{
  "name": "Tristan Jones \u2014 Consulting Capabilities",
  "version": "1.0",
  "services": [
    {
      "service": "Threat-Informed Risk Assessment",
      "description": "12-stage methodology grounded in NIST CSF 2.0. Likelihood driven by adversary behavior (MITRE ATT&CK), impact driven by control coverage gaps. Every finding traceable from technique to control to business risk.",
      "inputs": [
        "Risk Register",
        "CRI Profile Diagnostic Statements",
        "Policies and Procedures",
        "Network Architecture Diagrams",
        "Asset Inventory (ServiceNow CMDB)",
        "SIEM Alert Data (Splunk, QRadar)",
        "Vulnerability Scan Results (Nessus, Qualys)",
        "Threat Intelligence Feeds (FS-ISAC, CISA)"
      ],
      "outputs": [
        "Threat Profile (MITRE ATT&CK technique set)",
        "Coverage Assessment (Covered / Partial / No Coverage)",
        "Gap Analysis with Risk Scores",
        "Risk Heat Map",
        "Executive Summary (Board-ready)",
        "Remediation Roadmap with Owners and Timelines",
        "Evidence Packages per Finding",
        "Data Destruction Attestation"
      ],
      "frameworks": [
        "NIST CSF 2.0",
        "MITRE ATT&CK",
        "CRI Profile",
        "NIST SP 800-30",
        "FAIR",
        "SCF"
      ],
      "industries": [
        "Financial Services",
        "Banking",
        "Insurance"
      ],
      "stages": 12
    },
    {
      "service": "AI Governance Program Design",
      "description": "Design and implement AI governance frameworks for organizations deploying AI/ML systems. Covers risk assessment, model governance, bias detection, and regulatory compliance.",
      "inputs": [
        "AI/ML System Inventory",
        "Model Documentation and Validation Reports",
        "Data Governance Policies",
        "Regulatory Requirements (EU AI Act, State Laws)",
        "Existing IT Governance Framework"
      ],
      "outputs": [
        "AI Governance Framework",
        "AI Risk Register",
        "Model Risk Assessment Reports",
        "AI Policy and Procedure Documentation",
        "Compliance Gap Analysis",
        "Board Reporting Package"
      ],
      "frameworks": [
        "NIST AI RMF",
        "ISO 42001",
        "EU AI Act",
        "OWASP LLM Top 10",
        "COBIT 2019"
      ],
      "industries": [
        "Financial Services",
        "Healthcare",
        "Technology"
      ]
    },
    {
      "service": "CRI Profile Implementation",
      "description": "Map organizational controls to CRI Profile Diagnostic Statements and Response Guidance. Assess coverage, identify gaps, and design remediation plans for financial services regulatory requirements.",
      "inputs": [
        "CRI Profile Diagnostic Statements",
        "Existing Control Matrices",
        "GRC Platform Data (ServiceNow, Archer)",
        "Policy Documentation",
        "Prior Exam Findings"
      ],
      "outputs": [
        "CRI Coverage Matrix (Domain-level)",
        "Response Guidance Mapping",
        "Gap Register with Risk Ratings",
        "Remediation Plan",
        "Regulatory Exam Preparation Package"
      ],
      "frameworks": [
        "CRI Profile",
        "NIST CSF 2.0",
        "SCF",
        "FFIEC"
      ],
      "industries": [
        "Banking",
        "Financial Services"
      ]
    },
    {
      "service": "Control Design & Gap Assessment",
      "description": "Evaluate existing controls against MITRE ATT&CK mitigations to determine coverage effectiveness. Design new controls to close gaps based on adversary behavior, not compliance checklists.",
      "inputs": [
        "Control Inventory",
        "MITRE ATT&CK Technique Set",
        "Control Test History and Evidence",
        "Penetration Test Reports",
        "Configuration Audit Results (CIS-CAT)"
      ],
      "outputs": [
        "Control-to-Mitigation Traceability Matrix",
        "Coverage Ratings per Technique",
        "Control Design Specifications",
        "Prioritized Remediation Queue"
      ],
      "frameworks": [
        "MITRE ATT&CK",
        "NIST SP 800-53",
        "CIS Benchmarks",
        "SCF"
      ],
      "industries": [
        "Financial Services",
        "Critical Infrastructure"
      ]
    },
    {
      "service": "IT Audit",
      "description": "COBIT 2019-based IT audit methodology covering ITGC testing, access controls, change management, SDLC, and data integrity. 15+ years of hands-on audit execution at major financial institutions.",
      "inputs": [
        "Prior Audit Reports",
        "Control Documentation",
        "System Access Logs",
        "Change Management Records",
        "Evidence Artifacts (Screenshots, Exports)"
      ],
      "outputs": [
        "Audit Findings Report",
        "Control Deficiency Documentation",
        "Remediation Recommendations",
        "Management Action Plans",
        "Evidence Workpapers"
      ],
      "frameworks": [
        "COBIT 2019",
        "ISO 27001",
        "SOX",
        "FFIEC"
      ],
      "industries": [
        "Financial Services",
        "Banking"
      ],
      "experience": [
        "Citibank",
        "S&P Global",
        "DTCC",
        "Truist",
        "MUFG",
        "City National Bank"
      ]
    }
  ],
  "certifications": [
    {
      "name": "CISA",
      "full": "Certified Information Systems Auditor",
      "issuer": "ISACA",
      "id": "#252955101",
      "status": "Active"
    },
    {
      "name": "AAIA",
      "full": "Advanced in AI Audit",
      "issuer": "ISACA",
      "id": "#263090511",
      "status": "Active"
    },
    {
      "name": "AWS AIF",
      "full": "AWS Certified AI Practitioner",
      "issuer": "AWS",
      "id": "#521927105",
      "status": "Active"
    },
    {
      "name": "CRISC",
      "full": "Certified in Risk & IS Control",
      "issuer": "ISACA",
      "status": "In Progress"
    }
  ],
  "contact": {
    "email": "tristan@tristanjones.ai",
    "linkedin": "https://www.linkedin.com/in/itauditorjones",
    "website": "https://tristanjones.ai"
  }
}