↓ Skip to main content
Home

Christian Carrasco

IT Risk & Controls Analyst · Security GRC

Ran the systems. Now I prove the controls.

IT Risk & Controls Analyst in Orlando, working the evidence, findings and reviews behind security controls in SOC 2 and FedRAMP programs. Before that, ten years running enterprise IT in regulated environments: major incident management for Toyota Motor North America, leading an engineering team, identity and access, and the control testing that came with it. I ran the systems auditors test. Now I do the testing.

See the lab Read the resume

Skills & Tools

  • SOC 2
  • NIST SP 800-53
  • NIST CSF
  • HIPAA
  • Excel
  • Conditional Access
  • Group Policy
  • Microsoft 365
  • Vulnerability Mgmt
  • Cylance
  • Cisco Umbrella
  • Defender for Cloud Apps
  • AWS IAM
  • Route 53
  • Shield and WAF
  • Azure
  • PagerDuty
  • SCCM
  • PXE imaging
  • KACE
  • Windows Server
  • VMware
  • Proxmox
  • Compliance Manager
  • Intune
  • Defender for Cloud
  • Power BI
  • FedRAMP
  • ISO 27001
  • PCI DSS
  • ServiceNow
  • Entra ID
  • Active Directory
  • Exchange
  • LogRhythm
  • Sophos
  • Check Point
  • Imperva
  • Wireshark
  • AWS Lambda
  • CloudFront
  • Site-to-Site VPN
  • Dynatrace
  • Power Automate
  • FACETS
  • Jenkins
  • Password Safe
  • Hyper-V
  • Linux
  • OPNsense
  • Entra PIM
  • Azure Policy
  • Purview Audit

Highlights

5 yrs

Major incident management

Five years leading major incident management for Toyota Motor North America’s production applications, the last three as Operations Manager, leading the engineering team.

160+

AWS accounts, one report

Automated cost and tagging reporting across 160+ client AWS accounts, actual and forecast spend included, replacing a manual pull that cost the team 25 to 30 hours a week.

3

Audit cycles supported

Control testing against NIST CSF with PCI DSS alongside, an annual ISO 27001 review, and HIPAA audit evidence, all from the IT and security side before this role.

2

Languages

Fluent in English and Spanish, able to work directly with Spanish-speaking teams, control owners and stakeholders.

Core Strengths

Compliance Support

Audit Evidence & Access Reviews, Control Testing Support, Remediation Tracking, SSCP Passed, Studying CISSP

IT General Controls, Hands On

Logical Access & Access Reviews, Change Management & CAB, Monitoring, Incident & Backup Controls, Entra ID & Active Directory

ITSM & Operations Leadership

Major Incident, Problem & Change, SLAs & Vendor Contracts, Team Leadership, Runbooks & SOPs

Security Operations

SIEM Administration, Alert Triage, Phishing Investigation, Vulnerability Remediation

Career at a Glance

  1. 2026 to now

    IT Risk & Controls Analyst

    A cybersecurity company, Orlando

    Audit evidence and compliance records, evidence requests with auditors, remediation and exception tracking, policies and review schedules, vendor reviews, and continuous monitoring submissions.

  2. 2023 to 2026

    Operations Manager, promoted in 2023

    Beyondsoft Consulting, on assignment at Toyota Motor North America

    Major incident management lead, SLA performance run as a recurring control, support for the annual ISO 27001 review, the Dynatrace and PagerDuty contracts, and leadership of the engineering team.

    2021 to 2023

    Senior/Lead Technical Systems Analyst

    Beyondsoft Consulting, on assignment at Toyota Motor North America

    Logical access in Entra ID with Conditional Access, MFA and access reviews, misconfiguration reviews of client AWS accounts, a CAB-validated change procedure, and the DNS and certificate lifecycle.

  3. 2019 to 2020

    Information Security Analyst

    TelevisaUnivision

    Control testing against NIST CSF with PCI DSS alongside, findings and risk acceptance tracked in ServiceNow, user access reviews, and lead LogRhythm SIEM administrator.

  4. 2014 to 2019

    Technical Support Analyst

    Cigna HealthCare

    Grew from level 1 support to the team’s level 3 escalation point: Active Directory and Exchange access administration, the onboarding and offboarding SOPs, and access evidence through HIPAA audit cycles.

  5. 2013 to 2014

    IT Support Specialist

    Commonwealth-Altadis

    Deployed more than 300 machines for a sales force of over 1,500 agents.

Read the full resume

Certifications & Education

Active
  • LPI Linux EssentialsLifetime (active)
  • CompTIA Project+Lifetime (active)
  • CompTIA Cloud Essentials+Lifetime (active)
  • Azure AI Fundamentals (AI-900)2024 (active)
In progress
  • ISC2 SSCPPassed · endorsement pending (in progress)
  • ISC2 CISSPNext · 2027 (in progress)
Previously held
  • Cisco CCNA Routing & Switching2020 to 2023 (previously held)
  • CompTIA Security+2019 to 2022 (previously held)
  • Certified Ethical Hacker (CEH)2019 to 2022 (previously held)
  • AWS Certified Cloud Practitioner2019 to 2022 (previously held)
  • CompTIA A+2018 to 2022 (previously held)
  • ITIL 4 Foundation2019 to 2023 (previously held)
Degree
  • B.S. Network Operations and Security · Western Governors University

What’s Cooking

  • ISC2 SSCP Passed the exam on November 10, 2026. Endorsement with ISC2 is in progress
    Endorsement
  • ISC2 CISSP Straight after the SSCP, with the study already done. What follows depends on where the work leads
    Next
  • The lab A fictional SaaS company audited against SOC 2 and FedRAMP Moderate, one workpaper at a time, with the Microsoft stack collecting the evidence. First up: an ITGC test of logical access
    In progress

Open Bridge

> connect --linkedin

Not looking, always listening. If you work in GRC, are making the same move from IT operations, or have a role worth a conversation, I’d like to hear from you.

LinkedIn is the easiest place to find me, so join the bridge and say hi.

Connect on LinkedIn