Vinaya K

IT Security Consultant with over five years' experience helping organizations build security programs that actually work in practice — not just on paper. My background spans security governance, regulatory compliance, and day-to-day security operations. Comfortable bridging the gap between technical teams and business stakeholders, and experienced in taking complex security requirements and turning them into something the wider business can understand and act on.

Senior Cyber Security Consultant - Siemens PLC

(2021-09)

• Owned and maintained information security policies and standards aligned with ISO 27001, ISO 42001, NIST CSF, and CIS Controls, making sure they actually fit how teams work day-to-day rather than sitting on a SharePoint site.
• Day-to-day monitoring and investigation of security events through Microsoft Sentinel and Rapid7 — running through alerts, refining use cases, and cutting noise from low-value detections.
• Looked at phishing, spoofing, and spam reports via Proofpoint; tuned detection rules and worked with the SOC to bring down the volume of user-reported malicious emails.
• Ran application and infrastructure vulnerability assessments using SAST tools (SonarQube, Fortify) and DAST tools (WebInspect, Burp Suite), then worked with dev teams to actually close findings rather than just log them.
• Supported penetration-testing engagements, vulnerability scanning, and DLP initiatives — both scoping the work upfront and chasing remediation once findings landed.
• Hands-on with CyberArk for privileged access — vault onboarding, session management, access reviews — alongside wider IAM work in Microsoft Entra ID.
• Took part in infrastructure and web application audits for PCI DSS, ISO 27002, and internal compliance reviews.
• Wrote RCA documents for security incidents and operational issues, focusing on what actually happened and what changes would stop it recurring.
• Partnered with business and technical stakeholders on cybersecurity improvement projects, translating security requirements into something engineering teams could plan and deliver.
• Improved monitoring efficiency by walking through investigation workflows, retuning SIEM thresholds, and proposing new detection content based on observed gaps.
• Applied IT risk-management methods to assess control effectiveness and recommend pragmatic mitigations — not just textbook answers.
• Pulled together investigation reports, audit evidence, and compliance documentation for internal reviews and external assessments.
• Used Qualys to prioritise patching and steer system hardening, based on real exploitability rather than raw CVSS scores.
• Helped shape governance frameworks and operational security standards as the team's security maturity grew.
• Supported software assurance and migration projects, embedding security checks into the change process rather than bolting them on at the end.
• Drew on knowledge of adversary TTPs, mapped against MITRE ATT&CK, to sharpen detection content and incident-response playbooks.
• Supported early adoption of ISO/IEC 42001 (AI Management System) — helped define roles, risk processes, and oversight responsibilities for AI use cases across the organisation.
• Reviewed internal AI and LLM-based projects against ISO 42001, the NIST AI Risk Management Framework, and EU AI Act requirements, flagging gaps around data lineage, model transparency, and human-in-the-loop oversight.
• Worked with engineering teams on AI security fundamentals — prompt injection, sensitive data leakage, model misuse, training-data poisoning — using the OWASP Top 10 for LLM Applications as a baseline reference.
• Helped draft an internal AI acceptable-use policy and a lightweight AI risk-assessment template used by teams onboarding generative AI services or building LLM features.
• Used MITRE ATLAS to think about adversarial threats to ML systems and to start mapping detection ideas for AI-specific abuse patterns.

Information Security Analyst - Accenture

(2020-06 - 2021-08)

• Designed and ran phishing simulations through MetaCompliance, then used the results to shape awareness training and bring down click-through rates.
• Carried out enterprise-wide IT risk assessments — looking at control effectiveness and putting forward fixes the business could realistically take on.
• Supported GRC operations in OneTrust and RSA Archer, covering vendor risk assessments, DPIAs, and keeping the risk register tidy.
• Handled the identity and access lifecycle — joiner-mover-leaver processes, access reviews, and privileged access provisioning — using CyberArk alongside Active Directory.
• Wrote and updated information security policies and standards aligned with ISO 27001 and the wider security strategy.
• Worked across AWS, Azure, and GCP on cloud security: secure deployment patterns, posture assessments, and reviewing misconfigurations.
• Hands-on with Azure security tooling — Microsoft Defender, Sentinel, WAF, and the Office 365 security stack.
• Supported PCI DSS work — coordinating remediation, validating controls, and advising on compensating controls where the standard wasn't a clean fit.
• Took part in infrastructure and application security projects — both day-to-day operational work and longer-term roadmap items.
• Ran ad-hoc security assessments outside the formal roadmap when emerging risks needed a quick view.
• Coordinated penetration-testing engagements end-to-end — scoping, execution support, and remediation tracking afterwards.
• Acted as the go-to person for infrastructure security risk assessments, aiming to give teams something they could actually act on.
• Built and delivered internal cybersecurity awareness sessions and workshops to keep secure behaviour front of mind.
• Logged and tracked security risks in Archer GRC, keeping the DCM process and risk reviews in good shape.
• Hands-on use of Nessus, Qualys, Burp Suite, WebInspect, OpenVAS, Metasploit, Fortify, and Black Duck across day-to-day work.
• Solid working knowledge of IDS/IPS, encryption standards, and core cryptographic concepts (symmetric/asymmetric, hashing, PKI).
• Worked across DevSecOps, infrastructure security, and application security to strengthen enterprise-wide controls end-to-end.