Ledy Florez

GRC Specialist | Bridging the Gap between IT Security, Legal Compliance & AI Governance

How I Can Help Your Organization

Are you navigating the complexities of ISO 27001, struggling with GDPR documentation, or concerned about the upcoming requirements of the EU AI Act?

I help fast-growing startups and established enterprises in Berlin build robust Information Security Management Systems (ISMS) that are not just "compliant on paper," but technically sound and audit-ready. With a background as a qualified lawyer and hands-on training in Cybersecurity, I translate complex legal requirements into actionable IT controls.

What Sets Me Apart

The biggest challenge in GRC is the "silo" between the legal department and the IT team. I bridge that gap.

Legal Expertise: I understand the nuances of the BGB, TTDSG, and GDPR, ensuring your data processing and contracts are watertight.

Technical Proficiency: Unlike traditional compliance consultants, I understand the tech stack. I can discuss vulnerability management, IAM, and cloud security (AWS/GCP) directly with your DevOps and Security teams.

AI Governance Pioneer: I specialize in the EU AI Act, helping companies classify AI systems (Annex III) and implement the necessary risk management frameworks before the deadlines hit.

Key Deliverables & Projects I Manage

I provide end-to-end support for your GRC roadmap, including:

Framework Implementation: Gap analysis and roadmap for ISO/IEC 27001 and NIST CSF.

Data Privacy & GDPR: Building RoPA registers, conducting DPIAs, and finalizing audit-ready Cookie Policies.

Risk Management: Developing prioritized Risk Registers (likelihood/impact scoring) and treatment plans.

AI Compliance: High-risk AI classification, governance policy development, and ethical AI alignment.

Policy Pack Development: Drafting tailored policies for Access Control, BYOD, Remote Work, and Incident Response.

Third-Party Risk (TPRM): Reviewing DPAs and vendor security assessments to secure your supply chain.