12+ years on both sides of risk and controls — building frameworks where none existed, and auditing established ones at enterprise scale.