Hassam Malik

Led enterprise-wide cybersecurity awareness programs, designing and delivering targeted campaigns, phishing simulations, and training initiatives that improved employee resilience to social engineering attacks. Developed and executed a comprehensive Cybersecurity Awareness Month (October) program, including campaign themes, executive communications, training events, and engaging multimedia content under aggressive timelines. Created budget estimates, resource plans, and cost justifications for security awareness initiatives, ensuring alignment with organizational goals and leadership expectations. Measured and reported program effectiveness using KPIs, phishing metrics, and employee feedback, providing actionable insights and regular updates to senior stakeholders.

▪ Led cloud security enhancements, implementing GCP Service Perimeter, Cloud Armor, and enforcing perimeter controls, alongside Google Workspace Security configurations and firewall policies to prevent data breaches. ▪ Conducted endpoint protection and vulnerability management using FireEye Hx, FireEye ETP, Varonis, and Rapid7, while supporting security policies aligned with NERC CIP, ISO 27001/2, PCI DSS, and NIST standards. ▪ Handled internal ticket resolution via Web Help Desk, created cyber risk dashboards for senior management, and delivered actionable insights through security assessments ▪ Supported SDLC, vendor management, and project management processes, and contributed to cloud migration efforts to enhance organizational agility and security. ▪ Assisted the threat-hunting team by testing new threats, evaluating potential impacts, and supporting early identification of emerging threats.

• Providing leadership advise, project management, vendor management, and risk-based expert advice to technical & business teams to manage information security risks across FSRA. • Primary on-call person when responding to any high-severity cyber threat alert, and leading any cyber incident response. • Performing in-depth risk analysis for new applications/solutions/systems/services/vendors. • Providing proactive risk mitigation advice while considering cyber security best practices, corporate guidelines and directives, latest threat landscape, and operational sustainability. • Engaging in predictive threat intelligence while ensuring that strategies, designs, and plans take into account the future threat landscape. • Leading and managing multiple projects for establishing new cyber security capabilities while balancing various aspects of the projects such as - budget, stakeholder, change and vendor management, communications and reporting. • In-depth knowledge of cyber security domains, latest industry trends and best practices (i.e., NIST, CIS Top 18, OWASP Top 10, PCI DSS, ISO 27001), common vulnerabilities, threats and attacks targeting people and technology. • Proficient in risk management concepts and methods used for managing and governing cyber security risks. • Strong knowledge and hands-on experience with operating and fine-tuning cyber threat detection and response solutions such as - vulnerability scanners, SIEM platforms (e.g. Rapid7), EDR platforms (e.g. Crowdstrike), DLP tools, Cyber threat intel platforms (e.g. Recorded future), user behavior analytics, Honeypots. • Performing threat hunting to uncover IOA's and Indicators of Compromise. • Proactive and strong knowledge of cloud security for IaaS, PaaS, and SaaS. • Ability to analyze and synthesize information, perform log correlation and analytics, generate KRIs and KPIs, prepare executive reports supported by facts and data. • Ability to automate operational tasks to achieve efficiency.

Deployed enterprise SSO and MFA with Okta, Azure AD, and OneLogin. Conducted web application penetration testing (Burp Suite, OWASP ZAP). Created Power BI dashboards for threat visibility and IAM governance. Integrated SailPoint with SIEM and EDR tools for identity-based alerting. Led vulnerability management and client remediation support. Delivered KnowBe4-based phishing simulations and security training. Tracked and analyzed KPIs, including intrusion attempts and MTTR (Mean Time to Detect/Resolve), improving overall security response metrics.

Conducted IAM assessments and security testing (Nessus, Qualys). Ensured PHIPA compliance in healthcare IT solutions. Integrated security into SDLC with SAST/DAST testing methodologies. Monitored IDS/IPS and optimized firewall rule sets. Responded to Tier 2 incidents and performed cloud security reviews.

• Worked directly with clients to understand their security requirements and compile SIA/PIA • Worked with other teams to evaluate the contractual scope of works towards the client and establish a workflow to accomplish the goals • Participated in security baselines creation for existing and new clients and working with various teams to assure that the minimum set baselines were met. • Black Hat Testing of all publicly available servers, perimeter Firewalls and Intrusion Detection Systems. • White Hat Testing of all internal servers and member services like DNS, SQL, IIS and Application Servers. • Monitored and analyzed network traffic data using Wireshark to establish baselines and document anomalies. Appropriate actions were taken to minimise network downtime and security breaches resulting in an improvement of network services of 40%. • Established and documented process for event detection from monitoring devices and associated technology

Conducted black-box/white-box testing across DNS, SQL, IIS, and cloud environments. Used Splunk and Wireshark for network visibility and intrusion detection. Enhanced service uptime by 40% through proactive threat detection.