Headline

Cloud Security Specialist at Google | Security Architect | Cloud, Application & Product Security

About

Seasoned, versatile, and results-driven cybersecurity professional with varied experience of over a decade. Core expertise in performing application, cloud, and product security architect roles with extensive consulting experience for large global clients. Specialized in: - Traditional and cloud-based (AWS, Azure, GCP) application and infrastructure security design and implementation - Application security (web, mobile, thick-client) architecture and design - Cloud security architecture - Product security architecture and engineering - Threat modeling - Secure architecture reviews - Secure design reviews - Secure code reviews (SAST) - Vulnerability assessments (DAST) with in-depth knowledge of OWASP Top 10, CWE Top 25, and SANS Top 25 vulnerabilities - Penetration testing (PT) - API security architecture, design, and penetration testing - IoT (Internet of Things) security architecture and design - Software composition analysis (SCA) - SSDLC - DevSecOps (securing CI/CD pipelines) - Cloud-native security (serverless, microservices, containers, Docker, container orchestration, Kubernetes) - Cloud configuration reviews and cloud security posture management - Infrastructure as code (IaC) security - Threat and vulnerability management - Cybersecurity risk assessments, gap analysis, and risk management advisory - Security policies, standards preparation, and implementation - Compliance framework based assessments(ISO 27001, NIST 800-53, PCI DSS, GDPR, HIPAA, CIS benchmarks, NIST CSF, SOC 2) Equipped with strong communication, interpersonal, and people management skills. Adept at building and maintaining strong business relationships, problem resolution, and juggling multiple roles. Proven ability to lead diverse teams and interact effectively with a wide range of stakeholders, define and implement strategic security solutions and process frameworks that enable optimal business outcomes for leading organizations.

Location

Bengaluru

Work experience

Cloud Security Specialist at Google, Aug 2022 - Present · 3 yrs 9 mos, Bengaluru, Karnataka, India, - Providing domain expertise to Google Cloud customers in cloud computing security, compliance, and security best practices - Leading execution of consulting engagements, analyzing requirements and working with other team members to produce prioritized results aligned to client needs and risk profile - Providing guidance on building or transforming cybersecurity programs - Providing advice on managing cybersecurity risks during digital transformation as organizations adopt cloud, DevOps, and new architecture frameworks such as containerization, microservices, and zero trust - Conduct security reviews and maturity assessments across technology and business teams to address cyber risk and provide clear and organized risk findings and recommendations to clients - Working with customers to design and develop cloud security strategies, architectures, programs, and solutions to meet and exceed their security requirements - Acting as a technical security advisor and resolving technical challenges for customers - Creating and delivering security best practices recommendations, tutorials, blog articles, sample code, and technical presentations, adapting to different levels of key business and technical stakeholders

Security Delivery Associate Manager at Accenture, Dec 2021 - Aug 2022 · 9 mos, Bengaluru, Karnataka, India, Information Security Architect (ISA) for Mercedes-Benz Research and Development India As an advisory consultant for the commercial and autonomous vehicles domain, I'm responsible for: - Analysing software system architectures to identify potential security threats and vulnerabilities, and to assess their possible effects in collaboration with POs, architects, and developers across geographic regions - Work closely with technical architects, evaluate business requests, identify possible scenarios for system use/abuse, and propose designs to recommend optimal solutions to meet security and regulatory requirements in the design of new products, services, or enhancements - Threat modeling & threat analysis - Identification of security requirements to promote shift-left security approach (SSDLC) - Implementation of "Secure by Design" practices to proactively build security controls into systems from early stages - Identification of gaps and roadmap creation for improvement of security posture by addressing the control gaps - Identification of cloud security measures Additional responsibilities include: - Managing the cloud security architecture/design review/threat modeling capability at Accenture IASS, consisting of an SME pool of over 80 resources - Contributing to DevSecOps and container security capabilities - Coordinating and conducting regular training sessions for new joiners and resources looking to build cloud security/architecture review/threat modeling skills - Conducting periodic brown bag sessions as an SME on application and cloud security related topics for wide audience groups - Providing inputs for response to client RFPs and solution designs

Security Delivery Specialist/Team Lead at Accenture, Sep 2018 - Nov 2021 · 3 yrs 3 mos, Bengaluru, Karnataka, India, Designed, implemented, and ran the application security program for all assets under Accenture's Assets & Automation product group (including leading Accenture products like myWizard, myNav, myConcerto, myIndustryX, myMDI, etc.), consisting of: - Threat modeling and Application Security Architecture Reviews - Providing security and compliance guidance to delivery teams, assisting them with developing delivery procedures in alignment with global Accenture standards - Conducting Secure by Design (SbyD) assessments across domains (e.g. hosting security, data security and privacy, identity and access management, database security, etc.) - SAST (Static application security testing) - Dynamic application security testing (DAST) and Penetration Testing (PT) of web and mobile apps - API Penetration Testing - Software composition analysis (SCA) - Container security (image scanning, image risk management, drift protection) assessments - Kubernetes security assessments - Infrastructure as Code (IaC) security - Third-party risk assessments - Framework and compliance-based assessments (e.g. ISO 27001, GDPR, NIST 800-53, etc.) Additional responsibilities included: - Defining security requirements/guidelines - Providing technical design/architecture advice to internal teams on how to securely develop build applications/supporting systems - Providing remediation guidance to development teams on identified issues - Regularly contributing with inputs as an application security SME during RFP discussions with potential clients to allay any security concerns, and provide/demonstrate assurance about Accenture products' robust application security posture

Senior Security Analyst at Accenture, Mar 2016 - Aug 2018 · 2 yrs 6 mos, Bengaluru, Karnataka, India, Worked as a senior member in the cybersecurity program for a global pharmaceutical Fortune 500 giant, consisting of: - Project Security Demands: Assessed the required security involvement in all of the client's new projects during the requirements gathering phase. Based on the assessment, decided whether a security review is required in the project or not. Also, provided an estimation of the cost/effort involved in the security review. - Project Security Reviews (Design/Architecture review): During the analysis phase, reviewed application architecture and design (cloud and on-premise) and other security controls to ensure that the project implementation follows the organization's security policies and is secure by design. The process was revamped to follow NIST 800-53 standard during my tenure. Identified the security gaps in the project implementation and provided remediation recommendations for the gaps found. - Security Risk Assessments: During the maintenance phase of the Software Development Life Cycle (SDLC), performed periodic risk assessments for client applications using RSAM (GRC tool). Advised application teams on the business risks posed by applications and guided application owners through the risk management (mitigation, acceptance, transference, avoidance) process. - Application Vulnerability Assessments/Penetration testing: During the testing and maintenance phases of SDLC, performed automated vulnerability scans on applications using HP Web Inspect and manual vulnerability assessment/penetration testing using BurpSuite and a plethora of other open-source tools. Provided remediation support to developers for the identified vulnerabilities. - User Access Reviews: Guided application teams to develop access models and conduct periodic access reviews on their applications. Conducted regular automated access reviews using an internally developed tool on the applications. Led the transition effort to adopt Sailpoint IdentityIQ as the preferred tool.

Education

Bachelor of Technology - BTech, Electronics and Communications Engineering, West Bengal University of Technology, Kolkata

12th (ISC), Science (PCM), St. Xavier's School, Burdwan