Shaswat.

IT General Controls (ITGC) & Segregation of Duty (SOD) audit:

• Conducted internal audit review of change management, patch management, incident management, User Access Management (UAM) and Segregation of Duty (SOD) controls for critical business applications.
• Provided recommendations to enhance the design and effectiveness of existing policies and controls.
• Identified gaps in user access management to mitigate risks of unauthorized access to internal applications.

Data Security Assessment, Endpoint Review & DLP Testing:

• Conducted a comprehensive review of 15 internal applications to understand the flow of data and identify potential data leakage points.
• Identified procedural gaps through interviews with department heads and ground staff to mitigate risks of customer personally identifiable information (PII) leakage.
• Based on the interviews, designed data flow diagrams of all departments using Microsoft Visio, to visualize the flow of customer PII data across employees, systems and relevant applications.
• Conducted a physical inspection of the telesales floor to identify social engineering vulnerabilities and other physical data leakage avenues.
• Assessed endpoint security on employee PCs and identified several gaps in Data Leak Prevention (DLP) Provided recommendations to strengthen the DLP and prevent unauthorized data extraction.
• Successfully conducted an on-site vendor risk management exercise by visiting the client’s vendor and identifying significant gaps pertaining to the client’s data security.
• Prepared a comprehensive 110 pages report detailing process gaps and technical findings with the risks, and mitigation strategies for ELT’s perusal. 

Audit Based on NIST Cybersecurity Framework for IRDAI Compliance:

• Collaborated with the Chief Information Security Officer (CISO) to review and implement controls aligned with IRDAI information security guidelines based on the NIST Cybersecurity Framework.
• Enhanced the Information Security Management System (ISMS) and policies such as Cyber Crisis Management Policy, Business Continuity Policy, Asset Management and Incident Response to meet IRDAI requirements effectively.
• Recommended logging, monitoring, and threat mitigation controls throughout the organization’s IT infrastructure.
• Conducted a review of ISO 27001 implementation and refined the existing ISMS policies to align with ISO 27001 and NIST CSF guidelines.
• Assisted the IT team in conducting endpoint reviews and incident management tabletop exercises.