GRC &
THIRD-PARTY
RISK
Stress-testing what vendors claim against what the evidence actually shows for Fortune 500 healthcare enterprises. Based in Kathmandu. Working for the world.
The work
I do.
I am a GRC and Third-Party Risk Management professional based in Kathmandu, Nepal. For the past year I have been a contractor supporting a Fortune 500 healthcare enterprise through SecurityPal, conducting end-to-end vendor risk assessments against HITRUST CSF, CRF, HIPAA, SOC 2, ISO 27001, and GDPR.
My job is stress-testing what vendors say about themselves. I go through policies, map controls to regulatory requirements, identify gaps, and present findings to senior leadership for approval. I've done this across 6000+ vendors including some of the most well-known names in enterprise technology.
Before GRC I worked in SOC operations, vulnerability assessment, and network security. I also spent a year in AI data annotation where I was promoted to Quality Auditor within 2 months of joining as a fresher.
Vendor Risk Assessment
Validating HITRUST CSF and CRF submissions, reviewing evidence packages, identifying misrepresentations across 6000+ enterprise vendors.
Compliance Documentation
Producing audit-ready risk reports, scorecards, and mapping documents aligned to HIPAA, SOC 2, ISO 27001, and GDPR.
PHI/PII Governance
Evaluating vendor data classification, retention policies, encryption standards, and HIPAA breach notification obligations.
Security Operations
Background in SOC log analysis, threat detection using Splunk SIEM, and vulnerability assessment with CVSS-based prioritization.
Where I've
worked.
- Conduct end-to-end TPRM assessments for a Fortune 500 healthcare enterprise, validating HITRUST CSF and CRF assessments across 6000+ technology vendors.
- Validate vendor compliance posture against HIPAA/HITECH, SOC 2 Type II, ISO 27001, GDPR, and NIST CSF through evidence review and policy analysis.
- Perform detailed security policy reviews, mapping vendor controls and identifying gaps in PHI/PII handling, access management, and incident response.
- Prepare audit-ready risk reports and scorecards, presenting findings to senior GRC leadership.
- Reduced average remediation closure timelines by 25% through cross-functional collaboration.
- Maintain internal AI-powered compliance knowledge library, reducing downstream errors by 30%.
- Perform data collection, evaluation, and annotation tasks supporting AI/ML model development across audio, video, image, and text modalities.
- Execute pairwise comparisons, object tagging, and content classification with strict adherence to project guidelines.
- Annotated and validated 10,000+ data points for AI/ML model training across education and content intelligence projects.
- Maintained 98%+ accuracy rate in data labeling through rigorous quality control.
- Promoted to Quality Auditor within 2 months, reviewing the work of experienced peers.
- Assisted in SOC operations including log analysis, vulnerability assessments, and threat detection using Linux CLI, Python automation, and Splunk SIEM.
- Conducted vulnerability scans and supported triage aligned with CVSS scoring standards.
- Supported network configuration, security monitoring, and troubleshooting in a live ISP environment.
- Gained hands-on experience with routing protocols, firewall rule management, and network access controls.
Technical
toolkit.
Credentials.
Work I'm
proud of.
Reviewed and validated 6000+ vendor risk assessments against HITRUST CSF r2 and CRF frameworks as part of a Fortune 500 healthcare company's TPRM program. Developed standardized control mapping templates that improved assessment review efficiency by 40%.
Structured and validated 1,500+ Science and Math questions for an adaptive AI learning platform. Tagged content by Bloom's Taxonomy level across 20+ learning modules.
Reviewed and validated 2,000+ questions across Science, Math, and English for grades 6–12, formatted for integration into AI-based assessment systems used by 10+ ed-tech platforms.
Let's work
together.
Open to GRC analyst roles, TPRM contracts, and compliance consulting. If you're hiring or want to discuss a contract, book a call directly or reach out below.
Book a 30-Min Call
// Schedule directly — no back and forth