Anshul Srivastava

• Cybersecurity/Technology Risk Assessment/IT Audit/Third Party Risk Management/Data Privacy - Governing and driving InfoSec processes, Secure SDLC (CI/CD – SAST/Secrets/SCA) and Cloud Security Operations. Providing regular updates to the Leadership (CTO/CFO) via Risk Dashboard - Preparing annual operating plan in partnership with the Business Finance teams & forecasting based on gaps and plans for mitigating risks - Assisted businesses by performing technology risk assessments aiming at due diligence on various group level projects. Assessing Go/No Go decisions for technology projects based on the quality and effectiveness of cybersecurity controls - Defined Information Security policies and procedures and reviewed them on a periodic basis. Identified InfoSec risks and collaborated with with Engineering/Business stakeholders to mitigate those risks - Established the cloud security management program and concentrated efforts on continuous improvement of the cloud security configurations aligned to global standards like NIST CSF, ISO 27001, and CIS - Managing Cloud Security Incidents/Risks via PRISMA cloud solution. Collaborating with Engineering teams to mitigate the cybersecurity incidents and assisting in conducting RCAs whenever required - Instrumental in integrating shift-left strategy in the DevOps pipeline through the CI/CD lifecycle and introducing cultural transformation for the DevOps community as part of DevSecOps - Established and implemented IT General Controls and Application Controls for financially significant applications and infrastructure for meeting the IFC IT Audit requirements conducted annually by a BIG 4 auditing firm. - Implemented IT controls as part Data Privacy framework by working with the Legal/Procurement/ Third Parties ensuring compliance with Data Privacy regulations (GDPR/CCPA) - Establishing third party risk management process to identify and manage risks associated with third parties

• Technology Risk Assessment & Third Party Risk Assessment - Worked closely with the IT Security team to identify InfoSec risks associated with engineering applications. Maintained the risk register and collaborated with the stakeholders (Business/IT/Legal) to mitigate those risks - Established a Third-Party Risk Assessment program for effectively managing InfoSec risks associated with vendors providing critical services to the organization. Focused on vendor onboarding process and assisted in a go/no go decision in conjunction with Procurement/Legal/Business teams. Established vendor risk re-assessment process and certified them on an ongoing basis. Presented the risk dashboard to the CISO on a bi-weekly basis

• Third Party Risk Assessment (Oil & Energy Sector) - Lead Lightly Managed Applications (LMA) project for analysing InfoSec risks associated with business owned applications. Performed Legal & Regulatory Assessments and Business Impact Assessments, carried out an in-depth analysis of associated risks, and implemented technology controls ensuring design and operational effectiveness. Discussed the risks with the Project Managers, Supplier Assurance & Procurement teams and created an action plan towards implementing security controls and mitigating underlying risks

• Local Information Security Officer/Information Security Risk Management (Onsite/Offshore) - Analysed the security posture of R&D organizations based on the requirements defined in the Corporate InfoSec policy. Worked with InfoSec Officers globally and provided cybersecurity consulting support. Presented the risk dashboard to R&D Global ISO on a regular basis • Information Security Assessments (Onsite/Offshore) - Conducted InfoSec assessments based on ISO/IEC 27001:2013 standard at client locations, for e.g. RD Japan, Mercedes-Benz Japan, RD Mexico and Daimler Greater China • Corporate Audit Remediation (Onsite/Offshore) - Provided onsite/offshore support to Daimler entities for mitigating risks reported by Corporate Audit. The role involved working with internal stakeholders (CIO/LISO), proposing and coordinating controls implementation and submitting the report to the corporate audit team for review and approval • Information Security Risk Management of Daimler Renault Nissan JV - Drove the Information Security Steering Committee of DRN (from Daimler’s perspective) to establish appropriate security standards and provide an effective governance structure to ensure cyber compliance and accountability

• SOX 404 Testing (Consumer-Goods Sector) - Responsible for making IBMs client compliant based on the IT controls required for SOX audit. Any findings or observations registered were discussed with the stakeholders before being presented to senior management of the client for review - Worked on Data Security and Privacy project for IBMs clients which aimed at meeting the security specifications as required by the Data Security and Privacy framework. Risk assessments were carried out for meeting compliance and regulatory requirements. Final output of the process was a security assessment report which underwent a review by the independent Security Risk Assessor and rated. If the rating is not satisfactory, then the whole process was repeated for achieving the desired security level

• SOC 1/SOC 2/SOX 404 Audit/Third Party Risk Assessments (Financial Sector) - Conducted third party risk assessments to ensure the vendors are catering to the Information Security requirements of financial services clients and adhering to their policies, procedures, legal and regulatory aspects for managing the risks. - Executed multiple SOX 404/SOC 1/SOC 2 engagements for BFSI organisations. Carried out technical testing of the critical infrastructure along with IT General and Application controls testing - Worked on a consulting project for a financial client, aimed to strengthen their identity and access management controls and mitigate the audit findings registered by the Monetary Authority of Singapore (MAS) - Assisted UK regulatory authority who wanted to outsource their Web Application development, Infrastructure and BPO services to third parties based in India in making a go/no go decision from an Information Security perspective

• Infrastructure Security Scanning (Financial/Pharmaceutical Sector) - Worked as an IT Security Analyst to validate that operating systems/applications are appropriately configured to meet the baseline security requirements, thus ensuring adequate and robust controls are in place. The intent of the project was to ensure all devices were set up into the production according to the IT Security guidelines. Deviations were addressed until mitigation based on its criticality - Conducted internal compliance and controls review for the delivery and support processes which IBM had defined for its clients. Carried out Information Security risk assessments and defined controls which were monitored periodically for compliance - Supported external audits (SOC 1/SOC 2) for process documentations like the Global Risk Review, Statement of Work, Configuration Task Matrix and Operational Accountability Model as they remained to be the main focus areas for the auditors - Performed readiness review and periodic compliance testing for IS027001 standards certification - Automated and maintained critical services required for the functioning of User Revalidation Tool as part of Identity and Access Management project. This was done to ensure that IBMs customers were able to maintain compliance with user revalidation process