Headline

Security & Compliance Specialist | ISO 27001 Lead Auditor | MTA | EJPT | CEHv11(Master) | NIST | TISAX | PCI DSS | Bug Hunter | Cloud Enthusiast | IT Security Audit| FedRAMP 20x | Ex-Circles, Xperi, PTC

About

Security & Compliance Engineer with ~4 years of experience bridging technical security engineering with global regulatory compliance. I specialize in helping mid-to-enterprise organizations navigate complex regulatory environments (FedRAMP, ISO 27001:2022, GDPR, PCI-DSS, TISAX) without slowing down engineering velocity. My background spans both sides of the security spectrum—from executing threat models and penetration testing to building enterprise ISMS frameworks and automating cloud security controls. Core Competencies: Governance, Risk & Compliance (GRC): ISO 27001:2022 (Lead Auditor), FedRAMP Moderate Baseline Gap Analysis, GDPR/DPDP Privacy Architecture, SOC 2, TISAX, PCI-DSS. Cloud & Technical Security: AWS Security Specialty, Microsoft SC-200 (Sentinel/SecOps), Vulnerability Management (Qualys), Secure SDLC, and Application Security. Community & Thought Leadership: Awarded Cybersecurity Rising Star of the Year 2024 at BSides Bangalore; Active Speaker at Null Bangalore (Global Privacy Landscape & AI Security). 📩 Open to opportunities in Security Engineering, GRC, Cloud Security, and Privacy Architecture.

Location

Bengaluru

AI stack

codex

gemini

ChatGPT

Work experience

Compliance Specialist at IDrive Inc., Nov 2025 - Present · 1 yr, Bengaluru, Karnataka, India, • GDPR Compliance: Executed GDPR audit gap analysis, ROPA document reviews, and developed Data Flow Diagrams (DFDs). • ISO 27001 Certification: Managed end-to-end evidence collection and documentation for certification readiness. • FedRAMP Readiness: Conducted feasibility research, mapped Moderate Baseline controls (CM, CP, IA, IR), and developed Gap Assessment Matrices. • Secure SDLC & Design: Designed baseline standards for secure development lifecycles and strategic security improvements. • Vulnerability Management: Issued critical security advisories (e.g., React/Next.js RCE) and performed posture management research. • Policy & Audit Review: Evaluated SOC 2 drafts, BCP/ISMS policies, and conducted competitive compliance analysis.

Security Engineer II, Cybersecurity Governance at CIRCLES, Apr 2025 - Oct 2025 · 7 mos, Bengaluru, Karnataka, India, Executed and managed phishing simulations and security awareness campaigns using KnowBe4 to train employees against social engineering tactics. Improved phishing awareness click rate by 40% using KnowBe4 campaigns. Identified security gaps within corporate infrastructure and applications through technical control assessments, recommending remediation strategies. Analyzed vulnerability data to help prioritize patching and hardening efforts across the organization. Third Party Due Diligence

Associate Security Engineer | Privacy & Compliance - DPO extension for EU at Xperi Inc., Jul 2023 - Feb 2025 · 1 yr 8 mos, Security Assessment | Salesforce | NIST Assessments | TISAX Audits | Pentest Operations / Pentesting | PCI-DSS | DPA - GDPR , PIPL , TPDPB | Privacy & Compliance - Conducted security assessments, PIA, and DPIA for various projects across the company, providing control implementation recommendations to mitigate risks. - Contributed to ensuring TISAX certification for multiple offices by performing site walkthroughs and coordinating audit preparations with business owners (covering physical security, prototype security, and data protection). - Served as the Point of Contact (POC) for the PCI external audit, managing evidence tracking with the PCI team and coordinating with external auditors for the annual compliance audit. - Promoted the Security & Privacy Framework throughout the company via awareness training. - Assisted in coordinating the annual policy review program. - Assisted in coordinating the annual awareness training review program. - Supported the Data Protection Officer (DPO) in their responsibilities within the security department. - Assisted in coordinating the remediation plan following external NIST audits and penetration testing. - ISO27K : Setting up the ISO 27001 audit process

Intern - Privacy and Compliance at Xperi Inc., Jan 2023 - Jul 2023 · 7 mos, SPA Reviews | NIST | Salesforce Dev | Privacy and Compliance

IT Internal Audit at PTC, Oct 2022 - Jan 2023 · 4 mos, Pune District, Maharashtra, India, ITGC , SOX , Secure SDLC, Cyber Incident Response - Implemented and maintained IT General Controls (ITGC) to ensure the integrity, confidentiality, and availability of systems and data. - Managed SOX compliance efforts, including evidence collection, control testing, and coordination with internal and external auditors. - Integrated Secure Software Development Life Cycle (SDLC) practices into development processes, ensuring security considerations are addressed at each phase. - Developed and executed Cyber Incident Response plans, including detection, response, and recovery procedures to mitigate the impact of security incidents.

Education

Bachelor of Technology - BTech, Computer Science, MIT ADT University