Resume

Martin Paul Searle

Entry-Level GRC & Information Security Analyst | Open to relocation

Plymouth, United Kingdom | Email: martin.p.searle@outlook.com|

www.linkedin.com/in/martin-p-searle-895475404

Website: https://martinsearle1.com/ | GitHub: GRC-Hub https://github.com/Kernow19-cloud/GRC-Hub

Download resume (PDF)

PROFILE

Data protection and compliance professional seeking a first formal role in GRC, privacy or information security governance. Handles 2,500+ personal data access and amendment requests a year at the Valuation Office Agency (HMRC), applying UK GDPR and the Data Protection Act 2018 through identity verification and lawful-basis checks. Holds Lead Auditor training in ISO/IEC 27001, 27701 and 42001, and has built a self-directed portfolio of ISMS and AI management system documentation, risk registers, gap analyses and GDPR procedures, applying risk and compliance frameworks to both data governance and AI system oversight.

CORE SKILLS

  • Compliance and privacy: UK/EU GDPR, Data Protection, Data Protection Act 2018, RoPA, DSAR handling, breach response planning, lawful-basis assessment

  • Standards and frameworks: ISO/IEC 27001:2022, ISO/IEC 27701:2025, ISO/IEC 42001:2023, AI Governance, NIST CSF, PCI-DSS v4.0

  • Risk and governance: risk assessment and risk registers, third-party risk management, Statement of Applicability, policy development, compliance documentation

  • Security foundations: incident response planning, asset management and CMDB design, vulnerability management fundamentals (Qualys)

  • Tools: ServiceNow IRM (Risk, Compliance, Controls, Assessments, Entity Framework), Qualys Policy Compliance, Securiti

PROFESSIONAL EXPERIENCE

Administrative Officer, Data Quality and Compliance | July 2025 – Present Valuation Office Agency (HMRC), via Brook Street | Plymouth

  • Handle 2,500+ requests a year from members of the public to access or amend property details, completing identity verification and lawful-basis checks before each disclosure.

  • Process and validate property and personal data in accordance with UK GDPR and the Data Protection Act 2018, working daily in a regulated public-sector environment.

  • Contribute to the Record of Processing Activities (RoPA), keeping documentation aligned with current processes and compliance obligations.

  • Review internal processes and controls to flag data protection risks and support appropriate safeguards.

  • Advise internal teams on data protection requirements and liaise across departments on data governance standards, escalating complex data-quality queries to technical teams.

  • Validate and correct property records to maintain data accuracy for valuation and council tax purposes.

Freelance AI Trainer | June 2025 – June 2026 Mindrift

  • Tested AI outputs against written quality, safety and policy standards, a process comparable to testing evidence against audit criteria.

  • Identified and documented non-conformities, including factual errors, bias, and unsafe or policy-breaching responses, with a clear rationale for each.

  • Applied detailed guidelines consistently across large volumes of tasks, prioritising accuracy and quality.

  • Completed structured quality checks and met review and accuracy standards.

  • Handled confidential material under strict data protection and non-disclosure requirements.

Affiliate Marketer | March 2023 – June 2025 Self-employed, freelance, remote

  • Promoted sportswear brands, including Adidas and Nike, through third-party sites.

Pest Controller | November 2011 – March 2023 Cornwall

  • Assessed risks on client sites and recommended proportionate control measures.

  • Kept accurate treatment records and service reports to support client audits, including on sites subject to food safety and hygiene standards.

  • Handled and recorded hazardous substances in line with health and safety and COSHH requirements.

  • Reported non-conformities and advised clients on corrective actions; followed safe working practices including PPE, method statements and incident reporting.

Training and Certifications

  • ISO/IEC 42001:2023 Lead Auditor, Mastermind Assurance

  • ISO/IEC 27701:2025 Lead Auditor, Mastermind Assurance

  • ISO/IEC 27001:2022 Lead Auditor, GRC Mastery (Exemplar Global-recognised training provider), covering internal and external audits

  • Cybersecurity Governance, Risk and Compliance, GRC Mastery (cyber risk management, security audit, IAM, DLP, incident response, third-party risk)

  • Securiti PrivacyOps Academy Certified

  • Securiti AI Security and Governance

  • ServiceNow Integrated Risk Management (IRM) Fundamentals, ServiceNow University

  • Fundamentals of PCI-DSS v4.0.0

  • Qualys Policy Compliance Foundation

  • Qualys Vulnerability Management Foundation

  • University of Pennsylvania (Coursera): What is Compliance? (97.33%); Effective Compliance Programs (97.77%); Privacy Law and Data Protection (96.19%); Anti-Corruption and Compliance (96%); Regulatory Compliance

Applied Training Projects (Self-Directed)

Practical exercises completed alongside the training above. These are self-directed projects, not client or employer engagements, presented as evidence of applied framework knowledge.

Information Security (ISO/IEC 27001:2022)

  • Developed a full ISMS documentation set, including risk assessment, Statement of Applicability and core security policies required for certification.

  • Conducted an ISMS gap assessment and certification-readiness review.

  • Built an information security risk assessment and risk register, and a Third-Party Risk Management (TPRM) policy.

Data Protection (UK/EU GDPR)

  • Conducted a GDPR gap analysis identifying discrepancies between organisational practice and regulatory requirements, with proposed remediation steps.

  • Produced a personal data breach response plan and a Data Subject Rights (DSAR) procedure.

  • Compiled a GDPR policy collection and compliance review.

AI Governance (ISO/IEC 42001)

  • Built a full AI Management System (AIMS) documentation set for a simulated high-risk AI credit-scoring system: scope statement, AI policy, Statement of Applicability against Annex A controls, a quantified AI risk register (bias, explainability, data provenance, model drift, third-party risk), and a RACI-based governance and escalation model, aligned to EU AI Act and GDPR obligations.

Payment Security (PCI-DSS v4.0)

  • Completed a PCI-DSS readiness assessment, vendor risk assessment report and risk register.

  • Developed an incident response plan, access control policy, and data retention and cardholder data protection policy.

Cross-Framework Simulations

  • Conducted an end-to-end NIST Cybersecurity Framework maturity assessment.

  • Designed an asset management process and CMDB structure.

  • Modelled compliance projects for fictional organisations against PDPA (Singapore), ISO 27001, PCI-DSS and NIST CSF.

EDUCATION

• NCFE Level 2 in Cybersecurity: foundational coverage of threat awareness, network security, data protection and safe online practices.

Button

© 2026 Martin Searle.All Rights Reserved. Certain graphics on this website were created using AI tools. References to the NIST Cybersecurity Framework (CSF) are provided for informational purposes only and do not imply endorsement by NIST or the U.S. Government.

© 2026. All rights reserved.