I'm Shaswat, a Senior Consultant at EY and a CISA. I work on IT controls, cybersecurity and AI governance, and write scripts to make repetitive review work easier. This is where I keep my experience, qualifications and a few examples of how I approach the work.
I work in IT audit and technology risk. That means understanding a process, checking its controls and following the evidence. I also write scripts when a repetitive check can be made easier.
I started with programming. Most of my work today is in IT audit and technology risk, but I still like finding the parts of a review that a small script can make easier.
I’m a Senior Consultant in IS Audit & Risk at EY. Before that, I worked at Protiviti and Nangia & Co LLP. My experience covers IT controls, cloud security and data privacy, including work with financial services and insurance organisations.
I’m a CISA and have completed lead auditor training for ISO/IEC 27001 and ISO/IEC 42001. My work includes process walkthroughs, control-design and operating-effectiveness testing, risk and control matrices, audit reporting and follow-up on findings.
I have built a Python scanner for potential personal data and a PowerShell script to reconcile Active Directory users with HR termination records. I’ve also identified and responsibly disclosed an access-control vulnerability in a SaaS platform.
What I want this portfolio to show is the work behind those résumé lines. The project pages explain my contribution, while the fictional examples show the questions I’d ask and the evidence I’d need before reaching a conclusion.
A few examples of how I use code and control reviews in my work. Each case explains my contribution and the questions I would want the evidence to answer.
I wrote a Python scanner to look for possible personal data in more than 1,000 logs, PDFs and spreadsheets. It helped reduce the manual screening work. The case study explains where the script helped and where a reviewer still needed to make the call.
Read the case study →I built a PowerShell script to compare Active Directory users with HR termination records. It made the reconciliation easier to review, so the follow-up could focus on the accounts and dates that needed an explanation.
Read the case study →I reviewed access, privileged activity and repository configuration in GitHub environments, along with governance over integrated AI tools. The case study follows the questions about permissions, changes and evidence behind that work.
Read the case study →Five made-up records, including an account removed late and a current employee who falls outside the review. Pick the records you'd follow up and compare your reasoning with mine.
EY
I review IT controls, cloud security and AI governance, and document findings for audit and risk assessments.
Protiviti
My work covered IT audits, control testing and technology risk assessments, including reporting and follow-up on findings.
Nangia & Co LLP
I worked on cybersecurity reviews, data privacy and DLP assessments, and security policy documentation.
TCS
I completed a remote internship in dynamic application security testing and documented web application vulnerabilities.
Short explanations of the questions I would ask in a review, with enough detail to show why they matter.
A directory mismatch is worth a closer look. I explain how I'd check the identity, dates, scope and supporting evidence before reporting a finding.
Read the note →Before discussing the model, I'd want to know what the tool can read, where the information goes and which actions it can take.
Read the note →YouTube
/c/ShaswatManojJhaTelegram
@shaswatmanojjhaAddress
Jamshedpur, India
