Risk management professionals providing resilience and confidence in an uncertain world

Lindsey Domingo

Lindsey is a Senior Director at Xcina Consulting as well as the Data Protection Officer of Shearwater Group plc. He has 30 years’ experience, mainly in governance, risk and regulatory advisory roles based in the UK, continental Europe and emerging markets.

Lindsey is a Chartered Accountant, Certified Information Systems Auditor, and holds qualifications in GDPR, Governance, Risk & Compliance, Executive Coaching & Mentoring as well as Project Management.

He has led risk and compliance assurance advisory and change projects across financial and industrial sectors, and managed entire markets, with responsibility for developing teams, growing the practice, and delivering risk advisory, assurance, change management and regulatory projects. Lindsey also leads our Audit & Compliance practice.

Roger Greyling

Roger leads our PCI practice. Roger is a Senior Consultant and PCI DSS Qualified Security Assessor (QSA)in Xcina’s Information Security Consulting Team. He has 18 years of experience in information security auditing and PCI compliance.

In addition to being a PCI QSA, Roger holds a BSc (Hons) Information Security and security credentials including ISACA’s CISA and CISM certifications and ISC2’s CISSP certification.

Roger is adept at leading compliance initiatives and enjoys helping organisations navigate their journey toward complying with the Payment Card Industry Data Security Standard (PCI DSS). As a trusted adviser and relationship builder, he is accustomed to working across all organisational levels and collaborating with teams to engineer practical solutions.

David MacPhail

David leads our Cyber Maturity practice.  During his 15+ years in cyber security practices, David has delivered information security consultancy for many high-profile clients, most notably as a PCI DSS QSA. 

He has assisted a wide variety of organisations in securing their information assets and applications and achieving and maintaining compliance with industry standards.  David has extensive international and UK-based experience delivering security consultancy assignments.

Prior to specialising in security consultancy and the PCI DSS, he was engaged with a Managed Security Services provider and has extensive experience in network architecture, SOC / SIEM, firewall design, implementation, rules reviews, vulnerability (including ASV) scanning and penetration testing delivery.  David is also a CISSP and ISO27001 Lead Auditor.

Andrew McClelland

Andrew has a background spanning commercial, compliance and public policy roles, enabling him to understand business drivers and balancing these with the organisations data protection responsibilities.

Andrew’s commercial background includes product management in the telecoms sector, looking after mobile and broadband launches, customer services provision and the end-user proposition. Additionally, his commercial work includes advising retail, healthcare and hospitality sectors on the use of digital channels for domestic and international market growth.

Public policy activities include representing business interests to the EU, encompassing the full consultation process that led to the launch of General Data Protection Regulations, working with Government departments to help them understand the business implications on a range  of legislation, and trade groups on the development of initiatives such as PCI-DSS, PSD (2), ‘Chip-n-Pin’ and Contactless Payments. Andrew’s work included launching the first retail business forum on payments fraud and cyber security, contributing to the Government paper that led to the first investment into Cyber Security and advising businesses when they had been impacted by DDOS attacks.

Combining this commercial and policy expertise, Andrew has extensive experience in providing external Data Protection consulting services. Ranging from initial gap analysis review work through to remediation activities and virtual Data Protection Office services (vDPO), his experience is utilised  by a variety of organisations across sectors as diverse as Retail, Technology, Healthcare, Hospitality and Real Estate. This experience also includes successful interactions with the ICO following data breach project management, reporting and investigation. Andrew’s advice provides a pragmatic approach to compliance activities delivered with a defensible mindset.

Kathy Zhai

Kathy is an ISO 27001 and ISO 42001 Implementer with experience in implementing Artificial Intelligence Management Systems. She has a strong track record of optimising organisational efficiency and providing seamless support to Xcina clients. Kathy possesses exceptional communication and interpersonal skills, which foster collaborative relationships with internal and external stakeholders. She is also known for effectively and efficiently implementing and managing administrative processes as well as maintaining a high level of confidentiality and discretion in handling sensitive information.