Cloud Compliance & Governance Engineering — HIPAA, ISO 27001, SOC 2 & NDPA

Compliance · 2025

GCP HIPAA Compliance Audit & Controls Implementation

I conducted a comprehensive HIPAA compliance audit of a GCP-hosted healthcare application and implemented the technical controls required to achieve HIPAA Security Rule compliance — covering all 18 implementation specifications.

Compliance · 2025

ISO 27001:2022 Cloud Controls Audit & Implementation

I conducted an ISO 27001:2022 readiness assessment of a GCP environment — mapping infrastructure against all 93 Annex A controls, implementing missing controls, and producing the full evidence artefacts required for certification audit.

Compliance · 2025

SOC 2 Type II Readiness for a Cloud-Native SaaS

I led the SOC 2 Type II readiness programme for a cloud-native SaaS — mapping Trust Services Criteria to GCP technical controls, implementing missing controls, and building automated evidence collection for the 12-month observation window.

Compliance · 2025

Nigeria Data Protection Act (NDPA 2023) Compliance Programme

I designed and implemented a compliance programme under Nigeria's Data Protection Act 2023 — covering new obligations, technical controls, data inventory, DPIAs, 72-hour breach notification procedures, and cross-border transfer governance.

Compliance · 2024

Privacy Policy & Data Compliance Framework

I developed a complete privacy and data compliance framework for mobile and web apps — covering privacy policy authoring, App Store data safety declarations, GDPR, NDPR compliance, cookie consent implementation, and data retention policies.

Cloud Engineering · 2024

Cloud Resource Tagging & Governance Enforcement

I built a tag governance system that automatically detects untagged GCP resources, notifies owners, applies default tags where safe to do so, and enforces tagging standards through Organisation Policy — solving the cost attribution data gap.

Cloud Engineering · 2024

Cloud SQL Automated Backup Verification & DR Testing

I built an automated Cloud SQL backup verification and disaster recovery testing system — performing monthly automated restore tests, verifying data integrity, and producing compliance evidence that backups are both present and functional.

Cybersecurity · 2025

Audit Log Integrity Verification System

I built a cryptographic audit log integrity verification system — using SHA-256 hashing, KMS-signed hash registries, and immutable Cloud Storage to create a tamper-evident audit trail that satisfies HIPAA, ISO 27001, and SOC 2 log integrity requirements.

Cybersecurity · 2025

IAM Access Review Automation

I built a quarterly IAM access review automation system — pulling all IAM bindings across a GCP organisation, risk-scoring access, routing certification tasks to managers, tracking responses, and producing SOC 2 / ISO 27001 audit evidence.

Cloud Compliance · Jul 2026

Engineering Continuous Compliance Evidence for Regulated Health-Tech on GCP

How to turn HIPAA, GDPR and security-control requirements into continuously collected technical evidence instead of a last-minute audit exercise.

FinOps · Jul 2026

A Practical GCP FinOps Audit: From Billing Export to Remediation

A defensible workflow for finding waste, allocating spend, testing recommendations and proving that cloud-cost remediation actually worked.

HIPAA / ISO 27001 / SOC 2 Compliance

I implement and evidence compliance controls on GCP for HIPAA, ISO 27001:2022, and SOC 2 Type II — from gap assessment through to certification-ready evidence packages that satisfy external auditors.

BAA / DPA Audit & Acquisition

I identify every third-party vendor processing your users' data, assess whether a Business Associate Agreement or Data Processing Agreement is in place, flag uncovered gaps, and manage the acquisition process to get you fully covered.

NDPA 2023 Compliance (Nigeria)

I implement technical compliance under Nigeria's Data Protection Act 2023 — automated data inventory scanning with Cloud DLP, DPIA process, breach notification procedures, and the infrastructure controls that make compliance evidence-able for the NDPC.

IAM Access Review & Governance

I conduct quarterly IAM access reviews across your GCP organisation — risk-scoring every binding, routing certification decisions to the right managers, revoking excess access immediately, and producing BigQuery evidence for SOC 2 and ISO 27001 audits.

Disaster Recovery & Backup Verification

I design and automate your disaster recovery programme — Cloud SQL restore testing, audit log integrity verification, backup retention policy enforcement, and runbook documentation — so your backups are proven restorable before you need them.