Skip to content
DSML.KZ
TM

Tomiris Murzagali

@Tomiris

Quantitative Risk Analyst | Data Scientist | Statistician

Information Security Auditor with over 3 years of hands-on experience in SOC operations, vulnerability management, and information security auditing.

About

Experienced in developing audit documentation, preparing organizations for compliance assessments, and collaborating with financial institutions and vendors. Strong knowledge of ISO/IEC 27001, ISO/IEC 15408 (Common Criteria), and DORA frameworks, with practical experience in code review, stress testing, and risk-based analysis. Currently pursuing a Ph.D. in Computer Science at Nazarbayev University with a focus on secure systems and compliance automation.

Career

Experience: 3 years

Experience

Information Security Auditor

JB Works LLP

Sep 2023 — Present

Audits financial systems against security standards, tests vendor systems, and supports pre-audit work that improved vendor audit pass rates by 40%.

• Conducted independent risk assessments, gap analyses, and stress testing for financial organizations, evaluating system resilience and readiness for external inspections in line with ISO/IEC 27001 and DORA. • Assessed methodology, assumptions, data quality, and implementation of vendor systems through source-code analysis and stress testing, identifying logical vulnerabilities and stability risks. • Designed and developed audit documentation frameworks and risk-monitoring policies supporting continuous compliance and certification readiness.

Risk Analyst

Lawrence Technological University

A private university in Southfield, Michigan, offering undergraduate and graduate programs in engineering, technology, business, and design.

Dec 2024 — Feb 2025

Supported university network and endpoint security, managed access and patching, and provided technical support and cybersecurity awareness materials.

• Supported secure operation of university networks, servers, and endpoints, including user access control and patch management. • Provided Tier 1–2 technical support and developed cybersecurity awareness documentation for students and staff.

Education

Ph.D., Computer Science

Nazarbayev University

2025

M.Sc., Computer Science

Lawrence Technological University

2025

B.Sc., Cybersecurity

Astana IT University

2024

Selected projects

Ph.D. Research, Secure Systems and Compliance Automation

Researching compliance-aware architectures for distributed systems, integrating automated risk assessment and anomaly detection to support continuous monitoring under DORA and ISO/IEC 27001.

Master's Thesis, Lightweight and Modular 3D CNN Architectures for Efficient 3D Image Segmentation

Designed, trained, and validated modular 2.5D and 3D deep-learning models for coal char micro-CT image segmentation. Improved inference efficiency by 40% while maintaining segmentation accuracy.

Vendor Security Testing Program

Performed code analysis and stress testing of vendor platforms against Common Criteria (ISO/IEC 15408), identifying logic flaws and denial-of-service vectors to help vendors achieve certification faster.

CyberSafe for Women of Central Asia

Led a regional cybersecurity awareness initiative, designing educational content and metrics to measure behavioral change and awareness among participants.

Skills

Risk-based analysisStress testingSensitivity and stability analysisGap analysisBacktesting principlesModel methodology and performance assessmentDecision treesGradient boostingCNNsModel optimization and validationPython-based model developmentISO/IEC 27001DORAISO/IEC 15408 (Common Criteria)SOC 2NIST CSFGDPRPythonMATLABVS Code