RISK
GRC & SECURITY RISK ANALYST
PHOENIX, AZ
Josh Gouvisis
12 years enterprise risk management. Now cybersecurity.
AVAILABLE
REMOTE
CYSA+ IN PROGRESS
2026
12 years enterprise risk management. Now cybersecurity.
GRC & Security Risk Analyst with 12 years of insurance risk management experience, now applying that foundation to cybersecurity. I spent my career identifying exposures, assessing risk, and advising on mitigation strategies that protected clients and assets across insurance and aviation. That same discipline drives everything I do in cybersecurity risk.
I completed the Google Cybersecurity Professional Certificate with hands on training in SIEM tools (Splunk, Chronicle), network analysis (Wireshark, tcpdump), intrusion detection (Suricata), Python, SQL, and Linux. I hold the CompTIA Security+ and ISC2 Certified in Cybersecurity (CC) certifications and am building portfolio projects focused on NIST CSF gap assessments, vendor risk evaluations, and security policy development.
jgouvisis@gmail.comGap assessment for a fictional mid size company evaluating security maturity across all six NIST CSF functions. Scores current maturity, identifies gaps, and provides prioritized remediation recommendations. The biggest surprise: the tools already existed, but without governance connecting them, they weren't doing much on their own.
Evaluation of a fictional SaaS vendor's security posture using a structured risk questionnaire, risk scoring methodology, and written findings with remediation recommendations. The hardest gap to catch wasn't the obvious one, it was realizing "SOC 2 completed" didn't mean the trust criteria that actually mattered were in scope.
Acceptable use, incident response, and access control policies for a fictional company, aligned to NIST CSF and industry best practices. The real risk wasn't in granting access, it was in what happens after: the deprovisioning and access reviews that most policies treat as an afterthought.
Python scripts demonstrating automation of access control management, security log parsing, and data analysis. Skills directly applicable to compliance monitoring, audit support, and risk reporting workflows. Built through five hands on labs covering file automation, regex pattern matching, and systematic debugging, the fundamentals GRC tooling runs on.
Whether I'm evaluating a coverage gap in an insurance policy or a control gap in a NIST CSF assessment, the same three questions guide the work: what's exposed, how likely is it to be exploited, and what does it cost to fix versus ignore.
Twelve years in enterprise risk management taught me to translate technical findings into language stakeholders act on. A vulnerability without a cost and a likelihood attached is just noise. That's the lens I bring to cybersecurity: score the gap, prioritize it, and write remediation guidance someone can actually execute.