Mehul Nikumbh

Executed 1LOD Third-Party Risk Management (TPRM) reviews on 6+ SaaS vendors, evaluating SOC 2 reports, OAuth scopes, SSO/MFA, and IAM against vendor risk criteria; documented Complementary User Entity Controls (CUECs), compensating controls, and evidence obligations for vendor owners. Performed 1LOD ITGC control testing on firewall, SIEM, and endpoint configurations against CIS Benchmarks and internal baselines; validated control evidence and effectiveness, cataloged 12 control gaps with severity ratings, control owners, remediation timelines, and risk acceptance status. Coordinated IT security communications for stakeholders on control gaps, remediation status, and evolving risk trends; translated technical findings into audit and regulatory evidence packages for internal reviewers.

GRC / Cybersecurity Analyst Intern - The Cheesecake Factory

(2025-06 - 2025-08)

• Executed 1LOD Third-Party Risk Management (TPRM) reviews on 6+ SaaS vendors, evaluating SOC 2 reports, OAuth scopes, SSO/MFA, and IAM against vendor risk criteria; documented Complementary User Entity Controls (CUECs), compensating controls, and evidence obligations for vendor owners.
• Performed 1LOD ITGC control testing on firewall, SIEM, and endpoint configurations against CIS Benchmarks and internal baselines; validated control evidence and effectiveness, cataloged 12 control gaps with severity ratings, control owners, remediation timelines, and risk acceptance status.
• Coordinated IT security communications for stakeholders on control gaps, remediation status, and evolving risk trends; translated technical findings into audit and regulatory evidence packages for internal reviewers.
• Executed an end-to-end phishing simulation across departments and analyzed user-reported emails; generated KRIs from click-through trends, report rates, and response gaps.

Security Analyst - VESIT (University of Mumbai)

(2023-05 - 2024-08)

• Performed security risk assessments and control gap reviews across applications, systems, and processes mapped to NIST CSF, ISO 27001, and CIS Controls; documented findings with risk ratings and owners.
• Maintained ITGC control-evidence completeness and accuracy across a 200+ endpoint asset inventory using Wazuh SIEM and Windows Event Logs, collecting access reports, configuration exports, and policy documents on a quarterly audit-readiness cycle.
• Evaluated vulnerability reports, using OpenVAS and Nmap to support evidence collection, and validated findings against CIS Benchmarks.
• Conducted Vendor SOC 2 and ISO 27001 certification reviews, evaluating Complementary User Entity Controls (CUECs) and vendor risk posture; managed annual renewal and follow-up requirements in partnership with vendor owners.
• Tested IAM ITGC controls (privileged access, provisioning/de-provisioning, terminated-user review) and maintained the 1LOD risk register and risk acceptance documentation with likelihood/impact ratings, control owners, and remediation status.

Security Operations Analyst - Telenetworks Technologies

(2022-12 - 2023-05)

• Reviewed baseline configurations for 25+ systems against ITGC and CIS/NIST hardening standards; cataloged 8 deviations with risk impact, assigned owners, and target remediation dates.
• Examined 200+ security event logs across endpoint and network to identify control deviations and evidence requiring follow-up.
• Maintained remediation trackers for configuration anomalies, open findings, and control gaps; reduced unresolved findings by 35%.
• Prepared audit and regulatory evidence packages for 4 compliance assessments (configuration exports, access logs, control test results, and closure documentation) supporting external auditor and regulator information requests.

Master of Science - Information Systems (Cybersecurity) - California State University, Long Beach (2024-08 - 2026-05)

Bachelor of Engineering - Electronics (Honors: Cybersecurity) - University of Mumbai (2020-02 - 2024-05)