CRE Cyber Risk Engineering

Identity governance and GRC engineering

Controls designed well, then automated, so audits stop being a scramble.

Cyber Risk Engineering (CRE) is a small team of practitioners with two decades of hands-on experience building identity governance, access control and compliance programs inside large organizations. We work with security and risk leaders to design controls, then automate them.

Start a conversation What we do

What we do

Identity Governance & Administration

  • IAM/IGA strategy and roadmap, posture and readiness assessments
  • Joiner-mover-leaver, identity inventory, human and non-human identities
  • Segregation of duties (SoD)
  • M&A domain migration and identity consolidation

Identity & Access Management

  • RBAC and ABAC access models
  • Provisioning, de-provisioning, contractor access
  • User access review automation
  • PAM, MFA and Zero Trust

GRC Engineering & Automation

  • Control validation and automated evidence
  • Access and change management controls
  • Compliance dashboards and certification lifecycle reporting
  • Moving manual control work to evidence-ready workflows

AI Governance

  • ISO 42001, NIST AI RMF and EU AI Act
  • AI risk assessments and compliance oversight
  • AI-enabled control automation, such as SOC 1 and ISO 27001 control validation

Audit & Assurance

  • Support for commercial, regulatory, internal and operational audits
  • Audit readiness assessments against in-scope controls
  • ISO 27001 certification readiness with gap identification
  • Evidence and walkthrough coordination with control owners

Risk & Security Governance

  • IT, application-level and third-party risk assessments
  • Risk exception management
  • Design reviews and threat modelling for new features
  • One consistent control assessment approach across risk teams

Delivery & leadership

We work with CIO, CISO and VP-level leaders alongside engineering, product and risk teams. Engagements cover multi-country delivery, medium to large portfolios, KPI and SLA management, workforce planning, and budget and vendor management, using ITIL/ITSM, Agile, SAFe and Waterfall as the program requires.

Common Control Framework

Control mapping and gap analysis, mapping certification, audit and regulatory requirements to a common control framework, feature-level compliance impact assessments, SOX and ISO 27001 scoping across large application portfolios, and compliance-by-design with engineering and product teams.

Compliance & regulatory frameworks

  • SOX and ITGC
  • SOC 1 / SOC 2
  • PCI-DSS
  • NYDFS 23 NYCRR 500
  • ISO 27001
  • ISO 42001
  • NIST AI RMF
  • EU AI Act
  • CIS
  • GDPR
  • DLP
  • DORA
  • IRAP

Platforms and tools we work with

Identity governance and access
SailPoint, Saviynt, One Identity Manager, ConductorOne, Okta, Microsoft Entra ID, Active Directory
Enterprise and legacy systems
Microsoft 365, Exchange Online, SharePoint Online, Mainframe, Unix/AS400
GRC, ITSM and work tracking
Archer, ServiceNow, ManageEngine ServiceDesk Plus, Jira, Confluence, Bitbucket
Data, reporting and automation
Snowflake, Power BI, Streamlit, Retool, Python, PowerShell, SQL, APIs, Power Automate
Cloud
Azure, AWS, GCP

Certifications

  • CISSP
  • ISO 42001 Lead Implementer
  • ISO 27001 Lead Auditor
  • AWS Certified Cloud Practitioner
  • ISC2 CC
  • ITIL v3 2011 Foundation

Let's talk

If any of this overlaps with what is on your plate, we would welcome a conversation. No deck, no commitment.

yogesh@cyberriskeng.com