ASHISH C.

• Driving strategic initiatives that strengthen our overall strategic governance posture. • Partnering closely with cross-functional teams to deliver scalable, secure, and high-impact policy governance for our customers and stakeholders. • Building on a culture of excellence, innovation, and continuous improvement within the organization. Looking forward to contributing to the organization’s next phase of growth and collaborating with professionals who are equally passionate about transformative impact.

Certified CISO | CISSP | CISM | CISA | CRISC | CDPSE | ITIL | DCPLA | DCPP | CHFI | CEH | LA - ISO 27001 | LA - BS 25999 | LA - ISO 13485 | LA - ISO 20000

# General Data Protection Regulation (GDPR) – o GDPR Readiness Assessment: Conducting assessments to make organization GDPR ready. o Developing Privacy Framework: Developed privacy framework based on the applicable data privacy requirements. o Privacy Organization Structure: Established Privacy Organization Structure o Data Protection Impact Assessment: Conducting DPIA of various applications, websites, business processes and enhancements to identify the risk and provide recommendations. o Privacy requirements of IT Act: Reviewing privacy policy with respect to the privacy requirements of IT Act, identified gaps and update policy. o Data Flow maps: Identify and understand the flow of personal data in a process based on the discussions and interviews to prepare the data flow diagrams. o Application assessment: Identifying gaps in the application as per the GDPR requirements. o Contract review: Review vendor contracts with respect to the privacy requirements. o Personal data inventory and Records of processing activities: Prepare inventory of personal data collected and records of processing activities. o Privacy awareness session: Drafting privacy awareness deck and providing privacy awareness sessions to employees from different business functions. # Data Leak Prevention (DLP) – o Evaluated various DLP solutions (including CASB) to meet Organizations data protection requirements o Ensure DLP systems detect potential data breach incidents in timely manner and prevent them by monitoring data while in-use (endpoint actions), in-motion (network traffic) and at-rest (data storage) o Continuous review of configuration and tuning of DLP systems, policies and response rules. # Governance, Risk & Compliance (GRC) – o Review of IT Ops / IT Security Operations processes (like Change Management, Patch Management, Incident Management, Problem Management) and ensure compliance to same

• Develop, implement and monitor a strategic, comprehensive enterprise information security and IT risk management program to ensure that the integrity, confidentiality and availability of information is owned, controlled or processed by the organization. • Develop, maintain and publish up-to-date IT security policies, standards and guidelines. Oversee the approval, training, and dissemination of security policies and practices. • Communicate and implement a risk-based process for vendor risk management, including the assessment and treatment for risks that may result from partners, consultants and other service providers. • Manage IT security and risk management awareness training programs for all employees, contractors and approved system users. • Establish data flow between HRMS, Finance & IT Asset Management processes Master data to resolve issues like mismatch in asset records, timely identification of depreciation value of asset in FAR, track asset allocation etc. • Review regular reporting on the current status of the IT security program to enterprise risk teams, senior business leaders and the board of directors as part of a strategic enterprise risk management program. • Ensure that security programs follow relevant laws, regulations and policies to minimize or eliminate risk and audit findings. • Manage security incidents and events to protect corporate IT assets, including intellectual property, regulated data and the company's reputation. • Monitor the external threat environment for emerging threats and advise relevant stakeholders on the appropriate courses of action. • Liaise with external agencies, such as law enforcement and other advisory bodies as necessary, to ensure that the organization maintains a strong security posture.

• Perform internal security assessment tests as well as Risk assessments & gap analysis based on Stryker and Industry Security policies and standards. • Create a risk mitigation plan as an outcome of the security assessments • Conduct organization wide data classification assessment and security audits and manage remediation plans • Develop, maintain and publish up-to-date Global IT security policies, standards and guidelines. • Oversee the approval, training, and dissemination of security policies and practices. • Establish Master data management process for GRC tool Archer. • Demonstrate Customer service excellence and teamwork attitude • Work closely with the project owner as a trusted security advisor

I've worked extensively in the BSFI sector handling the auditing, assessments and other roles including SBI, Allahabad Bank, HDFC, Indian Bank, Corporation Bank, United Bank, SBI-Life, SBI Custodial Services Ltd., Saudi Telecom Company, Canara HSBC Life Insurance, A Littleworld and others. I also audited banking support services organization including that of a captive unit of large foreign bank.

Implemented ISO 27001 Compliance activity Information Security Awareness Training to employees Drafted IT Security Policy & Procedure

Managing ISO 27001 Compliance activity BCP/DR awareness training to employees Review of IT Security Policy & Procedure

Information Security Awareness Training to employees Drafted IT Security Policy & Procedure

MS - INFORMATION SECURITY & CYBER LAWS

BE - COMPUTER SCIENCE & ENGINEERING