Toyeeb Atanda

GRC · Security Compliance · AI Governance

I turn security and compliance requirements into controls, evidence, and systems that work.

GRC Engineering Security & Compliance Risk Management Audit & Assurance AI Governance Compliance Automation

Explore My Work View Resume

At a Glance

4+ Years GRC & compliance experience

9 Audit engagements coordinated

6+ Organizations assessed

50+ Control gaps identified

20+ Security & regulatory requests per quarter

5+ Organizations supported in AI governance

70+ Endpoints coordinated for remediation

50+ Personnel reached through security awareness

About

I’m a GRC professional and engineer bridging risk, compliance, audit, security, and technology. I translate frameworks and regulatory requirements into practical controls, automate evidence and compliance workflows, and build governance systems that teams can actually operate and auditors can verify.

I bring 4+ years of experience across third-party risk management, security questionnaires, SOC 2 audits, information security risk management, security assessments, governance, and compliance operations.

My work spans SOC 2, ISO/IEC 27001, NIST CSF, NIST SP 800-53, CMMC, HIPAA, privacy, and AI governance, including coordinating audits, collecting and evaluating evidence, mapping controls, identifying gaps, and tracking remediation.

I combine traditional GRC practice with engineering and automation to reduce repetitive compliance work, improve evidence quality, and make controls more measurable and operational.

The goal is simple: build governance that can demonstrate not only that controls exist, but that they work.

Projects

GRC + Cloud Security + Compliance Automation

HIPAA-Compliant Healthcare API Governance Pipeline

CI: gated

Hardened a patient-intake API to HIPAA Security Rule standards: customer-managed KMS, multi-region CloudTrail, and an S3 Object Lock evidence vault, then enforced the controls in CI.

Controls: Terraform baseline, 6 OPA/Rego policies with tests, OSCAL control-to-code mapping.
Assurance: Conftest fail-closed gate. Cosign keyless signing into the evidence vault, including on failing runs.
Lesson: Identified and remediated a live credential-exposure finding, including key rotation and repository hardening.

HIPAAOPA/RegoOSCALCosign

View Case Study → GitHub →

AI Governance + Regulatory Compliance + Automation

ARGUS: AI Governance Compliance Engine

CI: passing

Compliance-as-code for AI system inventories: classify risk, evaluate governance controls, and produce evidence before deployment.

Governance: EU AI Act classification with a control catalog crosswalked to NIST AI RMF and ISO/IEC 42001.
Enforcement: CI gate blocks merge on critical governance findings.
Evidence: Assessment report, findings register, Statement of Applicability, and SHA-256 integrity manifest.

EU AI ActNIST AI RMFISO 42001

View Case Study → GitHub →

AI Governance + Agentic Risk + GRC Automation

AIRA: AI Agent Risk Assessment

Engine tested

First-pass risk assessment for AI agents: score, control gaps, evidence requests, and a remediation plan, with the language model barred from deciding anything that has to be defended.

Built: Self-hosted n8n workflow. Deterministic engine scores Impact × Likelihood × Exposure; the model writes analysis and summaries only.
Governance: 13-control catalog, evidence gaps with named owners, TPRM branch for third-party systems. Framework mappings are illustrative, not a certified crosswalk.
Decision: Does not approve the system. Human governance review stays required.

NIST AI RMFn8nTPRMAgentic AI

GitHub →

TPRM + Vendor Evidence + Questionnaire Intelligence

Trust Ledger

CI: passing

Turns security questionnaire answers into a ledger of customer promises, flags where those promises contradict each other, and checks whether vendor SOC reports still support them.

Built: Layout-agnostic extraction from questionnaires. Rule-based classification (commitment vs roadmap vs attestation). Cross-customer contradiction detection. Human approval before anything is tracked.
Evidence: CUECs from vendor SOC 2 / SOC 3 PDFs, mapped to promises with reviewer sign-off, then a per-customer ledger: SUPPORTED / AT RISK / UNPROVEN.
Limit: Sample questionnaires and observed evidence are synthetic. Live checks (GitHub 2FA, CloudTrail retention, Okta deprovisioning) are still on the roadmap.

TPRMSOC 2CUECsQuestionnaires

GitHub →

GRC Knowledge Automation

NISTBOT: AI-Assisted Compliance Retrieval

RAG workflow

A retrieval assistant for NIST SP 800-53. Grounded answers from source text instead of model guesses. Not a deployment gate.

Built: n8n workflow: Google Drive ingestion → embeddings → Pinecone → retrieval-backed answers.
Evidence: Documented workflow with verified example queries against NIST SP 800-53 Rev. 5.

NIST 800-53RAGn8n

GitHub →

Cloud Compliance Lab

Multi-Cloud Compliance Lab

CI: passing

Compliant-by-default Terraform modules and keyless OIDC / Workload Identity Federation across AWS and GCP, with OSCAL documentation.

AWSGCPOIDCOSCAL

View on GitHub →

Planned Projects

DoD Supply Chain

CMMC Level 2 as Code

Planned

Map CMMC L2 practices to Terraform/OPA enforcement.

CMMCNIST 800-171

Cloud Compliance

FedRAMP Evidence-as-Code

Planned

Planned exploration of FedRAMP Rev. 5, OSCAL-based control implementation, automated cloud evidence collection, and policy-as-code validation.

FedRAMPOSCAL

Technical Skills

GRC Platforms

ServiceNowErambaCSETOneTrust

Cloud Security

AWS (S3, KMS, CloudTrail, Security Hub, IAM) GCP (Workload Identity Federation, Org Policy) Azure (Entra ID, Policy, Key Vault)

Compliance Automation

TerraformOPA/RegoConftest tfsecGitHub ActionsCosign S3 Object Lock

Machine-Readable Compliance

OSCALcompliance-trestle

Programming / Scripting

PythonHCLBash

Frameworks & Standards

Security & Compliance

SOC 2 ISO/IEC 27001 NIST CSF NIST SP 800-53 NIST SP 800-171 CMMC HIPAA PCI DSS

Privacy

ISO/IEC 27701 GDPR

AI Governance

ISO/IEC 42001 NIST AI RMF EU AI Act

GRC Expertise

GRC Engineering

Turn governance requirements into policy-as-code, CI gates, and auditor-ready evidence.

Governance & Compliance

Program design, policy, control mapping, and getting a team audit-ready.

Risk Management

Identify, own, track, and report information security risk through to closure or acceptance.

Audit & Assurance

End-to-end audit coordination: evidence, control testing, gap assessments, finding remediation.

Third-Party Risk

Vendor assessments, security questionnaires, and risk-based follow-up.

AI Governance

Risk assessment, control mapping, evidence, and human oversight for AI systems teams actually deploy.

How I Work

GRC engineering

ModelControls and requirements as explicit, testable definitions

EncodePolicy-as-code, Terraform, OPA/Rego, OSCAL mappings

EnforceFail-closed CI gates before merge or deploy

MonitorEvidence collection, control status, drift against the baseline

AuditSigned artifacts and auditor-ready proof of what ran

GRC operations

IdentifyRisks, regulatory requirements, control needs, vendor exposure

AssessGap assessments, questionnaires, risk assessments, audits

MapFrameworks → controls → evidence → owners

RemediatePrioritize gaps, assign owners, track closure

ValidateEvidence review, control testing, audit readiness

MonitorControl effectiveness, compliance status, risk change

ReportExecutive briefings, audit reporting, risk visibility

Writing

AI Governance & Automation

Real-Time AI Incident Logging

Zapier pipeline: AI Incident Database RSS → severity classification → Slack alerts and a live risk register.

→

Building an AI Readiness Tracker with Airtable

AI inventory, risk register, and controls with a compliance dashboard.

→

Framework Deep-Dives

ISO/IEC 27001:2022 Gap Assessment

Five-part series: how to run a gap assessment, then Clauses 4, 5 and 6, 7 and 8, and 9 and 10.

Intro Clause 4 Clauses 5 and 6 Clauses 7 and 8 Clauses 9 and 10

Implementing the NIST Risk Management Framework

Practical overview of NIST RMF: what it is, how the seven steps fit together, and how to apply it.

→

GRC Practice

Security Compliance Audit

How to run a compliance audit against NIST SP 800-53: scoping, evidence, and control interviews.

→

Risk Assessment

Companion demo: conducting a security risk assessment after the compliance audit.

→

Leadership

Vice President

2026 to Current

GRC Engineering Club, Augusta Chapter. Co-founded a regional community for GRC, audit, and compliance professionals across the CSRA, connecting practitioners around Fort Gordon’s Army Cyber Command, the Signal Corps, and the Georgia Cyber Innovation & Training Center.