Ashish Shrivastava

As a Product Cybersecurity Leader and trusted advisor to executive leadership, I provide strategic direction and hands-on leadership for the design, execution, and continuous evolution of Honeywell’s global product cybersecurity program. I drive security outcomes across industrial products, OT environments, and digital services, ensuring security enables innovation, customer trust, and regulatory readiness. I lead the end-to-end implementation of Product Security and Secure SDLC, embedding security and privacy by design across the product lifecycle—from architecture and development through deployment and operations. My role bridges engineering, product, legal, and executive stakeholders, enabling informed, risk-based business decisions aligned with corporate strategy. I have successfully driven adoption and certification against critical industrial and regulatory frameworks, including ISA/IEC 62443 for IACS, Secure Software Development Framework (SSDF), and EU Radio Equipment Directive (RED) 2014/53/EU. I currently spearhead enterprise initiatives to align products with the EU Cyber Resilience Act (CRA) and lead the establishment of an Open Source Program Office (OSPO) to strengthen software supply chain security and open-source governance. Key responsibilities and impact include: - Provide strategic leadership for Honeywell’s global product cybersecurity strategy, balancing security, compliance, and business objectives. - Act as a trusted advisor to the CTO and senior leadership, translating cyber risk into executive-level decision support. - Govern and enforce product security practices across architecture, engineering, and operations. - Lead OT and industrial cybersecurity initiatives, strengthening resilience of IACS-aligned products. - Define and track security metrics and KPIs to measure program effectiveness and drive continuous improvement. - Influence and mentor senior leaders and engineering teams, fostering a security-first culture.

Working as a Product security leader cyber security, here Leading the global Product Security team, responsible for secure development. I am responsible for performing Security and Privacy Assessments for Healthcare & Hospital products. Below are the responsibilities handled during the assessments, • Responsible for designing, building, testing and implementing security systems to ensure security/ safety of Baxter medical devices and the ecosystem they operate in. As a Security Architect also responsible to respond promptly and effectively to possible breaches of security. It also Include a strategic understanding of the business, customer/ patient needs. • Proactively drive the security requirements phase along with the product owner(s). Implement Proof of Concept projects to define innovative security solutions. Proactively derive the implementation of medical device cybersecurity functionalities that are part of the overall security architecture. Support medical device cybersecurity certification programs. • Assess security findings from various system validation activities. This includes Static code analysis and penetration test. Identify known/unknown vulnerabilities associated with Baxter’s medical devices, and provide inputs/technical expertise to multiple devices, and provide inputs/technical expertise to multiple teams to eliminate/mitigate identified cybersecurity risks. • Perform impact assessment, threat modeling, technical and operational feasibility on the appropriate technology, detect critical cyber security deficiencies, and recommend solutions for improvement. • Assist with the research, evaluation and design of new technologies, architectures, and security products that will support business security requirements for the enterprise and its third-party service providers.

As Product Cyber Security Leader, I provide strategic leadership in the design and execution of the company product cybersecurity program. Responsible for performing Security and Privacy Assessments for the Strategic Innovation Group projects in Philips, which is responsible for providing the healthcare solutions for the Emerging Markets. My responsibilities include, • Provide strategic leadership in the design and execution of the company product cybersecurity program. • Review of health suite platform, which includes all the platform micro services from security and privacy perspective, identify the risks, and suggest mitigations to the team. • Hands on experience in performing information security reviews of application designs architecture & application development. Experience working on secure development practices. • Responsible for planning, design, implementation, attack mitigation and ongoing support of security systems of high complexity to fulfill the business needs. • Collaborate with CTO, Engineering leader, Architects, and developers to understand Organization external and internal security and privacy compliance requirements. • Balance cybersecurity requirements with business needs while providing technical expertise to the CTO enabling informed business risk decisions. • Knowledge of industry security frameworks and regulatory standards such as FIPS140-2, ISO-27001, NIST Framework for Improving Critical Infrastructure Cybersecurity HIPAA, data protection and Cloud Security best practices and guidelines. • Ensure effective DevSecOps integration into Agile CD/CD release trains. • Govern and enforce effective implementation of product security practice throughout the entire lifecycle. • Train and mentor product design and development teams on cybersecurity awareness, secure by design, privacy by design, Threat modeling and secure coding practices. • Ensure that product portfolio meets current and emerging cyber regulatory and privacy requirements

My responsibilities included as Security leader ● Own and drive the development of secure coding program including standards and best practices. ● Promote best practice throughout engineering team at all stages of SDLC by performing code reviews, giving training and mentoring. Secure coding guideline and Developer Education & Security Evangelist ● Requirements Gathering, Resource Planning, Scheduling, Process Improvement, Collaborative Leader, Knowledge of Design and Development various activity of Mobile Security Platform. ● Act as Security Applications Architect, providing consulting solutions and support to application development teams. ● Actively manage the security activities associated with Secure Software Development to address existing and evolving risks and threats appropriately. ● Application privilege design and implementation review ● Smack based Access control and sand-boxing for native and web apps ● Secure application life cycle (Permissions, Signing, SDK, and so on) ● Responsible for Security Modules Development it includes (PKI, PKCS, X.509, Crypto, OCSP, Signing Tool, Access Control, SSL, OpenSSL), Platform Security Vulnerability Analysis. ● Creating project plans and schedules, managing resource allocation, people management. Resource allocation management.

I have worked on Samsung Mobile Development. My area of work includes Mobile Security. I have been working on different Security areas in mobile, it includes PKI, PKCS, Cryptography, SSL etc. I have been involved in implementation of different Security algorithms and standards. Projects worked Involved : PKI, PKCS, Authentication Module, Crypto Algorithm, Access Control, C,C++, IPC. ● Responsibilities include design and development of security module like Security Reports, SPD, certificate Management for mobile. ● Leading a team which caters requirements for mobile security issue. ● Ownership of security module commercialization. ● Non-technical responsibility includes customer interaction, Requirement analysis, release plan, team management, schedule plan. ● Technical responsibility includes design and development of key features.

* security research in detecting and mitigating security vulnerabilities, customer communications on product security-related issues. * Knowledge of secure protocols/standards (such as SSL/TLS, PKI, PKCS) * Knowledge of the internals of mobile or embedded operating systems * Experience of applying software static or dynamic analysis tools (such as Klocwork, Coverity, LLVM sanitizers and popular fuzzing tools) * Mobile platform security such as Android * Secure code review, analysis and vulnerability assessment * Product security incident response in mobile, embedded device or automotive industry

Promote best practice throughout engineering team at all stages of Secure SDLC by performing secure code reviews, giving training and mentoring on Cyber security, Security best practices & guideline creator, Developer Education & Security Evangelist. • Worked as a security module developer and is responsible for Development of security related feature. Developed and deliver Information Security Awareness training program for senior management and other employees. • Responsible for the open source contribution in Evolution mail client for GNOME. As a co-maintainer of Contact Management (Address Book), I was responsible for design and development of feature.

I have worked as a security module developer i.e. Certificate management feature, PKI etc. Actively manage the security activities associated with Secure Software Development to address existing and evolving risks and threats appropriately. As a module lead I was responsible for the design and development of interface for Screen and web access, software upgrade, video enhancement over call control/Call processing. Played important role in system design. Involved in Requirement analysis, Preparing requirement and functional specification document, time estimation, Contributed in Unit, Integration and System testing and various types of stress and acceptance testing. Languages Used: C programming, SIP-VoIP protocol, Linux Internals, Multithreading, Socket Programming, IPC Mechanism. Platform Used: Embedded Linux

BE