Dr Ryan Shah

Reads regulation like a threat model.

Staff Engineer, Security Assurance & Audit at Nscale

Start a conversation

Researcher turned practitioner

I sit where academic rigour meets the unglamorous reality of getting an organisation certified, compliant and genuinely more resilient.

I hold a PhD in information and network security and privacy, and now work as Staff Engineer, Security Assurance & Audit at Nscale, after several years consulting in GRC and data protection.

My research, ten peer-reviewed papers on side-channels, IoT safety and traffic analysis, taught me to treat evidence as the product. In practice I turn frameworks into outcomes: vCISO, vISM and DPO engagements across health, finance and industry, and standards-based assurance explained to very different audiences, often under time pressure.

Career and education

  1. 2026 – now

    Staff Engineer, Security Assurance & Audit

    Nscale

    Hands-on lead for assurance and audit: SOC 2 Type II, ISO and customer commitments. I own audit readiness for new sites, one control framework across SOC 2, ISO and NIST, evidence standards, and the relationship with external auditors, working with GRC engineering on evidence automation.

  2. 2025 – 2026

    Data Protection Officer

    Sapphire, UK

    Independent oversight and advice on UK and EU data protection law, including the GDPR. I led privacy governance (policies, training, audits, records of processing), breach management and incident response, DPIAs and DSARs.

  3. 2024 – 2026

    Senior Security Consultant

    Sapphire, UK

    Led complex GRC engagements across compliance, assurance and risk. Product owner for Third-Party Risk Management, with vCISO and vISM support in healthcare, finance and industry. I led tenders across ISO 27001, 27701, 22301, 22237 and 42001, the GDPR, DORA, NIS 2, the NCSC CAF and NIST CSF.

  4. 2023 – 2024

    Security Consultant

    Sapphire, UK

    Subject-matter expert on DORA and NIS 2. I led ISO 27001, 22301 and 27701 engagements from gap analysis to internal audit and certification, plus awareness training and business continuity, across transport, logistics, education, healthcare, manufacturing and finance.

  5. 2022 – 2023

    Postdoctoral Researcher

    Heriot-Watt University, Edinburgh

    SECRIOUS project: how new-code and non-traditional entrants engage with cyber security in software engineering, with human-centred approaches to security education across cyber security, games research and HCI.

  6. 2018 – 2022

    PhD, Cyber Security

    University of Strathclyde

    Thesis: Security of Robotic Workflows. Calibration security and operational privacy in robotic, cyber-physical and safety-critical systems: passive side-channel threats, access control and blockchain-based approaches, using machine learning and signal processing.

  7. 2014 – 2018

    BSc Computer Science, First Class

    Heriot-Watt University

    Software development, networking and cyber security. My final-year project built a tool to identify and remediate IoT devices vulnerable to the Mirai malware in real time. Advanced coursework in network security, AI, machine learning and distributed systems.

Research

Side-channels, IoT safety and traffic analysis, 2019 to 2025.

Publications, newest first
YearPaperVenue
2025WaveVerif: Acoustic Side-Channel based Verification of Robotic WorkflowsZ. Y. Erdogan, S. Nagaraja, C. M. Ahmed, R. ShaharXiv preprint
2023Sensor Identification via Acoustic Physically Unclonable FunctionG. Vaidya, T. V. Prabhakar, N. Gnani, R. Shah, S. NagarajaDigital Threats: Research and Practice
2022Can You Still See Me? Reconstructing Robot Operations Over End-to-End Encrypted ChannelsR. Shah, C. M. Ahmed, S. NagarajaACM WiSec 2022
2022Fingerprinting Robot Movements via Acoustic Side-ChannelR. Shah, M. Ahmed, S. NagarajaarXiv preprint
2022Reconstructing Robot Operations via Radio-Frequency Side-ChannelR. Shah, M. Ahmed, S. NagarajaarXiv preprint
2021VoIPLoc: Passive VoIP Call Provenance via Acoustic Side-ChannelsS. Nagaraja, R. ShahACM WiSec 2021, Abu Dhabi
2020A Unified Access Control Model for Calibration Traceability in Safety-Critical IoTR. Shah, S. NagarajaICISS 2020, Intl. Conference on Information Systems Security
2019Clicktok: Click Fraud Detection using Traffic AnalysisS. Nagaraja, R. ShahACM WiSec 2019
2019Secure Calibration for High-Assurance IoT: Traceability for Safety ResilienceR. Shah, M. McIntee, S. Nagaraja, S. Bhandary, P. Arote, J. KuriarXiv preprint
2019Do We Have the Time for IRM? Service Denial Attacks and SDN-based DefencesR. Shah, S. NagarajaICDCN 2019, Intl. Conference on Distributed Computing and Networking

All publications on Google Scholar

Capability

Regulatory compliance

  • NIS and NIS 2
  • UK and EU GDPR
  • DORA
  • CCPA
  • EU AI Act
  • EU CRA

Data protection

  • DPIA
  • DSAR
  • Breach response
  • Privacy governance

Standards and frameworks

  • SOC 2
  • ISO 27001
  • ISO 27701
  • ISO 22301
  • ISO 22237
  • ISO 42001
  • NCSC CAF
  • NIST CSF
  • NIST SP 800-53

Resilience

  • Business continuity
  • Incident response
  • Disaster recovery
  • BCP testing

Security leadership

  • vCISO and vISM
  • Internal audit
  • Third-party risk management
  • Threat modelling

Technical foundation

  • Python
  • Java
  • React and Node.js
  • ML and analytics
  • CI/CD
  • Secure development lifecycle

Credentials

  • Full Member, MCIISCIISec, 2025
  • Associate Fellow, AFHEAHigher Education Academy, 2023
  • ISO 27001 Lead AuditorIT Governance, 2026
  • Tech Risk and Compliance ProfessionalOneTrust, 2025
  • PIA and DPIA Automation ExpertOneTrust, 2025
  • TPRM ProfessionalOneTrust, 2024
  • Cyber Security Professional CertificateGoogle, 2024
  • PGCert, Researcher Professional DevelopmentUniversity of Strathclyde, 2022

Field notes

Writing on GRC, privacy and research.

    All field notes

    Get in touch

    Working on something where governance, privacy or resilience really matters? Let us talk.

    LinkedInin/ryankshah GitHub@ryankshah Google ScholarPublications