About, Belgrade, Serbia
Mark Emelianov
AI-native Governance, Risk, Controls & Compliance professional, more than 25 years in IT.
I work AI-native: agents do the legwork, and I own the decisions and the evidence. My field is governance, risk, controls, compliance, information security and IT audit. I design, roll out and scale controls, measure them, and manage assessments through to remediation, in large national and multinational companies with distributed teams.
Work with me: consultancy and solutions
Experience: ISO 27001 certification and recertification and SOC 2 Type I and Type II, ISO 42001 preparation, PCI DSS implementation and certification, and many other types of audits (see LinkedIn experience).
- COBIT
- ITIL
- ISO 27001
- ISO 20000
- GDPR
- ISAE 3402
- SOC 1/2
- Basel II / AMA
- PCI DSS
Knowledge
- Risk Assessment
- External Audit
- GRC
- IS Compliance
- Consultancy Services
- Regulatory Requirements
- Regulatory Compliance
- Analytical Skills
- Windows System Administration
- CRISC
Languages: English (full professional), Russian (native)
Member of ISACA (since Apr 2011) and the IIA (since Dec 2013). Publications: a book series on Microsoft Windows 2000 Server and Professional (BHV, 2000).
Off duty: I walk dogs. With agents doing the legwork, there is time for it.
Now
- Information security compliance consulting since July 2023: ISO 27001 and SOC 2, audits and gap analysis.
- Writing about running autonomous AI agents in practice (see Writing). As of October 2026.
→
Selected work, dated
Track record
Dates and scopes come from my own work history. Employers are not named.
Turning points
-
Into consulting: ISO 27001 and SOC 2 frameworks
Moved into information security compliance consulting: frameworks, audits and gap analysis.
Basis: my own experience -
A GRC framework on the CSA Cloud Controls Matrix
At a payments company, as Security Compliance Specialist: rolled out a hierarchical GRC framework on the CSA Cloud Controls Matrix, automated control mapping and task workflows for ISMS audits, and ran internal security assessments.
Basis: my own experience -
IT Governance Manager
At an IT services company until Oct 2022: built and piloted an IT general controls assessment methodology, coordinated internal and external IT audits, and designed a document-management framework on three core ITIL processes.
Basis: my own experience -
IT Controls & Compliance Manager, VP
At a bank until Jan 2018: coordinated IT audits, was subject-matter expert for IT risk and controls, established the Internal Control System and Risk Control Matrix, and developed privileged-accounts management processes.
Basis: my own experience -
ISACA CRISC certification
Certified in Risk and Information Systems Control, issued April 2011.
verify on Credly ↗
Roles and education
- Jul 2023 – nowInformation Security Compliance, consulting
- Jan – Jul 2023Security Compliance Specialist, payments
- Feb 2018 – Oct 2022Information Technology Governance Manager, IT services
- Jul 2012 – Jan 2018IT Controls & Compliance Manager, VP, banking
- Mar 2011 – Jun 2012Information Technology and Security Manager, banking
- Jun 2009 – Mar 2011IT Infrastructure Risk and Controls Manager, banking
- Jan 2000 – Mar 2009Change Control and Compliance officer, banking
- Jul 1998Microsoft MCP, MCSE, MCDBA, MCSA (retired)
- Sep 1990 – May 1996Master's degree in Computer Science (with Honors), University of Aerospace Instrumentation