I'm a cybersecurity leader with 13+ years of experience spanning IT audit, governance, risk, compliance, and security advisory. Today, I lead cybersecurity consulting engagements and serve as a Virtual CISO, helping organizations develop scalable security programs and navigate frameworks.

I joined the GRC Engineering Club to intentionally step outside my comfort zone, strengthen my hands-on technical skills, and learn how engineering practices can make GRC more automated, scalable, and integrated with the systems we govern. I'm particularly interested in policy-as-code, infrastructure-as-code, continuous control monitoring, and finding practical ways to bring these concepts into real-world security and compliance programs.

Most recently, I worked through the Certified GRC Engineer Practitioner (CGE-P) labs and capstone, hardening a deliberately non-compliant AWS workload against the HIPAA Security Rule with Terraform, OPA/Rego policy gates in CI, signed and vaulted evidence, and OSCAL documentation.

• 13+ years of cybersecurity, GRC, and audit experience spanning enterprise IT audit, compliance program ownership, security advisory, and GRC Engineering.
• Lead a cybersecurity consulting practice supporting 60+ enterprise clients, while managing and developing a team of cybersecurity consultants.
• Serve as a Virtual CISO and trusted advisor to high-growth organizations, developing security strategies, risk management programs, and audit readiness across SOC 2, ISO 27001, HITRUST, CMMC, and other frameworks.
• Built enterprise GRC experience leading SOX ITGC and PCI DSS compliance programs and designing governance programs based on the CIS Controls.

I'm always happy to connect with other GRC, security, and audit practitioners. Whether you want to compare notes on compliance automation, talk through a framework or audit question, or just introduce yourself and say hello, feel free to reach out.

• Personal: lrkinkaid@gmail.com
• Work: lkinkaid@barradvisory.com