Own the capability.
Lead the change.

Run a portfolio that can withstand an audit

Much of my career has been spent where an external party decides whether the control environment is adequate. I worked with FDA GxP and 21 CFR Part 11, ISO 27001 and SOX at Novo Nordisk, then with PCI DSS and provincial privacy requirements in a citizen-facing transit setting. I led a cross-portfolio security and compliance gap analysis across the organization's 55+ enterprise applications and owned the remediation program, the IT Security Standard and the evidence behind both. I did not own end-to-end application delivery for that estate; I strengthened the shared security, resilience and control layer that application owners had to operate.

The constraint I work to is external assurance, not a particular industry. At Novo Nordisk I separated platform qualification from application validation under a risk-based framework, reducing compliance overhead while strengthening the audit position.

Own the operating model around technology

I make accountability explicit and establish the standards, decision structures, service expectations and lifecycle controls that make enterprise technology dependable. That includes application portfolios, platforms, information security, continuity, suppliers and investment choices. I work from business-driven security architecture: requirements traced from business drivers through architecture to mechanisms, and back up again as assurance evidence. This included a US$11M annual application portfolio budget across Finance, HR, Legal and IT systems.

Turn direction into a capability that works

I use program discipline to connect strategy, component work, benefits, stakeholders and delivery. The work is not simply to track projects; it is to make the new capability work across the organization and leave the receiving team able to run and improve it. At Novo Nordisk I led the security and resilience layer of a program spanning 55+ enterprise applications. At Mphasis/UCB, I helped raise ITSM maturity from 1.5 to 3.5 across a 15,000-user global environment.

Lead people, budgets and suppliers

I have led a 20-person solution centre, managed performance, development and succession, and owned a cost centre with a US$11M application portfolio budget. I used forecasts, accruals, supplier commitments and service measures to keep delivery and spending visible.

Make decisions defensible and usable

I turn risk and control requirements into work people can own. I have worked with GxP, ISO 27001, SOX, PCI DSS, privacy, security standards, continuity and audit evidence, translating them into decisions, controls, exceptions and review points.

Bring international experience into public outcomes

Winnipeg has grounded the work in Canadian public procurement, citizen-facing services, vendors, budgets and operational continuity. I bring the same governance discipline to a public fare platform with 300,000 registered users and a multi-year modernization program.