Dr. Ryan Shah ~ Security Assurance & Audit

Researcher turned practitioner

I sit where academic rigour meets the unglamorous reality of getting an organisation certified, compliant and genuinely more resilient.

I hold a PhD in information and network security and privacy, and now work as Staff Engineer, Security Assurance & Audit at Nscale, after several years consulting in GRC and data protection.

My research, ten peer-reviewed papers on side-channels, IoT safety and traffic analysis, taught me to treat evidence as the product. In practice I turn frameworks into outcomes: vCISO, vISM and DPO engagements across health, finance and industry, and standards-based assurance explained to very different audiences, often under time pressure.

Career and education

2026 to now
Staff Engineer, Security Assurance & Audit
Nscale

Hands-on lead for assurance and audit: SOC 2 Type II, ISO and customer commitments. I own audit readiness for new sites, one control framework across SOC 2, ISO and NIST, evidence standards, and the relationship with external auditors, working with GRC engineering on evidence automation.
2025 to 2026
Data Protection Officer
Sapphire, UK

Independent oversight and advice on UK and EU data protection law, including the GDPR. I led privacy governance (policies, training, audits, records of processing), breach management and incident response, DPIAs and DSARs.
2024 to 2026
Senior Security Consultant
Sapphire, UK

Led complex GRC engagements across compliance, assurance and risk. Product owner for Third-Party Risk Management, with vCISO and vISM support in healthcare, finance and industry. I led tenders across ISO 27001, 27701, 22301, 22237 and 42001, the GDPR, DORA, NIS 2, the NCSC CAF and NIST CSF.
2023 to 2024
Security Consultant
Sapphire, UK

Subject-matter expert on DORA and NIS 2. I led ISO 27001, 22301 and 27701 engagements from gap analysis to internal audit and certification, plus awareness training and business continuity, across transport, logistics, education, healthcare, manufacturing and finance.
2022 to 2023
Postdoctoral Researcher
Heriot-Watt University, Edinburgh

SECRIOUS project: how new-code and non-traditional entrants engage with cyber security in software engineering, with human-centred approaches to security education across cyber security, games research and HCI.
2018 to 2022
PhD, Cyber Security
University of Strathclyde

Thesis: Security of Robotic Workflows. Calibration security and operational privacy in robotic, cyber-physical and safety-critical systems: passive side-channel threats, access control and blockchain-based approaches, using machine learning and signal processing.
2014 to 2018
BSc Computer Science, First Class
Heriot-Watt University

Software development, networking and cyber security. My final-year project built a tool to identify and remediate IoT devices vulnerable to the Mirai malware in real time. Advanced coursework in network security, AI, machine learning and distributed systems.

Research

Side-channels, IoT safety and traffic analysis, 2019 to 2025.

10 papers listed below

Publications, newest first
Year	Paper	Venue
2025	WaveVerif: Acoustic Side-Channel based Verification of Robotic WorkflowsZ. Y. Erdogan, S. Nagaraja, C. M. Ahmed, R. Shah	arXiv preprint
2023	Sensor Identification via Acoustic Physically Unclonable FunctionG. Vaidya, T. V. Prabhakar, N. Gnani, R. Shah, S. Nagaraja	Digital Threats: Research and Practice
2022	Can You Still See Me? Reconstructing Robot Operations Over End-to-End Encrypted ChannelsR. Shah, C. M. Ahmed, S. Nagaraja	ACM WiSec 2022
2022	Fingerprinting Robot Movements via Acoustic Side-ChannelR. Shah, M. Ahmed, S. Nagaraja	arXiv preprint
2022	Reconstructing Robot Operations via Radio-Frequency Side-ChannelR. Shah, M. Ahmed, S. Nagaraja	arXiv preprint
2021	VoIPLoc: Passive VoIP Call Provenance via Acoustic Side-ChannelsS. Nagaraja, R. Shah	ACM WiSec 2021, Abu Dhabi
2020	A Unified Access Control Model for Calibration Traceability in Safety-Critical IoTR. Shah, S. Nagaraja	ICISS 2020, Intl. Conference on Information Systems Security
2019	Clicktok: Click Fraud Detection using Traffic AnalysisS. Nagaraja, R. Shah	ACM WiSec 2019
2019	Secure Calibration for High-Assurance IoT: Traceability for Safety ResilienceR. Shah, M. McIntee, S. Nagaraja, S. Bhandary, P. Arote, J. Kuri	arXiv preprint
2019	Do We Have the Time for IRM? Service Denial Attacks and SDN-based DefencesR. Shah, S. Nagaraja	ICDCN 2019, Intl. Conference on Distributed Computing and Networking