Aamir Bashir

Results-driven Technology Governance, Risk & Compliance (GRC) professional with 15+ years of comprehensive experience in information security and technology risk management for international organizations across different sectors. Demonstrated expertise in establishing and maturing information security programs for global organizations, leading cross-functional teams in implementing GRC frameworks and controls, conducting IT audits and assessments against multiple frameworks (NIST, ISO 27001, SOC2, CIS 8, SAMA), developing and implementing risk management strategies aligned with business objectives, and providing strategic guidance to C-level executives on cybersecurity, technology and compliance matters. Core strengths in bridging technical and business requirements while ensuring regulatory compliance across diverse international environments.

Experienced in remote and hybrid work models with multinational teams.

Cyber & Technology Risk Consultant - HCC Arabia

(2024-10)

Leading technology risk governance and advisory engagements for regulated financial institutions across the Middle East.

• Cyber & Technology Risk Consulting
• Enhancing Technology Risk Department's Governance of Riyad Bank – Saudi Arabia
• Development of Risk Assessment Frameworks for FinTech Partnership and Open Banking implementation for Riyad Bank – Saudi Arabia

Cybersecurity Consultant - CyberVigilance LLC - USA - Remote

(2022-09 - 2024-11)

Managed GRC strategy, risk assessments, and compliance roadmaps for Fortune 500 enterprise clients across banking, tech, and retail sectors.

• Cyber Risk Management Consultant - Alliant Insurance (Cybersecurity wing)
• ISO/IEC 27001:2022 Readiness Assessment & Remediation Advisory - Gerson Lehrman Group
• AICPA SOC 2 Trust Service Criteria Readiness Assessment & Remediation Advisory - Cirrascale Cloud Services
• Azure Cloud and Microsoft Office 365 Security Assessment - US Payments
• Compliance assessment against OCC Guidelines for GLBA Compliance requirements - Neuberger Berman
• Cyber Due Diligence – Mergers & Acquisitions - Heidelberg Materials
• Information Security and Privacy Assessment of Target company using NIST CSF 2.0
• Actionable recommendations for integration strategies and risk mitigation plans
• Proposing solutions to streamline post-merger integration and achieve cost efficiencies
• Reports and presentations for executive leadership
• Application Security Consultant - Charles Schwab
• Second line of defense risk management organization
• Revision of application security related policies and standards
• Translation of raw technical vulnerabilities from Veracode/Checkmarx data into actionable business metrics for executive dashboards
• Oversight of critical web application security activities including WAF and WAAP
• End to end exception risk management triage process development and execution
• Tech GRC Consultant – Eventus (A Tech Mahindra Company)
• Gap assessment of information security controls against GDPR, HIPAA, ISO 27001, NIST
• Alignment of SOWs and MSAs with privacy requirements
• Policies and procedures review and development
• Vendor Risk Assessment
• Risk management oversight of the 3rd party/vendor risk management function
• Questionnaire and Checklist development
• Management of Risk assessment matrix for critical and other vendors

Manager Web and Senior IT Auditor - SBM Group

(2010-05 - 2024-06)

Delivered IT audit and VAPT services for financial and public sector entities, while leading web application development and internal system automation for group companies (SBM College, Masood Pervaiz & Co. Chartered Accountants, Centric Consulting Pvt Ltd).

• IT Audits and VAPT: Zarai Taraqiati Bank Limited (ZTBL) - PAK
• Azizi Bank – AFG
• Crescent Textile Mills PVT LTD (CRESTEX) - PAK
• Pakistan Poverty Alleviation Fund (PPAF), Consecutive Years – PAK
• Pakistan Accumulators – Manufacturer of Volta & Osaka Batteries - PAK
• Pakistan Single Window (PSW, Customs) – PAK
• JingelCred Digital Finance Limited (JDFL) – China / PAK
• ZANDA Financials (Private) Limited – China / PAK
• LogiServe Pvt. Ltd – a subsidiary of SLG-Trax – PAK
• HLB Consulting Pakistan – ISO 27001 and SOC 2 Certification
• Manager Web: Developed and maintained the websites and social media accounts of all the entities in SBM Group including a Business School (3 campuses), an Accounting Firm and a Consulting Firm
• Developed and maintained Student Management Information System (SMIS) and an E-Campus (distant learning)
• Developed and maintained a Project Management Tool to support project execution for Accounting and Consulting firms

Bachelor of Science - Computer Science - COMSATS Institute of Information Technology (2002 - 2006)

Intermediate in Science - Computer Science - Rawalpindi College of Commerce (1999 - 2001)