Nick Sotiroglou
Certified Information Systems Auditor

Governance, Risk & Compliance

I build and run GRC programs, connecting security risk, policies, vendor assurance, customer reviews, and audit readiness with the teams responsible for delivery.

As a CISA-certified professional, I have owned GRC program development and day-to-day execution across technology organizations. My work spans SOC 2, ISO 27001, PCI DSS, and HIPAA-related requirements. A background in product delivery and QA helps me turn requirements into clear responsibilities, practical controls, and remediation work.

Download Resume View GRC Experience Contact Me
Portrait of Nick Sotiroglou

PROGRAM EXPERIENCE

Building and running GRC programs

11:11 Systems | Compliance & Audit Specialist

Built and ran the GRC program across risk management, policy governance, third-party assurance, customer security reviews, and audit readiness. Established priorities, responsibilities, and recurring workflows, alongside hands-on risk assessment, control mapping, evidence review, and remediation work.

Audit scope: SOC 2, ISO 27001, and PCI DSS. OneTrust supported control-evidence organization and completeness checks.

ThreeFlow | Product Delivery Manager

Built and ran the GRC program as part of a broader product delivery remit. Connected risk assessments, vendor reviews, policy workflows, customer security inquiries, and audit requirements with engineering delivery plans and follow-up.

Audit work: SOC 2 Type II and HIPAA-related requirements. Vanta supported compliance workflows, while Jira connected requirements and identified gaps to implementation work.

Core Strengths

GRC program ownership and execution

Program ownership

Build the operating processes that connect requirements, priorities, responsible teams, and recurring compliance work.

Security risk management

Assess security risks and control gaps, prioritize follow-up, and maintain clear remediation ownership and status.

Third-party risk

Review vendor security information, identify concerns, and coordinate follow-up on third-party risk.

Policy governance

Manage policy development, review, and updates so requirements remain connected to operational responsibilities.

Customer assurance

Address customer security and compliance inquiries with clear explanations supported by policies and control evidence.

Audits and controls

Lead audit readiness, map requirements to controls and evidence, coordinate auditor requests, and manage remediation follow-through.

Framework Experience

Framework experience

Audit and control experience

SOC 2 ISO 27001 PCI DSS HIPAA-related requirements

Additional familiarity

NIST CSF GDPR CCPA/CPRA

Experience

My career

11:11 Systems logo

11:11 Systems

Compliance & Audit Specialist

Mar 2023 - Present
  • Built and ran the GRC program, establishing priorities, ownership, and recurring workflows across risk management, policy governance, third-party assurance, customer reviews, and audit readiness.
  • Conducted security risk assessments and translated identified gaps into prioritized remediation with defined owners, target dates, and follow-up.
  • Managed third-party risk reviews, evaluated vendor security information, and coordinated follow-up on identified concerns.
  • Owned policy governance, coordinating policy development, reviews, and updates with responsible stakeholders.
  • Managed customer assurance work, translating security policies and control evidence into clear responses to customer security and compliance inquiries.
  • Led external audit coordination across SOC 2, ISO 27001, and PCI DSS, managing auditor requests, evidence submissions, control-owner follow-up, and remediation.
  • Mapped framework requirements to controls, evidence expectations, and owners; reviewed control evidence and documented gaps requiring follow-up.
  • Used OneTrust to organize control evidence and validate completeness; maintained remediation ownership, due dates, and status across recurring compliance work.
ThreeFlow logo

ThreeFlow

Product Delivery Manager

Dec 2021 - Feb 2023
  • Built and ran the GRC program alongside product delivery responsibilities, connecting risk, policy, vendor and customer assurance, and audit readiness with engineering execution.
  • Led audit coordination for SOC 2 Type II and HIPAA-related requirements, translating control and evidence needs into delivery plans and implementation follow-up.
  • Conducted risk assessments and vendor security reviews; translated identified gaps into Jira work items with acceptance criteria, dependencies, ownership, and follow-up.
  • Managed policy review and update workflows and addressed customer security inquiries using relevant policy and control evidence.
  • Managed Vanta-supported workflows for security requirements, evidence needs, ownership, and implementation status; tracked unresolved risks and blockers affecting audit readiness.
ThreeFlow logo

ThreeFlow

Project Management Operations Specialist

Jun 2021 - Dec 2021
  • Built support workflows covering SLA tracking, service-desk configuration, documentation, training, and handoffs; coordinated product rollouts and user-acceptance testing.
Ceterus logo

Ceterus

QA Engineer Team Lead

Dec 2019 - Jun 2021
  • Led a QA team across manual and automated testing, coordinating regression coverage, defect follow-up, and release validation.
  • Worked with the QA Automation Engineer to expand repeatable tests and supported non-production releases through Jenkins and CircleCI.
Ceterus logo

Ceterus

QA Engineer

May 2019 - Dec 2019
  • Created test plans, documented reproducible defects, and used SQL to validate application data and investigate issues.
Ceterus logo

Ceterus

Technical Support Specialist

Feb 2018 - May 2019
  • Resolved technical support requests, documented workflows, and worked with engineering to investigate issues and improve data quality.

Projects

GRC project

Kasbah Labs logo

Kasbah Labs

GRC Workflow Application

Kasbah Labs is my independent application for organizing practical GRC work, from control ownership and evidence to policies and remediation.

Jun 2025 - Apr 2026
  • Designed, built, deployed, and maintained a full-stack application for control ownership, evidence uploads, policy acknowledgments, remediation tracking, and audit preparation.
  • Created views connecting controls, evidence, owners, review status, and open compliance tasks for audit preparation.
Kasbah Labs safeguards list showing control categories, priorities, and status for Acme, Inc.
Kasbah Labs safeguards view with sample Acme, Inc. data. Controls are organized by category, priority, and status.

Education

Academic background

Certification

Certified Information Systems Auditor (CISA) | ISACA

Issued Mar 2026

Western Governors University

Bachelor of Science, Information Technology

2021

Tools & Platforms

Tools used in my work

Compliance workflows

OneTrust Vanta

Delivery and documentation

Jira Confluence ServiceNow Zendesk Notion

Data and release work

SQL Jenkins CircleCI

Contact

Get in touch

For GRC program ownership, security risk, vendor assurance, policy governance, customer assurance, and audit-readiness opportunities, contact me at nsotiroglou@gmail.com.

Email Nick View LinkedIn