GRC Lead Auditor & Security Builder

Saqlain Momin

I see ¹risk at the ²enterprise level, and I build the ³tools to close the ⁴gaps I find.

Four years building controls at enterprise scale — I know why a control exists, who owns it, and what breaks when it doesn’t.

See the work ↓

ISO 27001 · ISO 27701 · ISO 22301 — Lead Auditor

The argument

The window is closing.

Defenders run on human cycles. Quarterly scans, annual pentests, patch SLAs measured in weeks. Attackers now run on machine cycles. The gap between the two is the story of my work.

Two timelines, same starting point.

A decade ago, defenders and attackers moved at roughly the same pace. Both bounded by human effort, human review, human salaries.

Then one of them stopped being human.

AI task autonomy is doubling every 89 days. Vulnerability discovery windows collapse from months to minutes.

source / METR task-horizon data

The defender's line barely moves.

Frameworks lag reality by three to five years. ISO 27001 was updated in 2022, a decade overdue. NIST CSF only added Govern in 2024.

source / ISO 27001:2022, NIST CSF 2.0

This shaded gap is the risk.

Every defensive delay is now measured against autonomous iteration. The structural disadvantage compounds daily. This is the space I build into.

89 days

The time it takes for AI task autonomy to double. Your patch cycle did not get twice as fast this quarter.

METR

97M

Downloads weaponised in a single PyPI supply-chain attack. It was caught only because it had a bug that crashed machines. That is luck, not a control.

PyPI transitive dependency attack

3-5 yrs

How far compliance frameworks lag the threats they are meant to govern. The standards exist. The migration does not.

ISO 27001:2022 / NIST CSF 2.0 / post-quantum

The work

The response.

Four years auditing controls at enterprise scale taught me where they fail. I build into the lag instead of writing about it.

full-scope audit platform

CyberAssess

A compliance audit platform that reads the evidence before it asks a question.

CyberAssess reads the evidence before it asks a single question. Every uploaded document is reviewed first — the tool arrives with a picture of what’s already answered, what’s partial, and what’s missing. Questions then adapt to what actually requires human judgement. Controls that map to multiple frameworks are assessed once, not once per standard. The result is end-to-end coverage across an organisation’s compliance landscape without the time it would normally cost.

DPDPA · ISO 27001 · GDPR · HIPAA · NIST CSF · PCI-DSS · SOC 2 + GLBA planned

A multi-call Claude pipeline that separates evidence extraction from gap analysis.

Six compliance frameworks defined as Python dicts — version-controlled, embeddable directly into Claude’s system prompt, never stored in the database. A framework abstraction layer maps overlapping controls into Unified Control Clusters so the questionnaire de-duplicates at the data level. The Claude pipeline separates evidence extraction from gap analysis, with prompt caching on the static requirements block to keep cost flat across assessments. Every response tracks its source — human, document, inferred, or overridden — from input through to the final PDF. A dependency DAG sequences the remediation roadmap so fixes respect implementation order. Root cause clustering groups gaps by category (policy, process, technology, people, governance) to generate strategic initiatives, not just a list of findings. No SPA — Jinja2 + HTMX, full server round-trips, zero client state.

Python 3.13 · FastAPI · Anthropic SDK · SQLAlchemy · Jinja2 + HTMX

6 compliance frameworks in one assessment
Evidence read before any question is asked
Deterministic scoring — model writes, code decides

GitHub →

Walkthrough of a completed CyberAssess GDPR gap report for Vantara Financial Services — overall score 49%, 46 high-risk gaps, scrolling through requirement-level findings with risk ratings

vendor pre-onboarding screen

Recon

A vendor security screen that checks public signals before you open the door.

Before a vendor questionnaire, before a contract, before access is granted — Recon reads what’s already publicly visible. Six scanners run against a domain simultaneously: DNS configuration, SSL/TLS posture, tech stack, breach exposure, security headers, and organisational signals. A red-flag detector runs before any AI interpretation. No access required, no questionnaire to fill. One domain, 60 seconds.

6 scanners · public signals only · 60 seconds

6 scanners run concurrently on one domain
Hard-rules verdict before AI interpretation
Public signals only — 60-second screen

GitHub →

Live walkthrough of a Recon scan on cloudflare.com — domain submitted, six scanners complete, AI analysis lands at risk score 12, LOW tier

reinforcement learning · game theory

RL Playground

Experiments in what happens when a system learns from rules alone.

A snake that taught itself to survive. A prisoner’s dilemma you can play — pick a strategy, run it against a population, watch cooperation emerge or collapse. A landing sequence a reinforcement agent learned without being told what “landing” looks like. These are experiments, not products. Simple environments, emergent behaviour, and the occasional surprise when the agent finds something you didn’t plan for.

Python · PyTorch · reinforcement learning

Reinforcement learning environments built in free time.

Each simulation: define an environment, set a reward signal, let the agent learn. The prisoner’s dilemma is interactive — pick a strategy and watch it run against a population over thousands of iterations. A grid-world snake agent, a spacecraft landing sequence, a car-driving environment. Built in Python and PyTorch. Some finished, some still in progress.

Python · PyTorch · RL environments

Interactive prisoner's dilemma against evolving populations
Grid-world, landing, and driving RL environments

GitHub →

Genetic algorithm evolving finite-state-machine strategies for the prisoner's dilemma — fitness climbing over 200 generations, best genome's automaton diagram updating as it improves

personal AI signal tracker

Velocity

An AI news tracker that scores developments against your own profile.

AI developments are everywhere — posts, threads, announcements, most of it hype, very little of it signal. And almost none of it helps you work out what any of it means for your specific work. Velocity filters against a professional profile: each development is scored as an opportunity, a disruption, or a knowledge gap — relative to what you actually do. Before taking on work AI might already handle, a calibration test answers it directly.

relevance scoring · personal profile · weekly digest

A relevance engine for AI news, scored against your own profile.

n8n ingests AI developments automatically. Gemini classifies each one as opportunity, disruption, or knowledge gap and scores its relevance against your uploaded CV or manual profile. Calibration mode lets you query specific upcoming tasks. React + Express front, SQLite back, weekly digest output.

React · Express · SQLite · Gemini · n8n

AI developments scored against your own profile
Opportunity / disruption / knowledge-gap classification
Weekly digest via automated ingestion pipeline

GitHub →

Velocity dashboard — 15 high-impact AI developments this week, top-scored item showing the Claude Sonnet 4.6 release as an opportunity

Field notes

I publish a position, with the data attached.

Fifteen articles for security and GRC practitioners. The recurring thesis: this is not IT security for AI tools, it is systems security for synthetic cognition.

Who

The audit grounding.

Pre-certification readiness for ISO 27001, 27701, and 22301. Third-party risk program design for financial services and fintech. Technology risk assessments and board-level reporting.

Impact

Led 15+ security engagements across BFSI, real estate, and e-commerce
Built vendor risk programs covering 50+ vendor ecosystems
Delivered end-to-end compliance reviews against NIST CSF, OWASP Top 10, PCI DSS

Role: Assistant Manager, Cyber Strategy & Governance, at KPMG
Certifications: ISO 27001, ISO 27701, ISO 22301 Lead Auditor
Education: B.Tech in Information Technology and MBA in Finance, NMIMS
Sectors: Financial services, fintech, SaaS

Download CV (PDF) ↓

Outside the work

The rest of it.

Reading

What I'm chasing

Everything I'm building comes from trying to understand something I don't yet. I've landed on the belief that the best moment to have a hard problem is today. Not because it gets easier, but because you're already in it.

Off the clock

I surf when the ocean cooperates. I take coffee too seriously and I collect Hot Wheels — the latter started in childhood and I've never found a good reason to stop.

Saqlain Momin

I see 1risk at the 2enterprise level, and I build the 3tools to close the 4gaps I find.

The window is closing.

Two timelines, same starting point.

Then one of them stopped being human.

The defender's line barely moves.

This shaded gap is the risk.

CyberAssess

Recon

RL Playground

Velocity

The audit grounding.

Impact

The rest of it.

Reading

What I'm chasing

Off the clock

I see ¹risk at the ²enterprise level, and I build the ³tools to close the ⁴gaps I find.