Security Governance, Risk & Privacy Topics
Governance, compliance frameworks, regulatory requirements, compliance implementation, and compliance-driven risk management. Covers compliance frameworks (SOX, GDPR, HIPAA, FCPA, etc.), regulatory interpretation, compliance control design, audit and control effectiveness evaluation, and compliance process management. For operational security implementation and technical threat mitigation, see Security Engineering & Operations.
Privacy and Security Alignment
The relationship between privacy and security: how they overlap and differ, and how access control, least privilege, encryption, and other security controls serve privacy goals. Covers aligning privacy and security programs and reasoning about safeguards that protect personal data at scale. Includes distinguishing a privacy failure from a security failure.
Risk Assessment and Management
Identifying, analyzing, prioritizing, and treating information-security, compliance, and privacy risk. Covers qualitative and quantitative risk assessment methodologies, threat and vulnerability identification, likelihood and impact (and severity-of-harm) scoring, risk registers, and treatment decisions (accept, mitigate, transfer, avoid). Includes privacy-specific assessments such as DPIAs and PIAs: when an assessment is required, how to structure it, and how to weigh likelihood and severity of harm to individuals, plus prioritizing compliance and privacy risk across a portfolio of initiatives. Emphasizes structured, repeatable methodology tied to business context.
Data Classification and Sensitivity Handling
Classifying data by sensitivity and applying controls proportionate to that classification: identifying personal, sensitive, and special-category data and tagging it through its lifecycle. Covers classification schemes, labeling, and how classification drives access, encryption, and retention decisions. Includes assessing the impact of a given data type on privacy and security risk.
Communicating Security and Privacy Risk to Stakeholders and Leadership
Translating technical security, compliance, and privacy risk into language that executives, boards, and non-technical stakeholders can act on. Covers framing risk in business terms, influencing leadership on investment and strategy, tailoring the message to the audience, and driving decisions through communication. The persuasion-and-translation skill, distinct from the metrics themselves.
Security Clearance and Background Investigation Readiness
Preparing for clearance-gated roles: clearance levels and what each requires, the background-investigation process, factors affecting eligibility, maintaining and transferring an existing clearance, and discussing clearance status appropriately in interviews.
Cryptographic Standards and Compliance
Compliance and standards governing the use of cryptography: approved algorithms and key lengths, FIPS 140 validation, key management standards, and regulatory expectations for encryption of data at rest and in transit. Covers how cryptographic choices are constrained by standards and how to demonstrate cryptographic compliance. Standards-and-governance view of crypto, not cryptographic design or attacks.
Data Breach and Privacy Incident Response
Responding to privacy incidents and breaches: detection, containment, investigation, severity and breach classification, and regulator and individual notification within statutory deadlines. Covers complaint intake and resolution, escalation, and balancing transparency against risk during an incident. Includes coordinating the cross-functional response and post-incident remediation.
Compliance Automation and Tooling
Using technology to scale and continuously enforce compliance and privacy. Covers GRC platforms, compliance-as-code, continuous control monitoring, automated evidence collection, and integrating compliance and privacy checks into engineering pipelines. Focuses on how tooling reduces manual effort and enables continuous rather than point-in-time assurance.