I am currently responsible for End-to-End product security of over 150 applications in Service Delivery platform and to define the IT security strategy for ongoing developments

• Elevating security for 150+ applications, from design to operations, with industry-best practices integrated into the CI/CD pipeline.
• Review Architecture designs, early stage and late-stage designs, identifying potential security issues
• Serving as the primary point of contact for all applications, establishing a self-service Secure Software Development advisory, inclusive of Threat Modelling.
• Identify and drive risk mitigation of (emerging tactical) Information Security Risk across the Portfolio
• Embedding Secure-by-Design and Secure Development Life Cycle principles to maximize Portfolio/Platform autonomy
• Understand and clearly identify Cyber risk within an agile development environment, highlighting risks to Cyber for inclusion in the Risk Register (Archer) and to inform prioritization of Cyber Backlog items.
• Support 'Business Enabling Platforms' Tech leads on their (emerging) Cyber issues starting from regular cyber risks to Architectural reviews.
• Guiding development initiatives on specific security questions by taking the lead on finding technical Cyber solutions

• Identified and closed security gaps in the CI/CD pipeline, incorporating essential security tools (SAST, DAST, IAST, OSS, Docker, Kubernetes Sensor).
• Transformed DevOps into a DevSecOps culture
• Enforced Secure Coding Standards (ASVS), Threat Analysis as well as Secure Code Review.
• Promoted a "Secure by Default" culture.
• Automated processes with Python scripting.
• Conducted Third-Party Security reviews and managed Azure Security Center.

• Assessed cybersecurity implications of new applications and infrastructure enhancements.
• Conducted threat analyses of application architecture and identified security risks.
• Guided development teams on security issues.
• Supported Tech Leads on emerging cyber issues in encryption, authentication, authorization, patching frequency and API security.

• Led diverse security teams to enhance overall security.
• Coordinated Product Security, Web Application Scanning, Penetration Testing, SDLC, Vulnerability Management, and Risk Assessment.
• Reviewed security reports and made recommendations.
• Enhanced security architecture and design.
• Promoted PKI-based certificate management.

At FIS (a Fortune 500 company works in Banking domain), I have worked in its Risk as A Service line of business which works as cloud source security services to Banking Sector. Being a part of its Red Team, I have,

• Introduced security in Agile DevOps.
• Led a product security team.
• Conducted secure coding training.
• Performed Vulnerability Management, Penetration Tests, and Risk assessments for different Banking Clients.
• Conducted Secure Code Reviews by HP Fortify, Checkmarx.
• Managed open-source tools and inventories.
• Ensured PCI DSS compliance.
• Worked with Security Analysts and Production Support to monitor security tools in CI/CD pipeline.
• Ensure PCI DSS compliance and security in the in-house developed applications and tools.

• Conducted security audits for World?s largest telecom giant.
• Analyzed data from 1500+ systems to find security gaps.
• Presented security analyses to the CISO.

• Improved Data Center security by 60% through employee training. 
• Implemented secure coding practices and regular web app scans. 
• Advised on security enhancements in architecture, infrastructure, and cryptography. 
• Established measures like Windows Firewall, Application Control, Secure Coding, Database & Disk Encryption, Web Server & Windows Hardening. 
• Standardized key management, identity, and network security. 
• Conducted regular security tests for ongoing vigilance.