Headline

Technical Lead @ UCB | Senior IT Compliance & GRC Professional | SOX ITGC | IT Controls | Risk Management | Audit Readiness | Cybersecurity Compliance

About

With over 15 years of professional experience, my work focuses on risk reporting, third-party risk management, and data privacy. Currently serving as a Technical Lead at UCB, I contribute to enhancing organizational security by conducting third-party risk assessments, vendor impact analyses, and technical security reviews. My role involves implementing ISO 27001 controls, managing remediation efforts, and leveraging tools like Qualys, RSAM, and ProcessUnity to address audit findings effectively. By emphasizing risk governance and compliance, I support informed decision-making to mitigate risks and enhance security frameworks. My expertise extends to client-based auditing, policy assessments, and vendor risk management, aligning with my dedication to fostering secure and compliant business environments. My professional contributions reflect a commitment to teamwork, operational excellence, and secure business practices.

Location

Greater Bengaluru Area

AI stack

claude

gemini

meta

ChatGPT

Chroma

Microsoft Copilot

Work experience

Technical Lead at UCB, Oct 2022 - Present · 4 yrs, Bengaluru, Karnataka, India, - Experience in Risk assessment processes, Third Party Risk assessments, Vendor Risk Management Conduct technical security reviews and assessments of vendors / suppliers, Perform second review on IT Security assessments . - Conducting impact analysis on vendors, Experience in finding root cause analysis, Summarize the IT Security Assessment results, estimate risk, and provide input for decision (approved, not approved, approved under condition) . - Experienced in Client Based auditing on Controls & Policies - Design and implementation of ISO27001 controls and process maps - Conduct third party audits and manage the remediation of third party audit findings and management responses in tools like Qualys, RSAM and ProcessUnity - Experience in executing client related engagements in internal audits. Performing root cause analysis of issues and incidents, identifying and implementing control improvements - Conduct Vulnerability Assessments for Network and Application, Penetration Testing, Hardening, Application Security. - Providing application design support, security best practice guidance and checklists, in the form of consultations, to various development teams and Business stakeholders. - Conducting vendor assessment related to SOC2 and ISO27001 IT audits. - Support internal and external audits & reviews. Identify and submit mitigation evidences for audit issues. Work with action owners to define action plan and track them to closure - Lead and oversee the activities, tasks and workload of L1 and L2 Risk Analysts Assist in calls with vendors to resolve assessment gaps with L2 Risk Analyst - Scaling Vendor Risk and preparing residual risk

Senior Manager ISMS at Newage Software & Solutions, Mar 2022 - Sep 2022 · 7 mos, Bangalore, - Conduct technical security reviews and assessments of vendors / suppliers. - Design and implementation of ISO27001 controls and process maps - Performing root cause analysis of issues and incidents, identifying and implementing control improvements - Conduct Vulnerability Assessments for Network and Application, Penetration Testing, Hardening, Application Security. - Providing application design support, security best practice guidance and checklists, in the form of consultations, to various development teams and Business stakeholders.

Senior Security Engineer at Advanced, Jul 2021 - Mar 2022 · 9 mos, Bangalore Urban, Karnataka, India, - Conduct technical security reviews and assessments of vendors / suppliers. - Participate and facilitate SOX audits. - Performing Gap assessment and the mitigation / closure of identified gaps - Conducted third party risk assessments using ISO 27001 & NIST SP- 800 Standards. - Conducted various internal control assessment & reviews - Conducted Gap assessment on business process in line with ISMS policies - Have been extensively involved in process reviews with respect to identifying risk and testing of controls - Maintaining Security and SOX Compliance as per contractual obligations and presenting the Governance Reports to stakeholders during regular meetings - Relevant experience in Application Security and Penetration Testing - Sound knowledge of Risk management with an ability to talk to process owners, identify potential risks within organizational context, and work with stakeholders in recommending and implementing mitigating controls. - Review Security Policies, Standards, Procedures and Guidelines on periodic basis per business requirement and send Security awareness fliers to all project team members. - Data Center Migration, Supporting & Administrating on VMWare, AWS Cloud & Microsoft Azure Platform. - Prepare the High-Level Design and Low-Level Design document - Work on moderate to complex installation and maintenance tasks with minimal guidance and direction from Lead Administrators or Management - VM Migration and Cut Over Plan Designing & Execution - Creating standard Server Builds, Snapshots and make them ready for production as per Security policy of the organization - Performing Cyber Security audit as per set of given ISO 27k controls. - Ensure Vulnerability & Patch Compliance by follow up with owners on the Remediation Plan. - Leverage intelligence and threat detection techniques in Antivirus Management. - Experience in external / client facing roles

Senior Consultant at Capgemini, Oct 2015 - Jun 2021 · 5 yrs 9 mos, Bengaluru, Karnataka, India, - Conduct technical security reviews and assessments of vendors / suppliers. - Participate and facilitate SOX audits. - Performing Gap assessment and the mitigation / closure of identified gaps - Conducted third party risk assessments using ISO 27001 & NIST SP- 800 Standards. - Conducted various internal control assessment & reviews - Conducted Gap assessment on business process in line with ISMS policies - Have been extensively involved in process reviews with respect to identifying risk and testing of controls - Maintaining Security and SOX Compliance as per contractual obligations and presenting the Governance Reports to stakeholders during regular meetings - Relevant experience in Application Security and Penetration Testing - Sound knowledge of Risk management with an ability to talk to process owners, identify potential risks within organizational context, and work with stakeholders in recommending and implementing mitigating controls. - Review Security Policies, Standards, Procedures and Guidelines on periodic basis per business requirement and send Security awareness fliers to all project team members. - Data Center Migration, Supporting & Administrating on VMWare, AWS Cloud & Microsoft Azure Platform. - Prepare the High-Level Design and Low-Level Design document - Work on moderate to complex installation and maintenance tasks with minimal guidance and direction from Lead Administrators or Management - VM Migration and Cut Over Plan Designing & Execution - Creating standard Server Builds, Snapshots and make them ready for production as per Security policy of the organization - Performing Cyber Security audit as per set of given ISO 27k controls. - Ensure Vulnerability & Patch Compliance by follow up with owners on the Remediation Plan. - Leverage intelligence and threat detection techniques in Antivirus Management. - Experience in external / client facing roles

Education

MBA, Information Systems, Annamalai university

Bachelor of Business Administration, Computer Programming, Specific Applications, Annamalai university

Public links

linkedin.com: https://www.linkedin.com/in/santhosh-kumar-s-san2sk?utm_source=share_via&utm_content=profile&utm_medium=member_android