Cyber Governance · TPRM · Risk Strategy

Nicholas A. Lawrence Cyber Risk, GRC & Enterprise Security Risk Professional

For 14+ years I've assessed cloud, network, endpoint and identity environments and turned technical exposure into decision-ready risk that business and engineering leaders can act on.

Midlothian, Texas U.S. Citizen Clearance-eligible
Get in touch LinkedIn ↗
Inherent → Residual Illustrative
Impact →
Likelihood →
Critical High Moderate Low
MBACISMCRISCCISACDPSEPMPCFECICAITIL v3AWS SA · Assoc & Pro
01 · Approach

Risk, stated in terms leadership can decide on

I work across the full span of enterprise security risk: cyber governance, GRC operations, third-party risk management and risk strategy. I independently assess engineering decisions, identify residual risk, and specify the risk reduction required to bring exposure back within enterprise risk appetite. My work spans third-party assessments, software and emerging AI risk reviews, and temporary risk acceptance.

Today I lead cyber risk, vulnerability and federal compliance operations for a FedRAMP cloud environment. Before that I led BISO/TISO risk assessments at Wells Fargo and cybersecurity assurance programs across banking, insurance and investment firms.

Assess

Likelihood, impact and residual risk across cloud, network, endpoint and IAM architectures, measured against NIST SP 800-53 and FedRAMP baselines.

Translate

Technical findings turned into business impact, with remediation priorities based on exploitability and operational cost.

Mature

Repeatable methodology, risk scoring models, automated evidence collection and continuous control monitoring.

02 · Framework

The 10 pillars of an end-to-end TPRM program

My framework for governing vendor risk, resilience and regulatory compliance. The ten pillars stay the same across sectors; how each one is implemented changes with the regulator. Pick an industry to see that version.

One framework. Four implementations. End-to-end resilience.

03 · Experience

Where I've done the work

  1. Aug 2025 – Present
    Current

    Senior FedRAMP GRC Lead

    Rezileans Consulting · Gratus | Commvault
    • Lead cyber risk, vulnerability and federal compliance operations for a FedRAMP cloud environment, advising engineering and leadership on risk across the authorization boundary.
    • Assess control design and operating effectiveness across cloud and on-premises systems; govern POA&M remediation through verified closure.
    • Primary liaison among security operations, system owners, engineering, 3PAOs and federal stakeholders for ConMon deliverables, data calls and audit evidence.
    • Implement automated GRC workflows, evidence aggregation and continuous control monitoring.
    FedRAMPNIST SP 800-53POA&M3PAOConMon
  2. Feb 2024 – Jul 2025

    Senior Security Analyst Lead, BISO/TISO

    Wells Fargo Bank · via Artech
    • Led cyber risk and control assessments across Payments, CTO and Enterprise Functions.
    • Led responses to OCC, Federal Reserve, SOX and state examinations.
    • Built repeatable control testing methodology, risk scoring models and continuous monitoring; integrated GRC automation into Agile/SDLC pipelines.
    • Guided senior analysts on methodology, findings quality and consistency of risk judgments.
    OCCFFIECNYDFS 500SOX
  3. Jun 2021 – Dec 2023

    IT GRC Security Lead, Cybersecurity Testing & Assurance

    PenFed Credit Union · Equitable · Royal Bank of Canada (TCS)
    • Led cybersecurity testing, control assessment and assurance across financial and insurance environments.
    • Governed remediation through POA&M management, corrective action plans and evidence validation.
    • Developed automated control testing and contributed to enterprise risk scoring methodology; coordinated SOX, FFIEC and GLBA examinations.
    GLBAFFIECTPRM
  4. Jul 2020 – Mar 2021

    Senior IT Cybersecurity GRC & Third-Party Risk Lead

    Fidelity Investments · via Mindteck
    • Led cybersecurity risk, control assessment and third-party security risk activities enterprise-wide.
    • Assessed vendor security risk, coordinated remediation with business owners, and supported posture benchmarking.
    Third-Party RiskNISTISO 27001
Earlier roles, 2002 – 2020
Oct 2019 – Apr 2020IT Security AnalystVersant Health · Zensar. Vulnerability assessment, IAM governance, HIPAA controls.
Apr 2019 – Sep 2019Senior IT Security AnalystInfosys Public Services. Public-sector application assessments aligned to NIST and CMS.
Aug 2018 – Jan 2019IT Security AnalystBoston Consulting Group. Global security monitoring, endpoint hardening, vendor risk reviews.
Aug 2017 – Jul 2018Senior IT Risk & Compliance SpecialistMartin Marietta. Enterprise IT risk assessments and SOX ITGC testing cycles.
Apr 2013 – Mar 2017IT Risk Management AnalystContextus Global Services. Application and infrastructure risk, vendor scoring, BC/DR.
Feb 2012 – Mar 2013Quality Assurance AuditorCardone Industries. Audits, root-cause analysis, corrective action verification.
Sep 2002 – Dec 2011State Accountant / Revenue OfficerJoint Admissions & Matriculation Board. Financial reporting, reconciliation, compliance reviews.
04 · Expertise

Frameworks, platforms and tools

Cyber risk competencies

Cyber risk assessmentResidual risk analysisEnterprise risk managementThird-party cyber riskSoftware & AI risk reviewTemporary risk acceptanceArchitecture & boundary riskRisk treatment coherenceEvidence handlingExecutive risk communication

Frameworks 13

NIST SP 800-53NIST CSFFedRAMPISO 27001/27002ISO 42001SOC 2FFIECGLBAHIPAAPCI DSSNYDFS 500GDPRCCPA

Cloud & GRC platforms

AWSAWS GovCloudAzureGCPArcherServiceNowMetricStreamOneTrust

Security tooling

SailPointCyberArkNetskopeQualysNexposeSplunkFidelisProofpointGuardiumJiraConfluenceTableau
05 · Credentials

Certifications & education

CISMCertified Information Security ManagerISACA
CRISCCertified in Risk and Information Systems ControlISACA
CISACertified Information Systems AuditorISACA
CDPSECertified Data Privacy Solutions EngineerISACA
AWS SASolutions Architect, Associate & ProfessionalAmazon Web Services
PMPProject Management ProfessionalPMI
CFECertified Fraud ExaminerACFE
CICACertified Internal Controls AuditorInternal controls
ITIL v3IT Service ManagementAXELOS
MBAMaster of Business AdministrationEducation

Let's talk about your risk program.

Open to senior Cyber Risk, GRC, Third-Party Risk and Enterprise Security Risk roles and advisory engagements, remote or in the Dallas–Fort Worth area.

LocationMidlothian, Texas