I build compliance programs that enable teams, open markets, and outlast the person who built them — turning regulatory complexity into the most durable competitive advantage a growth-stage company can own.
I’ve seen compliance treated as a tax on engineering — a year-long audit scramble that burns the team and stalls deals. The programs I build are different: synchronized, automated, and designed so evidence collected once serves every framework simultaneously. The team builds the program without noticing they’re building it. I call it compliance magic. It’s really pattern recognition at scale.
One evidence set serves SOC 2, ISO 27001, and HIPAA together. Ask engineering once. Use the answer everywhere.
Audit windows aligned so multiple auditors run in parallel. Year-round burden compressed to a focused three-month sprint.
JIRA workflows and Slack integrations route requests to control owners automatically. No spreadsheets. No chasing engineers mid-sprint.
Every certification decision maps to a specific deal pipeline entry or market segment — not to a security calendar.
Controls checked automatically between audit cycles. By audit time, the evidence is already there. Certification becomes an announcement.
Each row: baseline (grey circle), peer range (centre band), my result (vivid circle). Source: program records, public filings, industry benchmarks.
Forensic Architecture — expert analysis protecting Aetna Healthcare product development across enterprise systems.
Managed security and compliance for 50+ hospital networks handling PHIProtected Health Information: any health data tied to an individual. HIPAA requires strict controls for any vendor touching PHI. across AWS, Hadoop, and Salesforce.
First information security executive. Launched first-ever IAM program, Federal Audit Responses, and Disaster Recovery planning.
Led $3M enterprise DLP implementation across 20+ university departments; remediated 100,000+ incidents.
“The best compliance program is one the team builds themselves — and doesn’t even notice they’re building. That’s the magic.”
The certification portfolio I build is not operational overhead — it’s the direct unlock mechanism for regulated enterprise segments across every major market on earth. I’ve certified for, operated in, and crisis-tested programs in North America, Europe, the Middle East, and Asia-Pacific, including active BCDR programs in Ukraine and the Middle EastBusiness Continuity & Disaster Recovery frameworks I built and maintained under active regional crisis conditions — the highest-stress proof that a compliance program actually works when the environment stops cooperating. under real operational pressure.
Source: SEC filings, press releases, program records.
| Certifications | Market unlocked | Revenue outcome |
|---|---|---|
FINRA SEC 17a-4Rule 17a-4 mandates electronic records retention for broker-dealers. Any cloud vendor storing broker-dealer records must pass this evaluation. Completed four times at Rubrik — a prerequisite for every financial services enterprise deal.SOC 1 Type 2Covers controls relevant to financial reporting. Required by fintech and financial services procurement. Type 2 means controls were tested over a period (typically 6-12 months), not just described. | Financial Services & Broker-Dealers Non-negotiable gate for broker-dealers. Four evaluations completed at Rubrik. | $B+ TAM Financial services data security |
HIPAAHealth Insurance Portability and Accountability Act. Any vendor handling Protected Health Information (PHI) must be HIPAA-compliant. Non-negotiable for hospital systems, payers, and health tech platforms.HITRUSTHealthcare-specific certification combining HIPAA, NIST, and ISO controls. Preferred by major hospital networks and insurers over HIPAA alone — demonstrates a higher level of operational maturity. | Healthcare & Life Sciences Table-stakes for hospital systems, payers, and health tech buyers. | $390B+ TAM Healthcare IT · opened from zero |
EO 14028Executive Order on Improving the Nation's Cybersecurity (May 2021). Requires federal software suppliers to self-attest compliance with NIST SP 800-218. Active attestation maintained to preserve federal pipeline eligibility.FedRAMPFederal Risk and Authorization Management Program. The US government's cloud security authorization. Without FedRAMP authorization, no federal agency can procure a cloud service. One of the most rigorous and expensive compliance gates in enterprise software. | US Federal Government FedRAMP Moderate completed FY2025, unlocking the full US federal chain. | $100B+ TAM US federal IT · GSA eligibility |
BSI C5BSI Cloud Computing Compliance Criteria Catalogue. Published by Germany's Federal Office for Information Security. Required by German financial institutions and government agencies for cloud vendors.IRAPInformation Security Registered Assessors Program. Australia's government cloud security framework. Required for any vendor selling to Australian federal and state agencies.TISAXTrusted Information Security Assessment Exchange. Managed by ENX Association on behalf of the German automotive industry. Mandatory for any supplier to BMW, Volkswagen, Mercedes-Benz, and other OEMs. | Germany · Australia · Automotive OEMs Three markets from one coordinated portfolio build. | EU+APAC+Auto Three markets, one build |
| ISO 42001International standard for AI Management Systems (AIMS). Published December 2023. Pursued proactively before any customer demand — establishes governance, risk management, and accountability for AI systems. First-mover advantage in AI-governed data security. | First-mover: AI Governance Pursued before any customer requested it. Certifies at a fraction of the eventual cost. | First mover AI-governed data security |
Teal polygon = my profile. Grey dashed = Head of GRC peer (10+ yrs). Amber dotted = CCO peer. Score cards below show my raw scores per dimension.
Scores (0–10) reflect demonstrated outcomes across 13 years and three companies, weighted by recency, scale, and verifiable business impact. Each dimension maps to an industry-standard GRC competency framework (ISACA, (ISC)², NIST NICE).
GRC peer baseline — composite of Head of GRC / Head of Compliance at enterprise SaaS ($200M–$2B ARR), 10+ yrs. Source: LinkedIn data, ISACA compensation surveys, Foushee & ScottMadden Security Benchmarks 2024.
CCO peer baseline — composite of Chief Compliance Officers at comparable-stage companies. CCOs score higher on mature program management; lower on zero-to-one builds, sales enablement, and AI governance.
Selected from LinkedIn. Full profile at linkedin.com/in/savannamyer ↗
Savanna completely transformed how we approached compliance at Rubrik. What she built wasn’t just a set of certifications — it was a revenue strategy. I watched enterprise deals close specifically because of the compliance posture she designed. She has a rare ability to speak fluently with customers, auditors, and engineers in the same week, and make all three feel like they’re getting exactly what they need. The programs she built will outlast her tenure by years.
I’ve worked with a lot of compliance leaders who treat certifications as a checkbox exercise. Savanna treats them as a go-to-market motion. During our time together she drove us from 3 to 13 certifications without growing the team proportionally — that math only works if the methodology is genuinely efficient. Beyond the numbers, she built a team culture where compliance wasn’t the department that said no. She turned it into the department that opened doors.
As an audit partner, I see the full range of how companies manage their compliance programs. Savanna’s Coordinated Compliance approach is genuinely different — her evidence architecture is clean, her control mapping is tight, and her teams are prepared. Audits with her programs take a fraction of the time of comparable engagements because the infrastructure is built to be audited, not just to pass. I’ve recommended her methodology to other clients as a benchmark.
When I first met Savanna I was skeptical that compliance could be a competitive advantage rather than a cost center. Three months into her program I was a convert. She redesigned our entire evidence collection process so that by the time we went to audit, every artifact was already in place. Our engineers stopped dreading compliance requests. That shift in culture is harder to achieve than any certification, and she made it look effortless.
I recruited Savanna because we were nine months from an IPO and our compliance posture was a liability. What she built in that window was extraordinary — not just the certifications, but the documentation, the customer-facing assurance materials, and the internal culture of evidence-as-habit. The S-1 diligence process went smoothly. Investors asked compliance questions that most companies stumble on. We answered them with published whitepapers. That was Savanna’s work.
Savanna has a quality I rarely see in compliance professionals: she thinks in systems. She doesn’t just ask what framework requires what control — she asks how one piece of evidence can satisfy six frameworks simultaneously, and then builds the infrastructure to make that happen automatically. In our engagement she compressed what would have been an 18-month multi-framework certification effort into under five months. The audit partner called it the cleanest program he’d reviewed in a decade.
The same instinct that finds the hidden control satisfying five frameworks at once is the instinct I carry across all three of my graduate degrees: find the structure connecting unrelated systems, name the pattern, build something that uses it.
Each degree contributes a distinct layer. The intersections are where the real capability lives.
Let’s talk about the next locked market.
Your mail client should have opened. Reach me directly on LinkedIn ↗
I’ve spent 13 years building compliance programs that open markets and enable teams at growth-stage companies. The program gets built. The team gets trained. The market gets opened. I’m looking for the next company that needs all three.