##### Lead GRC specialist # Cindy Ruan * [](#) * [](https://www.linkedin.com/in/cindy-ruan-a99385130/) * [](#) * [](#) * [](#) * [](#) Cindy Ruan is the lead Governance Risk and Compliance (GRC) specialist at UpGuard, where she guides the enterprise risk function and oversees GRC development. Her background includes specialized roles in cybersecurity consulting and technology risk, equipping her with a deep understanding of IT audits and risks associated with complex security environments. ### Expertise Cindy’s expertise is concentrated in Governance, Risk, and Compliance (GRC), alongside developing and leading enterprise risk functions. She has practical experience in conducting cyber maturity assessments, IT audit and assurance, and ICT system certifications, specifically against the ISM. Her core competencies also include Management Consulting and Data Analysis, which she has applied in both technology risk and cyber-focused consulting roles. ### Experience Cindy currently leads the GRC function at UpGuard, where she manages the enterprise risk function and is responsible for the development and strategy of activities, including but not limited to: * Third-party risk management; * Internal audit and compliance; * Security awareness training; * External audit coordination and management; * Customer assurance; and * Policy and process improvements.  Cindy has shared her insights into GRC best practices at the prestigious [Australian Cyber Conference](https://melbourne2024.cyberconference.com.au/speakers/cindy-ruan-fm8ih). Prior to UpGuard, she worked at a cybersecurity consulting firm, focusing on Governance, Risk, and Compliance. Her foundation in the field was established at a large professional services and consulting firm, where she held roles in Management Consulting within the Technology Risk and Cyber practices.  ### Education Cindy holds two bachelor's degrees from the University of Adelaide:  * Bachelor of Computer Science * Bachelor of Laws (LLB).  ### Favorite cyber quote: *"You can't just be compliant; you must be defensibly compliant." * ## Latest from Cindy Ruan Learn more about the latest issues in cybersecurity. No other blog posts found. ## Cybersecurity & Risk Management Blog Learn more about the latest issues in cybersecurity. #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 11, 2026 #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 11, 2026 [All blog posts](/blog) ## Cybersecurity & Risk Management Library The ultimate guide to attack surface and third-party risk management – actionable advice for security teams, managers, and executives. ### [Breaches](/breaches) Security research and global news about data breaches. Explore resources ### [Third-party risk management](/category/third-party-risk-management) Articles, news, and research on third-party risk management. Explore resources ### [Attack Surface Management](/category/attack-surface-management) Articles, news, and research on attack surface management. Explore resources ### [Cybersecurity](/category/cybersecurity) Articles, news, and research on cybersecurity. Explore resources Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)