Ілля

Illia Merkulov
GRC Analyst | Information Security & Compliance

Kyiv, Ukraine • Open to Remote • [open contact info](look above in the "contact info" section) • [open contact info](look above in the "contact info" section)

PROFESSIONAL SUMMARY
IT professional with 2 years of hands-on experience in system administration, Active Directory, and network infrastructure. Combines practical IT
operations background with structured GRC knowledge — ISO/IEC 27001 risk assessments, access management, and security controls. Technical
background enables effective communication between IT teams and compliance functions, applying security-first thinking in daily operations.

GRC KNOWLEDGE & PRACTICE
Risk Management Security & Compliance
▪ Conducted ISO/IEC 27001-based risk assessments for IT systems ▪ Removed access for terminated employees promptly to prevent
and infrastructure — identified risks, evaluated existing unauthorized access — maintained formal offboarding security
controls and documented risk levels with justification checklist
▪ Developed Risk Registers and Risk Treatment Plans aligned with ▪ Supported Security Awareness program: distributed training
ISO 27001 Annex A controls — defined treatment actions, materials, tracked completion rates across departments,
owners and timelines for each identified risk analyzed test results to identify knowledge gaps
▪ Assessed effectiveness of security controls, identified gaps and ▪ Developed Security Awareness recommendations based on
formulated findings with actionable remediation identified gaps — proposed training topics, formats and
recommendations completion metrics

Access Management & Reviews Framework Knowledge
▪ Conducted User Access Review scenarios: identified excessive ▪ ISO/IEC 27001:2022
access and orphan accounts — documented ▪ NIST CSF 2.0
Approve/Revoke/Modify decisions per role requirements ▪ SOC 2 (Foundational Knowledge) · GDPR (Fundamentals)
▪ Implemented controlled temporary administrative access with
mandatory password rotation after task completion, reducing
standing privilege exposure
▪ Applied RBAC, Segregation of Duties and Principle of Least
Privilege consistently when provisioning access to corporate
resources

PROFESSIONAL EXPERIENCE
IT Infrastructure & Security Specialist 2023 – Present | Kyiv, Ukraine

▪ Coordinated end-to-end onboarding and offboarding: AD ▪ Supported Windows Server 2019 infrastructure: Active
account lifecycle, VPN provisioning and revocation, access Directory, DNS, DHCP and File Server roles
cleanup across all platforms ▪ Administered MikroTik network infrastructure: VPN
▪ Managed user access according to Principle of Least Privilege connectivity, NAT rules, firewall policies and configuration
and departmental responsibilities — applied RBAC for all backups before critical changes
resource provisioning ▪ Investigated infrastructure issues, identified root causes and
▪ Maintained IT asset inventory with full lifecycle tracking; implemented corrective actions to maintain business continuity
performed secure workstation reimaging before reassignment
to new employees

SKILLS

GRC Risk Assessment · Risk Register · Risk Treatment · Access Reviews · Security Awareness · Incident
Analysis

Frameworks ISO/IEC 27001:2022 · NIST CSF 2.0 · SOC 2 · GDPR

IAM Active Directory · RBAC · Principle of Least Privilege · GPO · Segregation of Duties

Infrastructure Windows Server 2019 · MikroTik RouterOS · VPN · Firewall/NAT · TCP/IP · RDP

Languages: Ukrainian — Native • English — B1 (Intermediate)