Ijaz Mohammed
Abu Dhabi, UAEInformation security since 2013Updated Oct 2026

Ijaz Mohammed

Security governance · Risk · Operations
Now

I turn technical risk into decisions leaders can act on.

Then I stay for the part where the control gets built and the evidence holds up. Eight years across healthcare, financial services, energy and FMCG, from audit floors to running a security program for a hospital group.

See the work Résumé PDF Weekly digest
Black and white portrait of Ijaz Mohammed
Ijaz MohammedAbu Dhabi
Status
Active engagement
Role
Senior Information Security Consultant (vCISO)
Current
Multi-brand healthcare group · UAE, Oman, Qatar, Bahrain, KSA
Frameworks
ISO 27001 · ISO 42001 · NIST CSF · ADHICS · PCI DSS
Credentials
CISM · ISO 27001 LA · ISO 42001 LA/LI
Co-founder
Veridion Cybersecurity, a boutique GRC and offensive security advisory
Writes
Security Week in Review, Fridays
8+years in security, audit and GRC
39vendors in the annual TPRM cycle I run
83applications in the authentication register
~3,000controls tested in 45 days for a global energy major
35of 93 ISO 27001 Annex A controls in delivered work
How I workThe method

Four steps. Every engagement.

Whether it's an ISO 27001 build, a vendor review or an SSO rollout, the work runs in the same order. Skipping a step is usually where programs stall.

  1. 01

    Start with the business

    What can't stop, who gets hurt if it does, and who owns the decision. A hospital and an exchange house have different worst days.

  2. 02

    Map once, comply many times

    One unified control framework across ISO 27001, ADHICS and NIST CSF, so one control answers several auditors instead of three spreadsheets.

  3. 03

    Build the control with its evidence

    A control nobody can prove is an opinion. I write the configuration, the owner and the evidence at the same time.

  4. 04

    Hand over a decision, not a report

    Options, cost, residual risk and a named owner. Leadership should be able to say yes or no in one meeting.

Selected workHealthcare · energy · finance · FMCG

The case files

What I did, where, and what changed because of it. Each file is tagged with the ISO 27001:2022 Annex A controls it moved. Hover or tap a file to light them up on the grid below.

IdentityFlagship
Healthcare group, GCC · 2025 – now

Single sign-on across clinical, business and cloud platforms

Leading a three-phase SSO program on Microsoft Entra ID. The hard part wasn't the protocol, it was the shared clinical workstations in operating theatres, where Conditional Access and session controls had to cut unattended-session risk without slowing a surgeon down. Along the way I built an authentication register covering 83 applications and an application-to-entity map across 20 group entities, so leadership has one view of who logs in where and where the gaps are.

Annex A5.155.165.175.187.78.5
Third-party risk
Healthcare group · 2025 – now

A vendor review cycle that changes contracts

Annual assessments across 39 vendors, from cloud and contact-centre platforms to security tooling. Business, technology and people controls, re-tiered criticality, and liability and risk-acceptance clauses added with Legal so findings have somewhere to land.

Annex A5.195.205.215.22
Cloud & hosting
Healthcare group · 2025 – now

Twenty websites, one secure landing zone

Consolidating 20 group websites into a single AWS UAE landing zone: full host and vendor inventory, migration path, and the target controls checklist (EDR, exposure management, vulnerability management, backup, monitoring). New platforms are also reviewed for DR, RPO/RTO and data residency before go-live.

Annex A5.235.305.348.88.138.16
Medical OT
Two hospitals, UAE · 2026

Connected medical devices, assessed properly

Claroty-based and manual vulnerability assessments of connected medical devices at 2 hospitals. Devices you can't patch on a Tuesday need a different conversation, so findings became prioritised remediation reports clinical and biomedical teams could act on.

Annex A5.98.88.208.22
Hardening
Healthcare group · 2026

Minimum security baselines with the exact settings

CIS Level 1 and 2 baselines with real values for servers, endpoints, POS, FortiGate and SonicWall firewalls, Cisco and Alcatel switches, and MSSQL, Oracle and MySQL. Written so an engineer can apply them and an auditor can test them.

Annex A8.18.98.20
Apps & people
Healthcare group · 2025 – now

Protecting patient-facing apps, and the people using them

Onboarding and tuning hospital and patient-facing applications on Radware WAF, with documented compensating controls where a platform has no native SSO or MFA. Security awareness sessions for business, IT and nursing teams, backed by KnowBe4.

Annex A6.36.88.26
AI risk
Financial services client · 2026

Go / no-go on AI platforms

Evaluated an AI data platform and an AML tool on use cases, AI guardrails, data security and vendor risk, so the client could decide on evidence rather than demos. This is where ISO 42001 turns practical.

Annex A5.195.34ISO 42001
Security operations
Energy · FMCG, KSA · 2024 – 25

Detection you can measure

Strengthened MITRE ATT&CK-based detection for a SOC enhancement, including AI-driven use cases, and ran FourCore breach and attack simulations to test controls against real attack paths. Also PAM, access reviews, vulnerability closure and incident tabletop exercises.

Annex A5.75.185.245.268.28.88.16
Audit & continuity
Online trading fintech · 2022 – 24

Leading audit in a regulated fintech

Led internal audit for GDPR, SWIFT and PCI DSS, ITGC and DORA readiness, and implemented business continuity and incident management to ISO 22301. Mentored junior auditors along the way.

Annex A5.245.295.305.315.35
Assurance
Global energy major, via KPMG · 2018 – 20

About 3,000 controls in 45 days

Internal control testing for security compliance as part of a six-person team, acting as deputy lead. It taught me how to read evidence fast, and how to tell a working control from a well-written one.

Annex A5.355.36
Programs from zero
NBFC · exchange house · 2018 – 22

Security governance where there was none

ISO 27001 end to end for an Indian NBFC, from gap and risk assessment to Statement of Applicability, internal audit and certification. Later, formal governance, standards and controls for a PCI DSS-regulated exchange house in Dubai. Plus threat models for a product firm.

ISO 27001Cl. 4–105.15.25.318.27
Proof of workISO/IEC 27001:2022 Annex A

Where my work lands in the standard

35 of 93 controls designed, implemented or tested in delivered work
Covered in delivered workThe file you're looking atNot yet on this listTap any square for the control name.

Client work is described at outcome level. Details stay with the client.

Experience2013 – now

Engineer, auditor, builder.

I started writing software, learned security by testing other people's controls, and now build and run programs. Each stage shows up in how I work: I read evidence like an auditor and design like someone who has to ship it.

Where I've workedDot map of the Gulf and India. Gulf countries covered by the current engagement (UAE, Oman, Qatar, Bahrain, Saudi Arabia) are highlighted, India is marked as earlier career, with Abu Dhabi as home base.Abu DhabiDubaiBengaluruCoimbatoreBahrain
Current engagement, GCCEarlier career, IndiaCities I've worked from
United Arab EmiratesAbu Dhabi and Dubai. Home base.
2021 – now
Wider GCCOman, Qatar, Bahrain and KSA through the current engagement; energy and FMCG clients in KSA before that.
2024 – now
IndiaBengaluru and Coimbatore. Engineering degree, Accenture, KPMG, GE Digital.
2009 – 2020
United StatesRichmond, Virginia. MS in Information Systems at VCU.
2016 – 2017
PeriodOrganisation & roleWhat it involvedLocation
Aug 2025 – nowICD InfoSecSenior Information Security Consultant (vCISO)vCISO for a multi-brand healthcare group across UAE, Oman, Qatar, Bahrain and KSA. Helped lift program maturity from Risk Informed to Repeatable.Dubai
Nov 2024 – Jul 2025Microminder Cyber SecuritySenior Information Security OfficerSOC detection for an energy major, breach simulation for an FMCG group, access governance in ServiceNow, PAM and vulnerability management.Abu Dhabi
Jan 2024 – Oct 2024United Al Saqer GroupInformation Security ConsultantEnterprise ISO 27001:2022 program, internal audits, vendor risk and SLA security.Abu Dhabi
Sep 2022 – Jan 2024DerivTeam Lead, Internal Audit · IT AuditorGDPR, SWIFT and PCI DSS audits, ITGC and DORA readiness, ISO 22301 continuity and incident processes.Dubai
Jan 2021 – Aug 2022Al Ansari ExchangeAssistant Manager, Network & Information SecurityEstablished security governance, policies and controls for a PCI DSS-regulated environment.Dubai
Feb 2020 – Dec 2020GE DigitalDigital AuditorAudits, attestations and certifications across security, sourcing, legal and compliance.Bengaluru
Jan 2018 – Jan 2020KPMG IndiaConsultant · Associate ConsultantControl testing for an energy major, ISO 27001 for an NBFC, threat models and ITGC across banking and manufacturing clients.Bengaluru
Nov 2013 – May 2015AccentureAssociate Software EngineerSAP BW migration and support, and a new production system build.Bengaluru
CredentialsCertifications & education

Certified, still studying.

CISM
ISACA

Certified Information Security Manager

Governance, risk, program and incident management.

ISO
27001
IRCA

ISO/IEC 27001:2022 Lead Auditor

Auditing information security management systems against the 2022 standard.

ISO
42001
Exemplar Global

ISO/IEC 42001:2023 Lead Auditor & Lead Implementer

Building and auditing AI management systems.

MS, Management Information SystemsVirginia Commonwealth University, School of Business2016 – 2017
MBA, Operations ManagementChrist University, Bangalore2015 – 2016
BE, Electrical, Electronics & CommunicationsKumaraguru College of Technology, Coimbatore2009 – 2013
NowOctober 2026

What I'm working towards

The next stretch is about depth: going from running GRC programs to designing the security architecture underneath them, and building GRC as software.

In progress

From GRC lead to security architect

A self-run 90-day program on the technical side of security architecture. Four weeks done, now on secure development and application security.

Week 1Week 5 of 13Week 13
NetworkingCrypto & PKIIAMEndpoint & architectureAppSec · next
In progress

The certification path

CISSP anchors the architecture program. CRISC formalises the risk work I already do every day. SABSA or TOGAF after that, for the enterprise architecture language.

CISSP→CRISC→SABSA / TOGAF
Ongoing

GRC engineering

Learning to build GRC as software instead of spreadsheets. What I'm reading and testing:

  • Control-centric data models and OSCAL
  • Automated control mapping, and how to validate it
  • AI-assisted evidence review, with a human signing off
  • Linking findings to controls to risk, automatically
Weekly

Writing in public

Security Week in Review is my Friday digest for people who make security decisions, whether they sign off budgets or run the systems. Plain English, with enough depth for tech teams.

Read the issues
What I'm buildingSide project · in development

NOVA SpaceBridge

Security skills are learned by doing, but most people only get to do it on the job. NOVA SpaceBridge is a simulation platform I'm building to close that gap: realistic scenarios instead of slide decks, for the people entering security, the people hiring them, the teams growing them, and the leaders who need to see where they stand.

For newcomers

NOVA Ready

Career-changers and graduates build practical skill by working through simulated incidents, audits and reviews, not just reading about them.

For hiring managers

NOVA Hire

The hiring manager sets a scenario, HR runs it with candidates, and NOVA returns the top five performers based on how they actually worked it.

For teams

NOVA Advance

Upskilling within security teams and across departments, so the people around security understand the part they play.

For CISOs & boards

NOVA Assure

One view of process, people, technology, data and data flows, with the security controls each gap calls for. This is where my GRC engineering work is heading: control-centric, evidence-backed, mapped once.

Built in the evenings with Claude Code. Early stage; happy to show it to anyone curious.

Security Week in ReviewEvery Friday · free to share

Latest issue

The week in security pulled into one place, in plain English, for anyone who makes security decisions. Read it in two minutes or twenty.

Issue 01Weekly · free to share24 – 30 Oct 2026
Security Week in Review
Breaking

One laptop. $6.3 billion gone.

The biggest crypto theft on record didn't need a stolen key, just a trusted engineer's computer. What it means for any business that moves money or data.

Read online PDF edition
Ijaz's take
We spend a lot proving who someone is at login, and far less asking what our own systems will do once they trust something.
Also inside
A hospital pulls the plug in 40 minutes
Patched isn't the same as clean
750,000 people, no login needed
Your weekend playlist

All issues · Discussion happens on LinkedIn.