Shreyansh Dubey

Dynamic Security Engineer with 3+ years of experience in penetration testing, vulnerability management, and security automation, leveraging OWASP Top 10 and MITRE ATT&CK frameworks. Skilled in ISO 27001, PCI DSS, and TISAX audits, Python-based automation, and driving organization-wide security awareness.

Compliance Specialist at IDrive Inc (2025-11 – Present)

• GDPR Compliance: Executed GDPR audit gap analysis, ROPA document reviews, and developed Data Flow Diagrams (DFDs).
• ISO 27001 Certification: Managed end-to-end evidence collection and documentation for certification readiness.
• FedRAMP Readiness: Conducted feasibility research, mapped Moderate Baseline controls (CM, CP, IA, IR), and developed Gap Assessment Matrices.
• Secure SDLC & Design: Designed baseline standards for secure development lifecycles and strategic security improvements.
• Vulnerability Management: Issued critical security advisories (e.g., React/Next.js RCE) and performed posture management research.
• Policy & Audit Review: Evaluated SOC 2 drafts, BCP/ISMS policies, and conducted competitive compliance analysis.
• Engineered an automated malware analysis and response pipeline using Python to intercept and evaluate public Drive URLs, reducing manual incident response time by 90%
• Implemented a multi-stage security validation workflow for files, integrating API-driven reputation checks (VirusTotal, URLhaus) and static analysis via AVG to detect and neutralize threats at scale.
• Demonstrated ability to apply AI & automation innovation to the control testing process.

Security Engineer II at Circles (2025-04 – 2025-10)

• Executed and managed phishing simulations and security awareness campaigns using KnowBe4.
• Leveraged KnowBe4 to train employees against social engineering tactics. Improved phishing awareness click rate by 40% using KnowBe4 campaigns.
• Identified security gaps within corporate infrastructure and applications through technical control assessments, recommending remediation strategies.
• Analyzed vulnerability data to help prioritize patching and hardening efforts across the organization.

Associate Security Engineer at Xperi (2023-01 – 2025-02)

• Security Assessment | Salesforce | NIST Assessments | TISAX Audits | Pentest Operations / Penetration Testing
• PCI-DSS | DPIA - GDPR, PIPL, TPDPB | Privacy & Compliance
• Conducted security assessments, for various projects across the company, providing control implementation recommendations to mitigate risks.
• Contributed to ensuring TISAX certification for 3 international offices by performing site walkthroughs and coordinating audit preparations(covering physical security, prototype security, and data protection).
• Served as the Point of Contact (POC) for the PCI external audit, managing evidence tracking with the PCI team and coordinating with external auditors for the annual compliance audit.
• Promoted the Security & Privacy Framework throughout the company via awareness training.
• Assisted in coordinating the annual policy review program.
• Assisted in coordinating the annual awareness training review program.
• Supported the Data Protection Officer (DPO) in their responsibilities within the security department.
• Assisted in coordinating the remediation plan following external NIST audits and penetration testing.
• ISO27001: Setting up the ISO 27001 audit process
• Engaged with internal and external stakeholders across multiple levels to align on compliance requirements and remediation strategies.

IT Internal Security Audit - Intern at PTC (2022-10 – 2023-01)

• Gained foundational offensive security experience at PTC by participating in cyber incident response exercises and analyzing IT controls within the SSDLC.
• Collaborated with the security team to understand and document potential attack vectors and control weaknesses.
• Implemented and maintained IT General Controls (ITGC) to ensure the integrity, confidentiality, and availability of systems and data.
• Managed SOX compliance efforts, including evidence collection, control testing, and coordination with internal and external auditors.
• Integrated Secure Software Development Life Cycle (SDLC) practices into development processes, ensuring security considerations are addressed at each phase. [SCA]
• Developed and executed Cyber Incident Response plans, including detection, response, and recovery procedures to mitigate the impact of security incidents.

Bachelor of Technology in Computer Science and Engineering – MIT-ADT University (2019 – 2023)