GRC engineering and AI automation for security teams
Most governance, risk and compliance work is recurring work: the same assessment, the same report, rewritten by hand every cycle. I design workflows and direct AI agents to automate that work, and I use 20+ years of security experience to decide what is sensible to automate and who must still sign it off.
I am a Copenhagen-based freelance GRC engineering consultant working internationally, on site and remotely. My work is not limited to Copenhagen or Denmark. I do not write the code myself: I direct AI coding agents that build it, and I put a review step in front of anything that matters.
Recurring compliance work can be automated
Vulnerability and benchmark reports, risk and privacy assessments, maturity documentation, mapping one standard to another. Each piece is small. Together they take the week of the people who should be thinking about risk instead of copying numbers between tools.
The hard part is choosing what to automate and keeping a person accountable for the result. It also has to fit how your people already work. This is where security experience matters.
Rewritten by hand vs built once and reviewed every time
What I do
Automate recurring security reporting
GRC engineering
AI-assisted assessments and documentation
How an engagement runs
I start small on purpose: one process, one owner, one review step. If it works, we add the next process. If it does not, you have spent a short assignment, not a program.
How an engagement runs
Why the combination matters
I came to this from the security side. 20+ years of risk assessments, audits, awareness work and exercises, in-house and as a consultant, taught me what a good assessment looks like and where shortcuts hurt. Since spring 2026 I have worked daily with AI agents. I forked and extended an open-source assistant that runs my own consulting work, and I am experimenting with other agent harnesses, the tools that let an AI model work with files and systems. You can read about my background on the about page and in the profile of Klaus Agnoletti.
I learn new tools fast, and in a field that moves this fast that counts for more than knowing any one tool.
At a glance
| What it is | Security experience applied to automating GRC work with AI agents |
|---|---|
| What you get | Automation for one defined process, with a review step a person owns |
| Who it is for | Heads of security, risk and compliance leads, IT leads who own compliance work |
| How I work | Freelance, by the day, week or fixed scope |
| Where | Based in Copenhagen; available internationally, on site and remotely |
| Language | English or Danish |
| What it is not | General-purpose software development, certification, or legal advice |
Questions people ask
What is GRC engineering and how does it apply to security?
GRC engineering applies engineering practice to governance, risk and compliance: automate repetitive work early, and measure outcomes instead of counting finished checklists. A community publishes its manifesto at grc.engineering. I offer it as a way of working, fully or in parts.
How can AI help with risk assessments and reporting?
For the routine parts. I have used Claude Code to access the Qualys API for various customers and automated routine tasks with Azure Functions, including reporting on vulnerabilities, benchmark compliance and installed patches. Judgments about risk stay with people, and I design the work so a person reviews the result.
Do you write the code yourself?
No. I understand code at a high level and direct AI coding agents that write it. I am a security professional who automates, not a software developer.
Is it safe to use AI on compliance data?
It depends on the data and the tool. Any AI use on your data would be agreed with your jurists and management first, and I design workflows with approval steps. In my own setup, data classes are mapped to the model routes allowed to see them, and sending, publishing, infrastructure changes and money need approval.
Can you automate ISO 27001 or NIS2 work?
I have worked with ISO 27001/27002 and NIS2 in practice, including supporting an ISO 27001 certification audit. I can help automate the recurring evidence, reporting and documentation work around them. I do not certify and I do not give legal advice.
What is the engagement format?
Freelance assignments by the day, week or fixed scope. I am based in Copenhagen and work internationally, on site and remotely, in English or Danish. My work is not limited to Denmark.
Tell me which report you rewrite every cycle
Tell me which report, assessment or document your team rewrites by hand each cycle. A short description is enough; please do not send sensitive data at this stage.
