability assessments, and threat detection using Linux CLI, Python automation, and Splunk SIEM.
- Conducted vulnerability scans and supported triage aligned with CVSS scoring standards.
- Supported network configuration, security monitoring, and troubleshooting in a live ISP environment.
- Gained hands-on experience with routing protocols, firewall rule management, and network access controls.
Technical toolkit.
GRC & Compliance
Third-Party Risk
Security Operations
AI & Data
Cloud & Infra
Documentation
Credentials.
Work I'm proud of.
Reviewed and validated 20+ vendor risk assessments against HITRUST CSF r2 and CRF frameworks as part of a Fortune 500 healthcare company's third-party risk program. Developed standardized control mapping templates that improved assessment review efficiency by 40%.
Structured and validated 1,500+ Science and Math questions for an adaptive AI learning platform. Tagged content by Bloom's Taxonomy level across 20+ learning modules.
Reviewed and validated 2,000+ questions across Science, Math, and English for grades 6–12, formatted for integration into AI-based assessment systems used by 10+ ed-tech platforms.
Let's work together.
Open to GRC analyst roles, TPRM contracts, and compliance consulting. Remote worldwide.
Get in touch
I am actively looking for GRC, compliance, and TPRM roles. If you are hiring or want to discuss a contract, book a call directly or reach out through any of the channels below.
📅 Book a 30-min call
Schedule directly — no back and forth needed.