ServiceNow IRM/GRC & AI Governance
Your AI agents need a risk owner.
Governance that holds.
I reduce the complexity of enterprise risk on ServiceNow, so you stay in control as AI adoption grows.
- 3x ServiceNow MVP2024–2026
- CIS-GRC · CSACertified
- 7+ yearsIRM/GRC delivery
- Regulated sectorsBanking · Insurance · Public
A decade inside enterprise platforms
The kind of platforms where a bad governance call doesn't just slow things down. It costs millions and takes years to unwind.
My job is making sure that doesn't happen: aligning governance, architecture and platform strategy so a programme still makes sense two years after launch, not just on the day it ships.
Three pillars, one standard
Governed enterprise platforms
Platform strategy, architecture and governance designed so capability grows without creating control gaps.
- Governance-aligned platform design
- Capability operating model
- Platform risk controls
- CMDB governance
Aligned frameworksSOX · SOC 2 · NIST · PCI DSS · ISO 27001 · COBIT
Architecture and transformation that endure
A coherent architecture and the leadership to carry it, keeping growing programmes aligned to the same business intent without compromising control, even as scope, teams and vendors change.
- Platform governance architecture
- Solution architecture for complex estates
- Technical leadership and executive alignment
Aligned frameworksServiceNow IRM Maturity Program · NowCreate Methodology
AI within the control framework
AI and automation built to the same governance standard as everything else on the platform: auditable, accountable, mapped to risk and compliance.
- Governed automation
- Script-driven decision support
- AI risk and controls model
- AI Control Tower
Aligned frameworksEU AI Act
How I can help
I work with ServiceNow partners, ServiceNow Professional Services and end clients, on contract. Three ways to bring me in; all of them start with a 30-minute call.
-
Design authority
As-is assessment, to-be workshops, target operating model and a prioritised backlog for IRM/GRC and AI governance, then review of what your team builds against it.
-
Solution architect
Solution architecture for ServiceNow IRM/GRC estates, from the first control to AI Control Tower, built to survive every upgrade.
-
Technical lead
Hands-on technical leadership through complex programmes, from user stories to production, keeping scope, teams and vendors on the same intent.
Track record
- Siemens SAITSM · 2016 – 2018
- Sony Interactive EntertainmentCSM · 2018 – 2019
- WranguIRM/GRC · 2019 – 2026
- 06 · IRM ProgrammePan-Nordic payments infrastructure2023
- 05 · IRM ProgrammeGlobal Swiss engineering group2023 – 2024
- 04 · IRM P&CGlobal food manufacturer2024 – 2025
- 03 · IRM ProgrammeUK housing provider2025
- 02 · IRM ProgrammeTop-tier UK bank2025 – 2026
- 01 · AI Control TowerUK mutual insurer2026
- IndependentIRM/GRC & AI governance · 2026 – now
Last key projects
-
Governing AI the way the business already governs risk
UK mutual insurer · InsuranceSupporting consultant · Jun – Aug 2026 · via WranguOne of the UK's largest mutual insurers was adopting AI and needed its governance to carry the same evidence and oversight as the rest of its risk operating model. I supported the Wrangu team on a live ServiceNow AI Control Tower implementation that brought AI governance into a single, auditable operating model.
-
Owning the path from requirements to production
Top-tier UK bank · BankingTechnical Lead · Aug 2025 – Oct 2026 · via Wrangu / ServiceNowA large-scale IRM programme across Policy & Compliance and Risk, in a heavily regulated environment. I led the development team from requirements to user stories to production, and defined the deployment and peer-review processes the team delivered against.
-
Policy, compliance and risk, built from the ground up
UK housing provider · Public sectorTechnical Lead and Solution Architect · Jan – Apr 2025 · via WranguA UK public-sector housing provider needed an IRM platform where none existed. I ran the requirements workshops, designed the solution and led the build through to go-live across Policy & Compliance and Risk Assessment, in four months.
-
One control library for SOX and supplier assurance
Global food manufacturer · Food manufacturingTechnical consultant · Jun 2024 – Mar 2025 · via WranguA global food manufacturer, across Europe and North America, needed SOX and its suppliers' assurance reports managed in one place instead of spreadsheets. On ServiceNow IRM I built the control library, SOX plus seven SOC and ISAE reports, 260 control objectives and 337 controls, mapped to policies and to an entity model that creates risks automatically, with continuous monitoring scheduled on the company's fiscal calendar through a small custom app.
-
One IRM platform across a global engineering group
Global Swiss engineering group · EngineeringTechnical Lead and Solution Architect · Dec 2023 – Jun 2024 · via WranguA global Swiss engineering group needed Policy & Compliance and Risk Assessment on one platform, across departments and functions. I ran the requirements workshops, designed the solution and led the build through to go-live.
-
IRM for a payments infrastructure owned by six banks
Pan-Nordic payments infrastructure · PaymentsTechnical Lead and Solution Architect · Jan – Jun 2023 · via WranguA pan-Nordic payments infrastructure, owned by six of the region's largest banks, needed risk and compliance that would satisfy all of its owners. I ran the requirements workshops, designed the solution and led the build through to go-live across Policy & Compliance and Risk Assessment.
Delivered as Sr Technical Consultant at Wrangu, 2019 – 2026. Client names withheld for confidentiality.
- Sony Interactive EntertainmentLondon · Jul 2018 – Apr 2019Customer Service Management with a redesigned Service Portal and SSO, giving customers and support teams one unified platform.
- Siemens SALisbon · Aug 2016 – Jun 2018End-to-end ITSM (Incident, Problem, Change, Request, Knowledge, Catalog) with onboarding automation and Tableau executive reporting.
What people say about working with me
Rafael delivered a successful transformation while identifying opportunities to improve our platform maturity. His recommendations led to a follow-on engagement, and we now have a platform that consistently delivers what the business expects.
Rafael brought a rare combination of hands-on technical skill and genuine business judgement. Our platform is more coherent today because of the foundation he insisted on.
Rafael consistently delivered under significant pressure, embraced constructive feedback, and adapted his approach to improve the team's performance.
Get in touch
If you have a ServiceNow IRM/GRC contract, or a programme that needs a design authority, solution architect or technical lead, send me the role details and I'll come back with availability and a CV.