Security Governance, Risk & Privacy Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Security and Privacy Culture, Training and Awareness
Building organization-wide security and privacy awareness and a culture where protective behavior is the norm. Covers awareness and role-based training programs, phishing simulations, embedding security and privacy ownership into engineering, product, and support teams, and measuring and improving culture. Focuses on the human layer of the program rather than technical controls.
Data Breach and Privacy Incident Response
Responding to privacy incidents and breaches: detection, containment, investigation, severity and breach classification, and regulator and individual notification within statutory deadlines. Covers complaint intake and resolution, escalation, and balancing transparency against risk during an incident. Includes coordinating the cross-functional response and post-incident remediation.
Data Subject Rights and Request Handling
Operationalizing individual rights: access, rectification, erasure, portability, restriction, and objection requests. Covers identity verification, response timelines, locating data across systems to fulfill a request, and handling edge cases and exemptions. Includes designing systems that can execute deletion and export reliably at scale.
GDPR Principles and Compliance
The General Data Protection Regulation in depth: the six lawful bases, data subject rights, accountability and records obligations, DPO requirements, and enforcement and fines. Covers how GDPR principles translate into concrete engineering and product controls. Includes controller and processor obligations and demonstrating compliance.
Regulatory Change Management and Interpretation
Keeping a compliance and privacy program current as regulations, standards, and guidance evolve. Covers monitoring the regulatory landscape, interpreting ambiguous or new requirements, performing impact assessments and gap analyses against current controls, and driving program changes to close gaps. Emphasizes navigating regulatory ambiguity and translating guidance into concrete obligations.
Privacy by Design and Default
Embedding privacy into architecture and the development lifecycle: the privacy-by-design principles, privacy-protective defaults, and on-device or edge processing to minimize data exposure. Covers integrating privacy controls into product and program design and into engineering workflows rather than bolting them on. Includes designing privacy-first solutions and reference architectures.
Risk Assessment and Management
Identifying, analyzing, prioritizing, and treating information-security, compliance, and privacy risk. Covers qualitative and quantitative risk assessment methodologies, threat and vulnerability identification, likelihood and impact (and severity-of-harm) scoring, risk registers, and treatment decisions (accept, mitigate, transfer, avoid). Includes privacy-specific assessments such as DPIAs and PIAs: when an assessment is required, how to structure it, and how to weigh likelihood and severity of harm to individuals, plus prioritizing compliance and privacy risk across a portfolio of initiatives. Emphasizes structured, repeatable methodology tied to business context.
Employee and Workplace Data Privacy
Protecting personal data of employees and candidates: HR-data confidentiality, monitoring and surveillance limits, and lawful handling of workforce data. Covers the distinct expectations and legal bases that apply in the employment context. Includes governing internal access to sensitive employee information.
Security and Privacy Program Governance and Strategy
Designing and running enterprise security and privacy programs: setting vision and a multi-year roadmap, structuring governance bodies, defining security-officer, DPO, and privacy-officer responsibilities and board oversight, and aligning objectives with organizational risk appetite. Covers how a program is resourced, prioritized, matured, and evolved, and how governance authority and accountability are established across both security and privacy. Program-level strategy and maturity modeling rather than individual control implementation.