Swati Pathak

ISC2-Certified (CC) GRC and Operational Risk professional with 16+ months of hands-on experience delivering enterprise risk and compliance outcomes at CSL Finance Ltd, an RBI-regulated NBFC, reporting directly to the CTO. Architected a Third-Party Risk Management (TPRM) programme from zero to full operation across 9–12 enterprise vendors, driving unvetted vendor exposure to zero within one quarter. Delivers audit-ready outcomes through RCSA-based risk assessments, ITGC and control testing (ToD/ToE), Gap Analysis against the RBI IT Framework and ISO 27001, and DPDP Act 2023 compliance (97% certified).

Brings second-line-of-defence (2LoD) rigor, risk register ownership, and a consistent record of translating regulatory requirements into enforceable controls for senior leadership.

IT Executive — GRC, IT Risk & Cybersecurity Compliance - CSL Finance Ltd (RBI-Regulated NBFC)

(2023-12 - 2025-04)

Reporting to CTO

• Architected the TPRM Programme from Zero: Designed and operationalised an end-to-end Third-Party Risk Management framework — vendor identification, inherent/residual risk scoring, security due diligence, and control assessment — across 9–12 enterprise vendors (Barracuda, eScan, Acronis, Digio, FinBox, Credgenics), reducing unvetted vendor exposure to zero within the first quarter.
• Led RCSA-Based Vendor Risk Assessments: Conducted structured Risk and Control Self-Assessments (RCSA), evaluating control design (ToD) and operating effectiveness (ToE); produced risk-rated reports with issue tracking, driving 100% remediation-plan coverage across the vendor portfolio.
• Delivered ITGC & RBI Framework Gap Analysis: Performed IT infrastructure Gap Analysis against the RBI IT Framework and ISO 27001 control objectives; produced KRI-aligned, risk-rated findings presented directly to the CTO for the annual governance and risk review cycle.
• Owned the Enterprise Risk Register: Maintained a live operational risk register covering open issues, control gaps, and remediation status across all vendors and internal IT processes; escalated risk-appetite breaches to senior leadership, supporting continuous audit readiness.
• Drafted IS Policy & Control Framework: Authored Information Security policies mapped to RBI IT Framework and ISO 27001 control objectives spanning access management, vendor data handling, and incident response; validated post-implementation control effectiveness.
• Delivered DPDP Act 2023 Compliance (97% Certified): Led data-inventory mapping and consent-management review; embedded DPDP privacy obligations into vendor contracts and internal SOPs ahead of regulatory deadlines.
• Prepared Regulatory & Governance Reporting: Delivered RBI compliance reports, audit-ready evidence packages, and governance memos; coordinated cross-functionally with the Company Secretary and legal counsel across regulatory reporting cycles.

Project Developer Intern - CRIS — Centre for Railway Information Systems

(2024-01 - 2024-06)

• Supported enhancement of an internal railway application within Agile sprints; developed structured test cases, building foundational exposure to issue logging and control testing.

Master of Computer Applications - MCA - Banasthali Vidyapith (2022 - 2024)

Bachelor of Computer Applications - BCA - Banasthali Vidyapith (2019 - 2022)