Shahzad

Cybersecurity GRC professional with 5+ years of experience in SOC 2 audit, technology risk, control testing, cybersecurity, data privacy, and regulatory compliance. Experienced in RCSA, RCM, control design and operating effectiveness, evidence validation, issue remediation, audit readiness, risk reporting, and stakeholder management. Working knowledge of ISO 27001, NIST CSF, GDPR, CCPA/CPRA, and DPDP, supporting technology and information security governance across global teams.

Assistant Manager- InfoSec - BIRCHSTREET SYSTEM - LAS VEGAS, USA

(2025-12 - 2026-04)

• SOC 2 Audit & Assurance – Supported end-to-end SOC 2 audit activities including control evidence collection, validation, testing, remediation tracking, audit documentation, and coordination with control owners and external auditors to maintain audit readiness.
• Cybersecurity Risk & Control Management – Applied ISO 27001, NIST CSF, SOC 2, and security governance principles to identify, assess, and manage cybersecurity risks; supported control design, effectiveness assessment, risk treatment, and compliance initiatives. Reviewed security controls, identified gaps, and supported remediation to strengthen security posture and audit readiness.
• Risk & Control Matrix (RCM) – Developed and maintained RCMs covering risk identification, control objectives, mitigating controls, evidence requirements, control ownership, and remediation actions to strengthen control effectiveness and audit readiness.
• Data Privacy & Protection – Supported GDPR, CCPA/CPRA, and India DPDP requirements by addressing data protection, access, sensitive-data exposure, privacy risks, PIA/DPIA, DSARs, and Privacy by Design considerations across business and technology processes.
• Third-Party Risk Management – Assessed vendors and technology providers across cybersecurity, privacy, regulatory, technology, and operational risks; supported due diligence, risk treatment, remediation, contractual requirements, and ongoing monitoring.
• Regulatory Compliance & Assurance – Supported compliance and audit-readiness activities by maintaining governance documentation, validating evidence, monitoring controls, tracking remediation, and reporting compliance risks and control gaps to stakeholders.
• Stakeholder Management & Reporting – Partnered with technology, cybersecurity, privacy, legal, compliance, and business stakeholders to communicate risks, coordinate evidence, drive remediation, and strengthen security, privacy, and regulatory compliance.

Compliance Analyst - TICKETMASTER INDIA PVT LTD - GURGAON

(2025-04 - 2025-10)

• Cybersecurity & IT Risk Management – Performed technology risk assessments, control reviews, compliance monitoring, evidence validation, and remediation tracking across business processes.
• Control Testing & RCSA – Supported risk and control assessments, control documentation, effectiveness reviews, issue identification, and remediation tracking across technology processes.
• Third-Party Risk Management – Executed TPRM/vendor assessments covering cybersecurity, data protection, regulatory compliance, privacy risks, and technology controls.
• Governance, Compliance & Assurance – Managed compliance workflows, control evidence, risk documentation, governance reporting, and stakeholder coordination supporting audits and regulatory requirements.
• AI, Privacy & Regulatory Compliance – Evaluated AI and technology risks across cybersecurity, privacy, regulatory, and operational areas, supporting risk-based controls and compliance requirements.

Compliance Analyst - GENPACT INDIA PVT LTD - GURGAON, INDIA

(2024-04 - 2025-03)

• ITGC & ITAC – Supported IT General and Application Controls across access, change management, system operations, and compliance requirements.
• SOX & Audit Compliance – Supported SOX/SOC controls through documentation, exception tracking, audit coordination, and readiness activities.
• Technology Risk & Controls – Assessed technology and cybersecurity risks, reviewed controls, identified gaps, and supported risk mitigation.
• Security & Compliance Frameworks – Applied NIST CSF, ISO 27001, cybersecurity controls, and regulatory requirements across technology processes.
• Emerging Technology & Privacy – Evaluated technology risks across cybersecurity, privacy, regulatory, and operational areas.

Compliance Analyst - AMERICAN ENGINEERS & DESIGN - LUCKNOW

(2022-01 - 2024-03)

• Risk & Controls – Managed operational risks, process controls, issues, and remediation across business operations.
• Process Governance – Developed SOPs, control procedures, process documentation, and governance reporting.
• Third-Party Risk – Coordinated vendors and stakeholders, monitoring contractual, operational, and compliance risks.
• IT & Cybersecurity Controls – Applied ITGC, ITAC, access controls, cybersecurity risk, and control frameworks.
• Compliance & Assurance – Maintained evidence supporting SOX, SOC, audit readiness, and internal controls.
• Frameworks & Risk – Applied ISO 27001, NIST CSF, RCM, TPRM, and emerging technology risk concepts.

Process Associate - TELEPERFORMANCE GLOBAL SERVICES - GURGAON

(2020-10 - 2021-09)

• Managed inbound/outbound service calls, resolving queries efficiently with clear communication.
• Maintained accurate case records to support compliance and performance tracking.
• Collaborated across teams to escalate and resolve issues, ensuring service-level targets were consistently met.

Bachelor Of Technology (B.tech) (2018)