Tuhin Subhra Roy

Technology Risk, Information Security, Cybersecurity, and IT Audit professional with 11+ years of experience across the all Three Lines of Defense, covering technology risk management, cybersecurity, governance, compliance, audit, and assurance. Led enterprise IT audit and technology risk advisory engagements, including multiple Third-Party Audit (TPA) mandates, covering ITGC, cyber and cloud risk, and regulatory compliance for banking, financial services, and large enterprise clients. CISA and ISO 27001:2022 Lead Auditor certified, with hands-on experience designing ISMS frameworks and executing compliance audits against ISO 27001, SOC 2, GDPR, NIST CSF, COBIT, CERT-IN, SEBI, RBI and APAC regulatory guidelines.

Led design and development of Continuous Control Monitoring (CCM) frameworks, automating ITGC and internal control testing using RPA, AI/ML, and Generative AI and Agentic AI–driven techniques — improving audit coverage, accuracy, and turnaround time. Experienced in cybersecurity and infrastructure security assessments, including vulnerability and penetration testing (VAPT), security architecture and configuration reviews, network security, security posture evaluations, and control effectiveness assessments. Designed and implemented security policies and governance frameworks aligned to regulatory and industry standards, translating technical risk into clear reporting for senior stakeholders and audit committees.

Owned end-to-end data center operations and infrastructure projects, — Network, Infrastructure, and Security Operations (NOC/SOC), business continuity and disaster recovery, large-scale technology projects, vendor governance, SLA management, and third-party risk oversight. Combines technical depth in network and security infrastructure with proven people leadership, having managed operations teams and delivered large-scale security and infrastructure projects on time and within compliance.

Lead Technology Risk Management at Societe Generale (2025-08 – Present)

• Operating within the Second Line of Defense, driving risk-based IT audit and Technology Risk Management across the organization, with ownership of control assurance, internal control testing, and gap analysis against regulatory and industry frameworks.
• Lead information security, cybersecurity, and data center audits across Asia-Pacific entities, assessing ISMS maturity and ITGC controls across applications, Cloud infrastructure (AWS, Azure), and network environments to identify control gaps and drive remediation.
• Manage regulatory compliance assessments across global and regional standards, including GDPR and NIST CSF, ensuring data protection, privacy, and cybersecurity risk controls are embedded within technology risk processes.
• Drive internal controls automation strategy, partnering with control owners and technology teams to strengthen control design, improve testing efficiency, and enhance audit-readiness across the technology risk landscape.
• Act as a key liaison between first-line control owners and third-line assurance functions, providing independent challenge and advisory input on emerging technology and cyber risks.

Internal Audit Manager at IDFC First Bank Limited (2023-12 – 2025-08)

• Led Third Line of Defense internal IT audit engagements, executing internal control testing, gap analysis, and regulatory compliance assessments across cybersecurity, information security, cloud security (AWS, Azure) and data center domains.
• Managed RBI-mandated Key Risk Indicator (KRI), Tranche tracking and regulatory returns/submissions, ensuring timely and accurate reporting to regulators and senior management.
• Conducted ITGC controls review and ISMS audits, evaluating control design and operating effectiveness across applications, networks, and systems, benchmarked against RBI, SEBI, CERT-IN and NIST CSF requirements.
• Spearheaded IT audit controls automation and Continuous Control Monitoring (CCM) development, leveraging RPA and AL/ML to shift testing from periodic to continuous, improving coverage and reducing manual audit effort.
• Defined and executed Risk-Based Audit Plan (RBAP) and audit strategy, prioritizing audit focus areas based on emerging technology, cyber, and regulatory risks across the bank's IT landscape.

Senior Analyst at KPMG India (2019-06 – 2023-12)

• Engaged in various third-party audit engagements, including IT Audit, Information Security Audit, IT General Controls review, and ISMS review.
• Performed risk assessments and assessments in risk management, information security, cybersecurity, infrastructure and network security.
• Provided technology consulting and advisory services related to IT Audit, Security Audit, Data Center, and IT and cloud infrastructure.
• Conducted internal control testing, analyzed results, and prepared reports to communicate findings to management, offering recommendations to improve the organization's security posture and ensure compliance with Continuously monitored Data Center IT infrastructure performance and evaluated the effectiveness of information security controls, policies, and procedures.
• Performed security and configuration reviews of firewalls, routers, switches, and other network devices. Conducted vulnerability assessments, network penetration testing, and web application penetration testing.
• Delivered project work including data analysis, report writing, fact-finding, and audit reporting (in line with ITIL standards). Independently carried out all audit and assessment tasks, preparing the final report documents for client deliverable submission.
• Provided ad-hoc analytics support for IT and financial audits, as well as for SLA and RFP preparation across various projects. Offered advisory support to IT projects related to internal controls, governance, and risk management.
• Conducted audits in all areas of information systems, including applications, databases, networks, data security, cloud security (AWS & Azure) and IT frameworks.

Team Leader (Network Administrator) at Airport Authority of India (off payroll), Vidass Venture (2016-07 – 2019-06)

• Oversaw complete Data Center operations and administration, including project management, budgeting, team management, patch and vulnerability management, incident management, threat analysis, investigation, log monitoring, data center physical controls, and SLA management.
• Conducted gap analysis, designed network architecture, and handled data center implementation and network cabling design.
• Managed end-to-end NOC and SOC operations along with a passive team, providing L2 and L3 technical support in a 24/7/365 environment. Experienced in managing multi-vendor OEM infrastructure including Cisco, Juniper, Brocade, HP, Aruba, Arista, and Meraki.
• Proficient in installing, troubleshooting, configuring, and monitoring the entire Data Center infrastructure and LAN/WAN networks at an airport.
• Managed cross-functional teams across various departments, including network engineers, server engineers, passive teams, and vendors.
• Utilized network security controls, tools, and best practices to detect anomalous events and security violations, reducing their impact on system vulnerabilities.
• Accountable for supporting, installing, and maintaining network devices such as switches, routers, firewalls, and extensive experience in monitoring and maintaining storage and virtualization solutions.

Network Engineer at Networkers Home (2015-06 – 2016-06)

• Oversee and maintain network and security operations.
• Worked on installation and configuration of network devices and services including routers and switches, collaborated with admin teams to deploy security tools, policies, and procedures, and ensured network availability and reliability through monitoring, access control, incident analysis, and performance optimization.

MCA in Master of Computer Application – The Oxford College of Science, Bangalore University (2015)

BCA in Master of Computer Application – Tata CMC Academy, NSOU, Kolkata (2010)

12th – WBCHSC, West Bengal (2007)

10th – WBBSC, West Bengal (2003)