Headline

CISSP | CISM | ISO 27001 LA/LI | CTPRA | SOC1 | SOC2 | PCI DSS

About

Cybersecurity and Third-Party Risk Management (TPRM) professional with 9+ years of experience in Governance, Risk, and Compliance (GRC) and vendor cyber risk management. Experienced in conducting third-party security assessments, evaluating vendor security postures, and managing risks across the vendor lifecycle. Skilled in reviewing SOC 1/SOC 2 reports, ISO 27001 certifications, PCI DSS compliance, SIG questionnaires, penetration testing reports, and external security ratings. Proficient in applying the NIST Cybersecurity Framework (CSF) and industry best practices to assess and mitigate third-party risks while supporting regulatory and business requirements. Passionate about strengthening organizational resilience through effective risk management, stakeholder collaboration, and continuous improvement of third-party security programs.

Location

Bengaluru

AI stack

anthropic apis

antigravity

claude

elevenlabs

geminicli

glama

Work experience

Lead - Risk and Compliance (Cyber Security) at 3M, Nov 2022 - Present · 3 yrs 11 mos, Bengaluru, Karnataka, India, As a lead, Risk & Compliance job ensures that the organization conducts its business processes in compliance with laws and regulations, professional standards, international standards, and accepted business practices. I do perform audits at regular intervals and execute design control systems, advising the management on possible risks that might occur, and organization policies. Conducting the Third-Party Risk Assessments for more than 1000 Vendors associated with 3M. ▪ Identifying and analyzing potential risks within IT systems and processes. ▪ Follow policies and procedures that support the successful implementation of TPRM operating tools, review policies and procedures. ▪ Manage Vendor Assessments through Vendor Risk Management tools like Archer, GRCM. ▪ Evaluate Cyber Security domains due diligence RiskRecon by MasterCard, BitSight, Scorecard. ▪ Validate and review Pentest report, External Security Certifications. ▪ Managing the team and assigning assessments to team and review escalated cases in team meeting. Working on SIG Questionnaire findings with remediation plans to Vendor. ▪ Conduct IT Audits to ensure compliance SOX ITGC and integrity of financial reports. ▪ Review and simulate continuity plans to ensure the ITCP as necessary. ▪ Create and maintain Information Security policies to align with industry best practices. ▪ Develop and implement IT continuity disaster recovery plans, including backup solutions and recovery procedures. ▪ Prepare detailed report on audit findings, risk assessments, and security incidents for senior management and stakeholders. ▪ Conducting gap assessments for IT Infrastructure and remediate the audit findings. ▪ Primary responsible in assessing risk, evaluating the design and effectiveness of controls, and identifying any deficiencies. ▪ Ensure that 3M is meeting its SOX compliance obligations, including reporting and disclosures. ▪ Conducting Internal audits for the controls of ISO 27001/ SOC1/ SOC2/ PCI/ SOX ITGC.

Senior Associate at Atos, Dec 2021 - Nov 2022 · 1 yr, Bengaluru, Karnataka, India, Roles and Responsibilities: ▪ Worked as the Lead Auditor in conducting the ISO Internal Audits. ▪ Part of SOC2 readiness, implementation, and maintaining COSO principles. ▪ Worked on PCI Implementation as SPOC. ▪ Worked on 6clicks GRC tool. ▪ Coordinating with the account team and SA teams to fix the non-conformity which are identified in the Compliance check reports. ▪ Compiling and tracking vulnerabilities and mitigation results to quantify program effectiveness. ▪ Creating and maintaining vulnerability management policies, procedures, and training. ▪ Conducting internal audit reviews, initiating vulnerability scans, and ensuring the compliance of process, procedures, and controls. ▪ Auditing the patches (APARs) released by the vendor based on the platforms like Unix and Windows to ensure all the critical patches are deployed in the systems. ▪ Conducting risk assessments to identify, manage, mitigate and report the risk. ▪ Act as a delivery focal for external audits and conducting cross internal audits. ▪ Conducting SSAE’16 audit semi-annually on all in-scope servers to ensure compliance. ▪ Managing 5000+ servers to make it secure by implementing and validating CSD security standards set by the customer. ▪ Providing compliance report to server build team after assessing the initial configuration settings set in the server and ensuring the security requirements are up to date to move the servers into production. ▪ Reviewing the customer exceptions periodically, checking the validity of exceptions and getting the exception extended if needed.

Senior Engineer at ISSQUARED, Inc., Dec 2016 - Nov 2021 · 5 yrs, Hyderabad, Telangana, India, Provided support to multiple clients. ▪ ISO 27001:2013 Implementation. ▪ Prepared Policies and Procedures as per the Compliance requirements. ▪ Handling NA region ISMS activities. ▪ Conducting Internal ISO audits. ▪ Mapping different standards with ISO standards and controls (CMMC) ▪ Prepare teams (Preparatory audit) for external audits falling under the scope of the audit. ▪ Handling Back-end database monitoring audit on SOX and PCI databases. ▪ Reporting Bi-weekly audit data to the client. ▪ Presenting weekly service review report to the Security team and Client. ▪ Preparing Standard operating procedures for BEDM and PCI activities. ▪ Performing Imperva tool Policy review. ▪ Training DBAs with the procedures to follow while creating tickets in SNOW for any activities. Worked with stakeholders and team members to achieve business and departmental goals and objectives. ▪ Operate as a key contributor to Information Security Management. ▪ Review, draft and negotiate business proposals and relationships for potential conflicts of interest. ▪ Conducting risk assessments to identify, manage, mitigate, and report the risk. ▪ Coordinating with the account team and SA teams to fix the non-conformity which are identified in the Compliance check reports. ▪ Conducting Internal ISO audits. ▪ Responsible for Nessus vulnerability management and the remediation. Mapping different standards with ISO standards and controls (CMMC) ▪ Prepare teams (Preparatory audit) for external audits falling under the scope of the audit.

Education

Bachelor's degree, Computer Science, Seshachala Institute of Technology,Tirupati