Security that enables sustainable growth.
I help modern technology companies, financial entities, and European ICT suppliers navigate complex security frameworks — delivering clear risk governance and audit-ready compliance without bureaucratic friction.
Samer Buraei
Based in Belgrade, Serbia · Serving clients globally
Independent GRC (governance, risk, and compliance) and cybersecurity professional. I partner directly with founders, CTOs, and compliance leads to turn regulatory frameworks into pragmatic, defensible operational habits.
Read full bio & backgroundMy Certifications
Hover or tap for meaningFrameworks I Help With
Build and run a certified Information Security Management System (ISMS) across governance, people, physical, and technological controls.
Demonstrate operational security, availability, and confidentiality controls that US and global enterprise buyers demand.
Ensure ICT risk management, incident notification, resilience testing, and third-party oversight for EU financial entities and ICT providers.
Govern, identify, protect, detect, respond, and recover across your complete security posture with practical outcomes.
Comply with elevated cybersecurity risk management and reporting duties across critical and essential European sectors.
Safeguard customer and employee personal data with clear technical, organisational, and privacy-by-design controls.
Comprehensive CISO & GRC Architecture
Cybersecurity is more than isolated technical checkboxes. I provide structured advisory across five interdependent domains — from board-level risk appetite down to engineering controls.
Governance, Risk & Compliance
Transforming regulatory complexity into clear business confidence. I align your security posture with global standards and practical operational goals.
Regulatory Readiness
Navigating European and international mandates including DORA (EU Digital Operational Resilience Act), NIS2 (EU Network and Information Security Directive), and GDPR (EU General Data Protection Regulation). I translate legal requirements into an actionable control baseline.
Certification Journeys
End-to-end guidance for ISO 27001 (information security management), SOC 2 (trust services criteria for service organizations), and NIST CSF 2.0 (cybersecurity framework). From initial gap analysis to audit defense and continuous compliance.
Executive & Board Governance
Developing executive reporting dashboards, defining risk appetite, and translating technical cyber risks into clear business and financial impact for board members.
Enterprise Risk Management
Structured risk assessments, third-party vendor due diligence, and security reviews for mergers and acquisitions.
Evaluate Your ISO 27001 Posture
Run a rapid, indicative assessment to pinpoint governance gaps.
Readiness Assessment Engine
Take the guesswork out of compliance. Enter your systems, cloud footprint, and data types to automatically generate an indicative risk register and map controls against ISO 27001, SOC 2, DORA, and NIST CSF 2.0.
100% Client-Side Privacy
Zero data leaves your browser. All calculations run locally.
Export & Share
Print clean reports or download JSON/CSV registers for audits.
Cheat Sheets & Course Notes
Free, publicly accessible resources with zero signup required. Plain language, defensible frameworks, and practical templates.
ISO 27001 in One Page
A plain-language summary of clauses 4 through 10 and the four Annex A control themes.
SOC 2 vs ISO 27001: Which Do You Need First?
A decision matrix for SaaS founders comparing US enterprise demands against global standards.
DORA for ICT Suppliers: The First 10 Questions
What European banks and insurers will legally require from your cloud services and contracts.
Interactive Security & AI Labs
Hands-on environments to practice modern application security, AI safety (such as prompt injection defense), and cloud posture hardening. Currently in development and clearly marked as demo previews.
Let's build an intuitive security posture.
Whether you are preparing for your first ISO 27001 or SOC 2 audit, reviewing DORA compliance as a financial ICT provider, or seeking fractional CISO leadership, I work directly with your team.