Sandesh Dhanwade

Information Security, GRC, and SAP Security professional with 8+ years of experience in ITGC, SOX, ISO 27001, PCI DSS, NIST, risk management, audit, and compliance programs. Experienced in vulnerability management, third-party risk management, BCP/DR, SAP Security & GRC, access governance, SoD analysis, and audit support. Proven track record of strengthening security controls, driving regulatory compliance, managing enterprise risks, and delivering effective governance and executive reporting across financial services and global IT environments.

Senior Consultant at InfoBeans (2025-12 – Present)

• Led a cross-functional Security & Compliance team overseeing ITGC, SOX, ISO 27001, SOC, and regulatory compliance across applications, infrastructure, and data environments.
• Managed enterprise risk assessments, control testing, risk registers, and remediation activities, reducing high-risk findings and strengthening control effectiveness.
• Owned end-to-end audit management, including internal/external audits, walkthroughs, evidence collection, remediation tracking, and audit closure.
• Directed vulnerability management and patch compliance programs in collaboration with SOC, Infrastructure, DevOps, and SAP Basis teams to improve remediation timelines.
• Led Third-Party Risk Management (TPRM) assessments, vendor risk reviews, and remediation tracking for critical suppliers.
• Developed and maintained security policies, standards, SOPs, and governance frameworks aligned with regulatory and business requirements.
• Prepared and presented cybersecurity risk dashboards, compliance reports, and executive updates to Senior Management and CISO using Power BI.
• Supported ISO 27001 implementation, continuous compliance improvement, team mentoring, and security awareness initiatives.
• Supported SAP Security and GRC activities, including user access reviews, role design, access compliance reporting, and Segregation of Duties (SoD) analysis.
• Coordinated SAP Security Note assessments, vulnerability remediation, and security compliance activities with SAP Basis and application teams.
• Assisted in SAP transport management, security-related change implementations, and access provisioning processes.
• Supported SAP audits, role reviews, compliance assessments, and remediation activities to ensure adherence to security and regulatory requirements.

Security Consultant at Worldline Global Services (2023-10 – 2025-10)

• Led information security, risk, and compliance as the second line of defense for payments and fintech services; established governance, controls, and operational metrics aligned with ISO 27001, ISO 22301, NIST, and PCI DSS requirements.
• Built and scaled GRC tooling and processes to increase risk visibility and automation across control testing, policy lifecycle, and vendor assessments; reduced manual effort and improved reporting cadence.
• Headed third-party and vendor risk management program, conducting risk classification, assessments, SLA reviews, and remediation tracking for strategic suppliers supporting payment operations.
• Owned vulnerability management, VAPT coordination, and remediation governance; collaborated with SOC and infrastructure teams to prioritize fixes and drive closure of critical vulnerabilities.
• Supported SAP Security controls, user provisioning, access governance, and periodic access reviews across SAP environments.
• Assisted in SAP GRC Access Control, SoD remediation, risk analysis, and user access compliance activities.
• Worked closely with SAP Basis teams on patch validation, transport management, and security-related system changes.
• Provided SAP security evidence, user access reports, and compliance documentation for internal and external audits.
• Designed and implemented Business Continuity and Disaster Recovery (BCP/DR) strategy, conducted BIAs, defined recovery objectives, and led enterprise-wide drills to validate readiness.
• Directed crisis management and incident response coordination, acting as escalation lead during major incidents; strengthened playbooks and runbooks for cross-site coordination.
• Led security awareness initiatives, phishing simulations, and targeted training to improve employee security behaviors and reduce phishing susceptibility metrics.
• Supported client audits, RFPs, and regulatory assessments by providing control evidence, remediation roadmaps, and continuous improvement plans; contributed to winning and retaining key payments clients.

Senior Associate - Information Security at Evalueserve Pvt Ltd (2022-02 – 2023-10)

• Led annual ISO 27001 certification audits for Evalueserve, ensuring compliance with international standards.
• Managed information security reviews for MSAs, RFPs, SOWs, serving as a key stakeholder during client audits.
• Strengthened Third-Party Risk Management (TPRM) through detailed vendor assessments.
• Established and maintained the Business Continuity Management System (BCMS).
• Developed and implemented Business Continuity (BCP) and Disaster Recovery (DR) plans; executed drills.
• Conducted training, awareness programs, and post-incident reviews.
• Designed organization-wide security awareness programs including phishing simulations.
• Collaborated with the SOC team on Vulnerability Assessments and Penetration Testing (VAPT).
• Conducted risk assessments and managed the risk treatment plan.
• Performed internal audits across multiple departments and ensured timely closure of security incidents.

Lead Auditor at Tech Mahindra LTD (2018-07 – 2022-02)

• Led audits across all global delivery centers with a team of auditors.
• Planned and executed annual audit calendars.
• Conducted comprehensive audits including HR, Physical Security, Data Centers, Vendor Management.
• Reviewed information systems, processes, and security policies.
• Collaborated with departmental managers to gather data for audits.
• Prepared and delivered monthly security audit dashboards to leadership.
• Identified weaknesses in data security controls and recommended mitigation strategies.

Master of Computer Applications in Computer Applications – Savitribai Phule Pune University (2017-01)

Bachelor of Science in Computer Science – Savitribai Phule Pune University (2014-01)