CISA · Cybersecurity GRC · Regulatory Audit · Risk & Compliance
Cybersecurity GRC
& Technology Risk
Cybersecurity governance, regulatory compliance, IT audit and risk advisory — with hands-on security operations experience behind the controls.
01 Consulting Focus
Cybersecurity is not only a technology problem. Organisations also need governance that holds, controls that actually operate, regulatory alignment that survives scrutiny, and evidence that stands up in an audit.
My work sits where those requirements meet reality — assessing how controls are designed and operated, where the gaps sit, what the risk actually is, and what has to be fixed first.
02 Advisory Areas
Advisory areas drawn directly from regulatory audit, IT control assessment and security operations experience.
01
Make sense of what a cybersecurity requirement actually demands — then establish the governance structure, policies and controls that satisfy it. Identify gaps between stated policy and operating practice, define control ownership, and give leadership reporting that reflects the real control position.
02
Compliance assessments and control reviews against the frameworks that matter in regulated environments, with practical support on evidence readiness, documentation quality and remediation planning ahead of an inspection or audit.
03
Review technology and IT general controls for design and operating effectiveness, surface control weaknesses, and prepare documentation that is audit-ready — sample coverage, testing periods and control ownership included.
04
Assess technology and cybersecurity risk across the environment, identify the genuinely high-risk areas, and support risk-based remediation rather than an undifferentiated list of findings.
05
Evaluate the cybersecurity posture of third parties and vendors — reviewing audit reports for scope, methodology and finding quality, assessing control coverage, and identifying the security risk carried into your environment.
06
Review incident governance end to end — response process, root cause analysis discipline and reporting quality — alongside BCP/DR plans and whether recovery objectives hold against resilience requirements.
07
Practical SOC experience applied to oversight questions: whether detection coverage is real, whether alerts are triaged properly, whether vulnerability management closes anything, and whether operational evidence supports the control claim.
03 Differentiation
Most cybersecurity advice comes from one side of the line — either the framework or the console. The useful work happens where both are understood.
Working experience inside cybersecurity regulatory compliance and with regulated entities — including how a regulator reads an audit report and what a compliance gap looks like from the other side of the table.
Hands-on with inspections, control assessments and third-party audit reports: scope, methodology, sample sizes, testing periods, control ownership and whether a finding is actually evidenced.
A SOC background in SIEM, EDR/XDR, DLP, vulnerability assessment and incident response — the technical depth that lets a control conversation go past the policy document.
Identifying control gaps, documenting risk clearly, performing root cause analysis and supporting remediation in the order that reduces the most exposure first.
04 Professional Experience
Two very different vantage points on the same problem — regulatory oversight of cybersecurity, and the security operations floor where controls either work or don’t.
Nov 2024 — Present
Cyber Security Analyst (YP) Mumbai
Regulatory cybersecurity oversight of SEBI-regulated entities, including Market Infrastructure Institutions.
Driving compliance audits across SEBI-regulated entities and assessing adherence to the Cyber Security and Cyber Resilience Framework (CSCRF), reporting compliance gaps to leadership.
Leading cybersecurity inspections and control assessments to identify governance and technical gaps, and coordinating remediation timelines with regulated entities.
Reviewing and validating third-party cybersecurity audit reports, and evaluating audit firms and security vendors on scope, methodology and finding quality.
Managing end-to-end incident lifecycle governance, including RCA documentation and risk-based reporting for regulatory and executive audiences.
Applying ITGC testing methodology — control design and operating effectiveness — when reviewing third-party audit evidence against CSCRF audit quality standards.
Reviewing Business Continuity and Disaster Recovery plans, verifying resilience controls against regulatory recovery time and recovery point objectives.
Jun 2023 — Nov 2024
Associate Gurugram
Security operations, endpoint governance and vulnerability assessment in an enterprise SOC environment.
Monitoring enterprise systems and network logs with Splunk and ELK Stack, detecting and analysing security incidents across the environment.
Investigating alerts and suspicious activity through EDR and XDR platforms, supporting triage, containment and remediation.
DLP monitoring and policy enforcement to prevent data exfiltration and maintain compliance with organisational security standards.
Implementing and administering Mobile Device Management with Microsoft Intune and ManageEngine — compliance policy, remote wipe and encryption standards across the endpoint estate.
Performing vulnerability assessments with OpenVAS and web application testing with OWASP ZAP, reporting identified security risk.
Supporting incident response and root cause analysis, preparing incident summaries and helping develop response playbooks to standardise procedure.
05 Areas of Expertise
Four connected domains — governance, risk, regulation and security operations — applied together rather than in isolation.
06 Applied Knowledge
Areas of professional working knowledge and applied experience, developed through regulatory audit and control assessment work.
Cyber Security and Cyber Resilience Framework — compliance audits, control assessment and audit-report review across SEBI-regulated entities.
Working knowledge of the RBI cybersecurity expectations for regulated financial entities, applied for cross-framework alignment.
Functional structuring of cybersecurity capability — used as a reference model when mapping controls across frameworks.
Information security management system structure, control domains and documentation expectations.
Payment data security control requirements and their overlap with wider regulatory control obligations.
India’s Digital Personal Data Protection Act — data protection obligations and their intersection with security controls.
These represent professional working knowledge and applied experience. Framework-specific certification is listed separately under Credentials.
07 Technical Depth
Control assessment is more credible when the assessor has operated the tooling that produces the evidence.
08 Credentials
ISACA
The audit credential that underpins the control assessment, evidence review and IT audit work.
Cybersecurity Analyst
EC-Council
Security Fundamentals
Azure Security Engineer
09 About
I am a CISA-certified cybersecurity GRC professional working at the intersection of regulatory cybersecurity, IT audit, risk and compliance.
My current work is regulatory: driving compliance audits and cybersecurity inspections across regulated entities, assessing controls against framework requirements, reviewing third-party audit reports and governing the incident lifecycle from RCA through to risk-based reporting. Before that, my time was spent in security operations — SIEM monitoring, endpoint detection and response, DLP, vulnerability assessment and incident handling.
That combination is deliberate. Governance without technical grounding produces documents nobody can operate; technical work without governance produces fixes nobody can evidence. I work on the connection between the two — regulatory requirement, control design, operating reality, and the risk that remains.
10 Approach
The working method applied to a cybersecurity, audit or compliance requirement — a professional framework rather than a fixed engagement model.
01
Understand the organisation’s regulatory obligations, technology environment and risk posture before assuming what the problem is.
02
Identify control gaps, risks and the areas that genuinely require attention — assessed on design and on how the control actually operates.
03
Translate findings into risk-based remediation priorities, so effort goes where exposure and regulatory consequence are highest.
04
Support practical control improvement, documentation and audit readiness — the state where the control works and can be evidenced.
11 Contact
For discussions around cybersecurity governance, regulatory readiness, IT audit, technology risk and compliance, get in touch.
Email Ravinder