I'm Shazia Saeed. For 15+ years at PwC, ReliaQuest, Protiviti and Accenture, I've built governance, risk and security programs from nothing and gotten them adopted across global organizations. Then I automate them, because a developer is still who I am at heart.
I advise CIOs, CISOs, legal counsel and boards on GRC strategy in terms of revenue, contracts and insurance, which is the language leadership acts on.
I speak engineering's language. Controls get embedded in the pipeline, evidence gets collected automatically, and audits stop being a fire drill.
I've trained people with no security background into senior roles, and I lead mentorship for high-achieving women in security.
Accenture hired me straight out of college and told me I'd be a database administrator for a telecom company. It was sink or swim. I built a network of DBAs around me and learned on the job, then went on to deliver ERP systems and custom applications for large enterprises.
When I moved into risk management at PwC, I kept that engineer's lens. My first compliance role uncovered a 49% ITGC deficiency rate. Within a year we had brought it down to 6%, and I was handpicked to build PwC's first global information security compliance program. Others had tried before and stalled. I built it from scratch and took it across 151 member firms.
Since then I've led risk and compliance at ReliaQuest, an AI cybersecurity company serving 1,300+ enterprise clients. I returned to PwC to run GRC and business continuity for a $450M product portfolio, where I built AI agents that do the manual work for us.
You can take the girl out of technology, but you can't take the technology out of the girl.
Each one written up the way I'd document a finding: what was wrong, what I did, and what changed.
151 independent member firms with no consistent information security compliance. Earlier attempts had stalled because of the complexity.
Before rollout I met every CISO individually and framed compliance as a way to win more clients. I placed regional team members across the Americas, EMEA and APAC and built a unified controls framework where one piece of evidence satisfies many controls. I reviewed automated dashboards weekly with the Global Chief Risk Officer.
Delivered on time and within budget. The program ran as a centrally ISO-certified shared service, and its revenue funded ongoing cybersecurity investment across the network. No CISO wanted to be the red dot on the CRO's dashboard.
Commercial digital products earning $450M a year had no shared GRC framework and no executive sponsor for one.
I led with business impact instead of compliance language. I showed product leaders where missing controls conflicted with customer contracts they had already signed, which made compliance a customer-retention issue. Legal, Risk & Quality and Contracts became advocates.
A framework anchored in NIST CSF, NIST AI RMF, COBIT, ISO 27001 and SSAE 18. We closed 10 high-risk findings and rolled out repeatable remediation playbooks enterprise-wide.
An AI cybersecurity company serving 1,300+ enterprise clients needed SOC 2 Type 2, ISO 27001, PCI-DSS and HIPAA audits each year.
I kicked off all four audits together on a common controls framework in LogicGate, so evidence collected once satisfied every framework. I also turned customer assurance into a sales enabler and built a four-tier vendor risk program.
Shorter audit timelines and far less burden on process owners. Third-party risk went from ad hoc requests to a consistent process.
Critical gaps in IT general controls put the reliability of financial statements at risk.
I led SOX/ICFR scoping, tracked remediation rigorously with steering committee escalation, and redesigned SAP Financials security to remove segregation-of-duties conflicts.
Senior leadership noticed the turnaround, and it led directly to the global security compliance mandate.
Automation only works on a sound process, so I prove the manual version first. These are the three I built at PwC.
Pulls elevated accounts from Azure, VMs, databases, ADO and GitHub and matches them against team rosters. Only exceptions go to approvers. Accounts marked invalid automatically open a ServiceNow ticket for termination.
Scans every resource in the Azure subscription, rates its criticality and baselines its configuration. It has flagged a production database with encryption turned off, storage made public, and logs that stopped reaching the SIEM.
A custom GPT compares the DR architecture with recovery time and recovery point requirements from the business impact analysis. It recommends the right DR pattern and generates a remediation plan when they don't match. Tested across 30 products.
When leaders are bought in, half the battle is won. Their mandate drives adoption and accountability.
Controls don't run themselves. Every control needs a named owner who is held to it.
Harvest evidence straight from source systems. That removes human error, omissions and inconsistency.
Every finding gets an owner, a plan and a due date, with automatic escalation when SLAs slip.
A live signal that controls work every day, not a quarterly snapshot.
When I built PwC's AI controls framework on the NIST AI RMF, 80% of the controls turned out to be conventional IT general controls. Only 20% were truly AI-specific, and that's where teams should spend their attention.
You have built rapport and trust with the Risk & Compliance team as well as teams across the business, and have brought structure and maturity to how the team operates. You have a high level of accountability and can be trusted to execute and get things done.
Her genuine interest in the other members and passion for cultivating a safe environment has rapidly increased our level of comfort in opening up to share our ideas, endeavors, and efforts.
GRC, compliance engineering and resilience for 30+ commercial products ($450M), reporting to the Board of Partners. Built the AI controls framework and the agentic AI automations.
Enterprise GRC for an AI cybersecurity company with six global operating centers. Ran multi-framework audits, third-party risk, security awareness for 1,200 people, and the risk and compliance integration after the Digital Shadows acquisition.
Built the program across 151 member firms in a $57B network. Led a 14-person global team on a $2.3M budget.
Led the ICFR and SAP Security teams. Owned SOX scoping and testing, reporting to the CFO, Controller and Audit Committee.
ITGC, PCI-DSS and vendor governance across PeopleSoft, SAP, Oracle and SQL Server.
SOX internal audits, data center security assessments, pre-implementation reviews.
ERP and custom application delivery across telecom, education and transportation. Started as a DBA.
I speak at corporate events about where compliance is heading, and how organizations can build the governance they'll need to stay ahead of AI.
Inquire about a talkThe 80/20 of AI controls, and why waiting for standards is the wrong move.
What it takes to get independent firms to say yes.
Turning six weeks of manual work into four hours, and what to automate first.
Clarity, visibility and consequences in place of a mandate.
I assess where each person is today, build a plan around their strengths, and use real work as the classroom. I've trained people with no security background who went on to senior roles. One is now a partner at KPMG.
At PwC I led a mentorship circle for high-achieving women in security through the Women Security Leadership Forum. Strong mentors invested in me, and I'm passionate about paying it forward.
When I take something on, it gets done. That's the standard I hold myself and my team to.
When resources are tight, I find a way forward, whether that's sequencing scarce engineering time or putting AI to work.
I invest in the people around me and have developed senior managers across three regions.
Each morning I read what's new in how organizations adopt AI agents and write up one finding, with the sources so you can check it.
Loading the latest notes…
shasae099@gmail.comBased in Tampa, Florida · Speaks English, French, Hindi, Urdu and Punjabi