Appala

Cyber Security Manager with over 21 years of experience delivering security governance, risk management, security operations, and cloud security solutions within highly regulated financial services environments. Over 7 years of leading enterprise security and architecture initiatives that strengthen cyber resilience, improve operational processes, and support business objectives through effective risk management and security governance. Experienced in designing, implementing, and continuously improving security controls aligned with ISO 27001, NIST Cybersecurity Framework, CIS Controls, PCI DSS and GDPR.

Strong background in SIEM-enabled security monitoring, incident response, third-party risk management, vulnerability management, and secure application delivery across cloud, web, mobile, and API platforms. Hands-on experience with Microsoft Sentinel, Microsoft Defender, identity and access management, authentication technologies, endpoint security, vulnerability assessment, and secure SDLC practices. Skilled in collaborating with Security Operations, engineering, architecture, and business teams to enhance security services, communicate technical risks to diverse stakeholders, and deliver measurable improvements in security posture.

Recognised for building trusted stakeholder relationships, simplifying complex cyber security concepts for technical and non-technical audiences, and driving continuous service improvements through automation, governance, and risk-based decision making.

Cyber Security Manager - Virtusa Pvt Ltd - London, UK

(2018-10 - 2026-06)

• Collaborated with solution architects and engineering teams to assess identity, network, application, and data security controls, providing practical recommendations that improved security posture while supporting business delivery
• Designed landing zones aligned with Azure Cloud Adoption Framework to implement a secure Azure cloud (Azure Firewall, Key Vault, Defender for Cloud, and Microsoft Entra ID) supporting over 100,000 plus users, incorporating Zero Trust principles, private networking, encryption, identity federation, and automated security controls
• Introduced Event-Driven for Standardised REST APIs to implement API security using OAuth2/OpenID Connect and Designed scalable API-led integration architecture using Azure Integration Services (API Management, Logic Apps, Service Bus, Event Grid)
• Created reusable architecture templates quality gates and design patterns Chaired and presented solution designs to the Architecture Review Board (ARB) and ensuring alignment with strategic technology roadmaps, cloud standards, and cybersecurity policies
• Conducted Threat modelling and secure-by-design reviews for high-value digital banking platforms, identifying critical data flow risks and ensuring encryption, MFA, and RBAC controls
• Built, scaled, and maintained SAST based Checkmax/SonarQube, ZAP-based DAST (Dynamic Application Security Testing) pipelines across all API and UI layers, ensuring comprehensive security coverage
• Partnered with developers and architects to embed BurpSuite/OWASP ZAP Top 10 controls into CI/CD pipelines, configuration, and enforcement of security best practices, acting as a trusted partner throughout development cycles achieving a 95% remediation rate within 60 days of vulnerability discovery
• Guided microservices teams on API security posture, implementing inventory tracking and automated testing of exposed routes using Burp Suite and OWASP ZAP
• Contributed to architecture governance by reviewing solution designs against ISO 27001, NIST Cybersecurity Framework, PCI DSS, and organisational security policies, supporting Architecture Review Board (ARB) approvals
• Supported internal and external audits (ISO 27001, SOC2, GDPR), leading evidence gathering, gap remediation, and control maturity assessments
• Enhanced Identity and Access Management by implementing Multi-Factor Authentication, CyberArk privileged access management and endpoint security controls, strengthening authentication and reducing cyber security incidents by 40%
• Evaluated cloud solution architectures for Microsoft Azure, ensuring secure identity management, encryption, network segmentation, logging, monitoring, and resilience controls were embedded into enterprise applications
• Delivered ongoing security awareness training and phishing simulation programs, reducing employee susceptibility by 50%
• Conducted security design reviews for cloud, web, mobile, and API solutions, ensuring architectures aligned with secure-by-design principles, enterprise standards, and regulatory requirements before implementation
• Mapped and monitored control performance against ISO 27001, PCI-DSS and NIST CSF requirements, ensuring continuous effectiveness and alignment with audit standards
• Performed Third-party supplier security risk assessments, evaluating cloud and technology providers against organisational security standards and driving remediation of identified risks, by reviewing a supplier relationship control by assessing security questionnaires, contractual security clauses reducing exposure by 30% through control enhancements and targeted remediation
• Developed automated security dashboards and reporting, providing senior stakeholders with meaningful risk metrics, control effectiveness and compliance reporting to support informed decision-making
• Led and coordinated application security incident response and forensic investigations, ensuring timely containment, root cause analysis, and remediation
• Partnered with Windows, Network, Application team integrate security controls with SIEM Tools to Log authentication events, failed login attempts, account lockouts, and privilege changes. and alerting, improving threat visibility, incident detection and operational response across critical banking applications
• Designed and implemented a Security Incident Response Plan (SIRP) covering cloud, web, and mobile assets to streamline triage and escalation workflows
• Reduced application vulnerabilities by 20% in six months via automated scanning and secure coding practices
• Launched a continuous improvement process that reduced incident resolution times by 30%
• Standardized control documentation and reporting, improving audit readiness across multiple business units

Project Manager - Polaris/Virtusa Pvt Ltd - USA

(2012-03 - 2018-09)

Client: M&T Bank, USA

• Oversaw the design, implementation, and assurance of IT security controls for backup, patch, access, and network management
• Conducted quarterly risk audits and control evidence reviews to maintain compliance with ISO 27001, ISO 20000, SOC1/SOC2, and cryptographic controls
• Collaborated with risk and IT governance functions to align technical controls with data privacy and information governance policies
• Drove continuous control maturity assessments across applications and infrastructure, improving governance by 25%

Senior Consultant - Polaris Pvt Ltd - India

(2005-04 - 2012-03)

• Enhanced testing frameworks and automation pipelines, integrating security testing within SDLC using Selenium, Jenkins, and BDD methodologies
• Conducted secure code reviews, ensuring adherence to OWASP standards and improving application security baselines
• Supported early-stage application risk assessments, introducing threat modelling and secure coding standards

Master of Computer Application (2004-03)

Bachelor of Degree - Maths Physics and Chemistry (1998-06)