Jan 2023 – Jul 2024 · 1 yr 6 mos · Chennai, Tamil Nadu, India

• Manages compliance in accordance with client, organizational, and regulatory security requirements.
• Executes control assessment evaluations.
• Enables offshore consulting support for Physical, Administrative, and Technical security controls to ensure confidentiality, integrity, and availability of IT infrastructure.
• Drives Enhanced Compliance Assessments in accordance with ISO 27001:2013 requirements at the engagement level.
• Analyzes and highlights risk areas via documented audit reports and flowcharts, providing management with insights on compliance posture.
• Oversees the governance of the ISMS (Information Security Management System).

Sep 2022 – Jan 2023 · 4 mos · Chennai, Tamil Nadu, India

• Performing vendor risk Assessments periodically for Critical vendors who are providing services to HCL
• Worked efficiently on VRM program through the of GRC tool called Process Unity
• Identifing the Critical Risks which are associated with the critial services.
• Ensure all vendor relationships are documented in the VRM system and all contracts related to vendors that provide outsourced services are uploaded in the system
• Provide analysis and recommendations for identified security exceptions; participate in defining remediation efforts
• Act as a subject matter expert to assist the business in identifying and
• mitigating risks on their vendor relationships

Jun 2021 – Sep 2022 · 1 yr 3 mos · Chennai, Tamil Nadu, India

• Vulnerability Assessment:
• Performing VAPT for web applications, Network devices, and Servers based on OWASP and CWE standards.
• Creating and publishing Vulnerability Assessment report detailing exposures that were identified, rating the severity of the system, and suggestions to mitigate any exposures and testing known vulnerabilities.
• In-depth knowledge of Web Application Vulnerabilities and ability to articulate their impact to clients and support them to fix it.
• Followed up for remediation and prioritization of zero-day vulnerabilities
• Performing POC for VAPT automated testing tools and implement them in the organization
• Risk Assessments:
• Conducting Risk assessments for any new technology implementation within our organization group companies on security perspective and publish the report with mitigation control.
• Digital Forensics:
• Performing email forensics for the phishing emails received and performing Root Cause Analysis.
• Performing Malware behavioral analysis in sandbox environments like a cuckoo sandbox.
• Performing Forensic analysis by taking memory and hard disk dump of the infected/suspicious behaving systems and providing reports and suggestions to the respective team.