Headline

Cybersecurity Professional | CISSP | Security GRC · Cloud Security (AWS/Azure) · IAM · Product Security | AI-Powered Compliance Automation (RAG, LLMs) | Ex-EY

About

I build the automation behind security compliance, not just the paperwork. At Snowflake, I built a complete agentic audit automation platform on our internal AI infrastructure, with a React front end, covering a wide range of audit modules — from Disaster Recovery to Product Security to Vulnerability Management — each executable end-to-end via a single command. The platform pulls live data across our data warehouse, Glean, Confluence, Jira, and Git via MCP integrations, automatically validating findings against real, current-state data and modeling the potential impact of vulnerabilities before they're remediated. I presented this platform, along with the Common Control Framework methodology behind its control logic, directly to our CFO. That framework — the Common Control Framework (CCF) — maps a large catalog of controls across multiple domains to 8+ compliance frameworks (SOC 2, ISO 27001, NIST CSF, PCI DSS, HIPAA), eliminating duplicate evidence collection wherever a single control already satisfies multiple regulatory requirements. It's the same instinct behind a finding I reinstated after it had been quietly downgraded and left open for 301 days without documented risk-acceptance — I built the technical exploitability case myself and corrected the severity rating. At EY, I built an AI-powered SOC control-testing tool on Azure AI — indexing full SOC reports into a vector database via embeddings, then using retrieval-augmented validation to map report content against our control catalog and determine compliance status per control. I also built a Power Apps-based evidence collection system replacing manual stakeholder chasing with structured, automated intake — across IAM governance and privileged access engagements spanning Azure AD, Okta, SAP, and Workday for 10+ global clients. I received EY's Client Extraordinaire award multiple times. CISSP-certified, with hands-on security exposure across AWS and Azure, and an independent AI Security Risk Framework covering a broad set of risks and controls — including a dedicated catalog for agentic AI and MCP-based systems, mapped against NIST AI RMF and OWASP LLM Top 10. Outside my day job, seven years building and shipping Android apps under my own studio, The Absolute Corporation — real, published products. Same builder's instinct behind everything above: build the thing that solves the problem, rather than solve it once and repeat the work forever.

Location

Pune District

AI stack

codex

cursor

opencode

Work experience

Information Technology Auditor at Snowflake, Jul 2025 - Present · 1 yr 2 mos, Pune, Maharashtra, India, I build the automation that makes compliance continuous rather than periodic — across cloud, identity, and AI-driven security control validation. ▸ Built a complete audit automation platform on Snowflake's internal agentic AI infrastructure, with a React-based interface, covering modules including Disaster Recovery, Infrastructure Security, Product Security, and Vulnerability Management — each executable via a single command. ▸ Architected multi-source data ingestion via MCP integrations — pulling live data from our data warehouse, Glean, Confluence, Jira, and Git — to validate audit findings against real, current-state data. ▸ Platform outputs findings, vulnerabilities, remediation recommendations, and modeled vulnerability-impact simulations. Presented this platform and its CCF methodology directly to Snowflake's CFO. ▸ Built the Common Control Framework (CCF) as control-as-code, mapping a large catalog of controls across multiple domains to 8+ frameworks (SOC 2, ISO 27001, NIST CSF, PCI DSS, HIPAA), eliminating duplicate evidence collection. ▸ Own end-to-end audit lifecycle activities spanning SOX ITGC, SOC 2, and vendor onboarding testing — evidence collection, walkthroughs, and remediation tracking to closure. ▸ Led a vulnerability assessment across OWASP ZAP, Grype, and Tenable; found a DAST scan gap silently disabling active scanning while reporting "success," and traced the same misconfiguration across an entire server fleet to one flawed baseline. ▸ Investigated and escalated a product security finding with a 301-day SLA breach, downgraded without documented risk-acceptance; built the exploitability case myself and reinstated the correct severity. ▸ Designed a Python CVE correlation and risk-prioritization pipeline (CVSS + EPSS, asset context) replacing manual, unprioritized triage. ▸ Built an AI Security Risk Framework covering a broad set of risks and controls, including a dedicated catalog for agentic AI and MCP-based systems.

Founder & Developer at The Absolute Corporation, Nov 2018 - Present · 7 yrs 10 mos, India, ► UI/UX Design Excellence: Designed intuitive user interfaces that enhance user engagement through multisensory experiences, ensuring applications deliver impactful user interactions. ► Comprehensive Mobile Development Lifecycle: Managed and executed the full mobile development lifecycle from concept to deployment, addressing challenges effectively at each stage to ensure project success. ► Library and API Utilization: Integrated third-party libraries, custom-built libraries, and APIs to optimize functionality and deliver innovative features in Android applications, enhancing user experience and app performance. ► Version Control and Collaboration: Maintained a robust online presence on GitHub, regularly updating repositories with project code, documentation, and resources. Actively collaborated with team members using version control systems like Git for efficient project management and code review. ► Performance Optimization: Implemented performance optimization techniques to enhance app speed, responsiveness, and stability, ensuring smooth operation across various Android devices and OS versions. ► Testing and Debugging: Conducted thorough testing and debugging using Android Studio and other tools to identify and resolve issues, ensuring high-quality, bug-free applications. ► Published Apps: Published multiple apps on Google Play, showcasing a diverse range of skills and capabilities. ► Technical Writing and Thought Leadership: Authored technical articles on Medium, sharing insights into Android development techniques, best practices, and personal projects. ► Community Engagement: Engaged with the developer community through forums, conferences, and local meetups. Contributed to open-source projects and provided support to fellow developers, fostering a collaborative and knowledge-sharing environment. GitHub Profile: github.com/vidit135g Medium: medium.com/@vidit135g Google Play: play.google.com/store/apps/dev?id=5641162008785731419

Cybersecurity Consultant at EY, May 2023 - Jul 2025 · 2 yrs 3 mos, India, Delivered cloud security, identity governance, and AI-powered compliance automation across 10+ global enterprise clients. ▸ Built an AI-powered SOC control-testing tool on Azure AI — indexing full SOC reports into a vector database via embeddings, then using retrieval-augmented generation to map report content against our control catalog and validate compliance status per control, replacing manual line-by-line review. ▸ Built a Power Apps-based stakeholder evidence-collection system, automating structured intake of compliance evidence and questionnaire responses in place of manual email- and spreadsheet-based collection. ▸ Led IAM governance and privileged access reviews across Azure AD (Entra ID), Okta, SAP, and Workday for 10+ global engagements, identifying over-privileged accounts, toxic permission combinations, and SoD violations, aligned with SOX and ISO 27001. ▸ Executed SOX ITGC testing across the same client base, evaluating IT general controls across access, change management, and computer operations to support external financial audit reliance. ▸ Conducted cloud security audits using the Cloud Controls Matrix (CCM) across Azure environments, and assessed NIST CSF 2.0, CIS 18, and Zero Trust implementation for enterprise clients. ▸ Executed TPRM assessments using OneTrust, covering GDPR, CCPA, and DPIA privacy frameworks. ▸ Performed web application security assessments and threat modeling, identifying vulnerabilities across authentication, session management, and access control, translating findings into design-stage fixes. ▸ Contributed to early development of the Common Control Framework (CCF), later built out into a comprehensive multi-framework platform at Snowflake. ▸ Published peer-reviewed research (Springer International Journal) on Zero Trust Architecture, Privacy Management, and Supply Chain Risk Management. ▸ Received EY's Client Extraordinaire award multiple times.

DevOps & Cloud Security Engineer Intrern at Mactores, Apr 2022 - Jul 2022 · 4 mos, Mumbai, ▸ Managed CI/CD pipeline automation and cloud-native deployments across AWS and Azure, embedding security controls directly into the deployment workflow rather than reviewing them after the fact. ▸ Implemented least-privilege access principles and CIS benchmark compliance within infrastructure-as-code workflows. ▸ Used Terraform, Docker, and Kubernetes for infrastructure automation and secure containerized deployments — early, direct exposure to the Security Engineering and DevSecOps discipline that now informs how I think about audit and compliance automation.

Education

Master of Business Administration - MBA, Information Technology Business Management, SYMBIOSIS INTERNATIONAL UNIVERSITY

Bachelor of Vocation (Software Development), Computer Science, University of lucknow

Public links

github: https://github.com/vidit135g

medium: https://medium.com/@vidit135g