Samer Buraei
Based in Belgrade, Serbia · Serving clients globally
I am an independent GRC (governance, risk, and compliance) and cybersecurity professional. I help fast-growing technology companies, SaaS providers, and European financial entities build defensible, audit-ready security programs without drowning in bureaucracy.
My advisory work is anchored in three globally recognized, rigorous professional certifications: CISSP (Certified Information Systems Security Professional, issued by (ISC)²), CISA (Certified Information Systems Auditor, issued by ISACA), and CISM (Certified Information Security Manager, issued by ISACA).
“With a career dedicated to information security architecture, enterprise risk management, and audit defense, I focus on bridging the gap between technical engineering teams and executive board expectations. Whether navigating European digital resilience regulations or preparing a US SaaS startup for its first SOC 2 Type II report, my approach prioritizes actionable habits over paper-only compliance.”
My Professional Certifications
Each credential represents a verified mastery of governance, engineering, or audit principles.
Certified Information Systems Security Professional
Enterprise security architecture, risk management, and holistic defense leadership.
Certified Information Systems Auditor
Rigorous audit readiness, control evaluation, and defensible compliance evidence.
Certified Information Security Manager
Executive alignment of security programs with corporate strategy and board governance.
How I Work: From Chaos to Continuous Assurance
A structured, four-step engagement model designed to deliver measurable progress at every phase.
Baseline Gap & Risk Discovery
We begin by mapping what you actually operate — cloud assets, code repositories, data flows, and third-party vendors. I compare your current controls against target frameworks like ISO 27001, SOC 2, or DORA to highlight true operational exposure rather than theoretical risks.
Pragmatic Remediation Roadmap
Instead of an overwhelming 200-item compliance backlog, I deliver a prioritized roadmap. High-impact risks and critical auditor requirements are tackled first, calibrated to your engineering velocity and budget.
Operational Control Integration
Compliance only works when engineering and operations teams can live with it. I help integrate automated security checks, access review cadences, and incident response playbooks directly into your daily workflow.
Audit Defense & Continuous Assurance
I represent your security posture during external auditor walkthroughs and enterprise customer security questionnaires, ensuring long-term audit readiness and executive confidence.
Frameworks I Help Organizations Navigate
Expanded definitions and context for the core standards supported in my advisory engagements.
Build and run a certified Information Security Management System (ISMS) across governance, people, physical, and technological controls.
Demonstrate operational security, availability, and confidentiality controls that US and global enterprise buyers demand.
Ensure ICT risk management, incident notification, resilience testing, and third-party oversight for EU financial entities and ICT providers.
Govern, identify, protect, detect, respond, and recover across your complete security posture with practical outcomes.
Comply with elevated cybersecurity risk management and reporting duties across critical and essential European sectors.
Safeguard customer and employee personal data with clear technical, organisational, and privacy-by-design controls.
Ready to evaluate your posture?
Try the free in-browser readiness tool or schedule a direct consultation.