Sabbir Hossain

Cybersecurity Leader · GRC & AI Governance · Ottawa, Canada

Security leadership for regulated organisations. Proven at national scale.

Cybersecurity, GRC and AI governance leader for regulated organisations, with 15+ years across financial services, critical infrastructure and government. ISO 27001 Senior Lead Auditor and ISO 42001 AI Lead Auditor. Previously a core member of the team that built Bangladesh's first government CIRT, and contributor to its national cybersecurity strategy.

View major projects Get in touch
  • C|CISO
  • ISO 27001 Senior Lead Auditor
  • ISO 42001 AI Lead Auditor
  • CEH
  • ACE
15+years in cybersecurity
8national cyber programmes delivered
23critical infrastructures audited
~95%drop in nationwide attacks

Skills at a glance

See proof for each
  • Cyber strategy & policy10+ yrs
  • Governance, risk & compliance (GRC)10+ yrs
  • Audit & certification10+ yrs
  • AI governance & AI security6+ yrs
  • Incident response & security operations10+ yrs
  • Security testing10+ yrs
  • Digital forensics & investigations16+ yrs
  • Fraud, AML & KYC2+ yrs
  • Leadership, programmes & training16+ yrs

Selected projects

All projects

2015 – 2020

Bangladesh's first government CIRT

BGD e-GOV CIRT · Norway Registers Development / NRD Bangladesh

Built the country's national government CIRT after the 2016 Bangladesh Bank SWIFT heist.

  • ~95% drop in nationwide cyberattacks
  • Repeat attacks on banks and government blocked
  • Incident response
  • Strategy & policy

Jun 2018 – Jun 2019

National cybersecurity strategy & risk framework

Government of Bangladesh · with University of Oxford GCSCC

Led Bangladesh's national cybersecurity strategy with Oxford's Global Cyber Security Capacity Centre.

  • National strategy and risk framework
  • Covered in national press
  • Strategy & policy

Feb 2020 – Jul 2020

Critical infrastructure & Tier-IV data centre audit

Bangladesh National CERT · Digital Security Agency

Led audit and risk assessment of 23 critical information infrastructures, including the national Tier-IV data centre.

  • 23 critical infrastructures hardened
  • ~65% better compliance posture
  • Audit & risk

What colleagues say

All recommendations
Mr. Sabbir Hossain is a person one can rely for business operations and things get done, even when situations get difficult. His technical in-depth knowledge of ICT and Information Security disciplines are making him great communicator and effective business …
Vilius Benetis Establishment of incident response capabilities (SOCs / CSIRTs / ISACs / MSSPs) Managed Sabbir directly · Feb 2019
I have worked with Sabbir in several IT and Cyber Security international projects, financed by major international donors. In these projects Sabbir always was very professional and qualified manager, his project planing and execution skills were excellent. Sa…
Rimtautas Cerniauskas CIRT Solutions Architect, NRD Cyber Security Worked on the same team · May 2020
Mr. Sabbir is a fantastic manager. I had the pleasure of working with him on several projects for two years, and he leads by example. He always kept the team morale high, and I believe he is the best manager I've ever had because he is so approachable. His ab…
Mahidul Alam Reported to Sabbir directly Direct report · Jul 2022

Latest insights

All articles

· 5 min read

The Only Exploited Flaw This Month Was Rated Moderate

Microsoft's November 2026 Patch Tuesday fixed more than 1,000 vulnerabilities, 63 of them Critical. The only one attackers were already using was the single Moderate, a CVSS 6.5 Outlook flaw. Why sorting patches by CVSS score puts the real risk last, and what to sort by instead.

  • Security Operations
  • Governance & Risk

Certifications across the domain

Full list

Leadership

EC-Council Certified CISO (C|CISO)

Governance, audit & privacy

ISO/IEC 27001 Senior Lead Auditor (PECB) (verify on Credly) · ISO/IEC 27701:2025 Lead Auditor (verify on Credly) · COBIT 5 (ISACA) · ITIL Foundation

AI governance

ISO/IEC 42001:2023 AI Lead Auditor (verify on Credly)

Offensive security

Certified Ethical Hacker (CEH) · Lead Pen Test Professional

Forensics & investigation

AccessData Certified Examiner (ACE) · Certified Cyber Crime Examiner (3CE)

Financial crime

Certified Online Fraud Prevention Specialist (COFPS) (verify on Hack & Fix)

Education & delivery

Certified Cybersecurity Educator Professional (CCEP) (verify on Red Team Leaders) · Google Cybersecurity (verify on Coursera) · Google Project Management (verify on Coursera)

For hiring teams

Senior cyber, risk and GRC leadership

Open to senior cybersecurity, IT risk, GRC and security programme roles in Canada. I bring national CIRT and critical-infrastructure delivery, programme and P&L leadership, and current Canadian AML/KYC experience.

See experience

For organisations

Strategy, resilience and assurance

From cyber strategy and incident-response capability to audits, AI governance and penetration-test programmes, on fixed-scope engagements or as a fractional leader.

See services