Santhosh Kumar M

Strategize and manage regional Information Security programs across EMEA (20+ countries) with a team of Information Security SMEs. - Oversee IT Risk Management, Non-Financial Risk Assessment (NFRA) / and Risk & Control Self-Assessment (RCSA) - Ensure compliance with PCI DSS Version 4 and manage IT Third Party Risk Management - Drive Information Security Awareness initiatives and lead Customer Audits & Contract Reviews. - Provide Regulatory Assurance for DORA, UAE ADHICS, UAE Information Assurance, Jordan Central Bank Regulation and Qatar Cyber Security Regulation and - Report Information Security compliance to the Audit/Risk Committee and Executive Leadership - Contributed to technology and security assessments for major infrastructure changes, Mergers / Acquisitions and Divestitures (M&A). - Supervise Identity & Access Management programs Spearheaded multi-million dollar strategic regional security transformation programs, including: - Implementation of Privileged Access Management across 1,000+ servers - Deployment of Automated Access Recertification for 175+ applications - Rollout of Data Loss Prevention for 5,000+ endpoints - Establishment of Database Logging & Monitoring for 150+ database servers - Integration of Multi-Factor Authentication and Single Sign-On for 20 applications; and - Governance of Lower (non-PROD) Environment and Data Masking for 250+ applications Report Information Security compliance to Audit / Risk Committee & Executive Leadership. Assisted on technology and security consideration for country divestitures (M&A).

Part of the Security & Management Transformation (SMT) team. Area of Expertise : - Led the development of InfoSec Strategy, Roadmap, and Governance Model that significantly elevated the security maturity of the UAE health sector, achieving stronger regulatory alignment and risk management. - Skilled in developing business proposals and responding to Requests for Proposals (RFPs), contributing to new business opportunities and strategic partnerships. - Extensive experience in conducting IT & Information Security Audits, including the creation and management of comprehensive IT Audit Plans. - Advisory and audit experience in the implementation of Information Security Standards & Best Practices, including ISO 27001/27002:2013, ISO 27005:2011, NESA (UAE), and ADSIC (UAE) frameworks. - Proven track record in People Development, including mentoring, coaching, and managing talent to cultivate high-performing teams and future leaders.

Specialization in Information Security and Risk Management, Governance, and Compliance: - Led the development of Qatar’s national Information Security Risk Management Framework for the Ministry of ICT, managing risk assessments for government and financial entities. - Supervised a multi-disciplinary team of consultants to deliver a comprehensive Cybersecurity and GRC advisory portfolio, including IT Risk Assessment, Information Security Management Systems (ISMS), IT General Controls Audits, and SOC 2 reporting. - Developed and implemented IT and Information Security Policies, Procedures, and Process Maps, ensuring alignment with industry standards and organizational objectives. - Led COSO IT Control Transformation initiatives, enhancing internal control frameworks and IT governance models. - Extensive experience conducting SAS 70 (SOC) Audits, ensuring regulatory compliance and operational efficiency. - Skilled in performing IT & Information Security Audits, identifying and mitigating risks to strengthen overall security posture. - Specialized in Supply Chain Security Management, safeguarding data integrity and compliance across third-party relationships.

Executive-IT at Axis Bank, Mumbai

Consultant - Managed Security Services