Muhammad Emal Khan Email & Phone Number

United Kingdom

United Kingdom

London, England, United Kingdom

Adding to my responsibilities I had been moved to the UK to cater to the UK and EU regional needs to meet the information security and compliance gaps.

Lahore, Punjab, Pakistan

As a member of the information security leadership team, I led the development and implementation of a robust 'Afiniti Securiti' program that covered all aspects of information security, privacy, and GRC and its related practices aligning security policies with the company's strategic objectives.Partnered with inter-company teams spread across 5 continents and 14 countries to ensure the information security policies are properly implemented to safeguard client and company data, as well as… Show more As a member of the information security leadership team, I led the development and implementation of a robust 'Afiniti Securiti' program that covered all aspects of information security, privacy, and GRC and its related practices aligning security policies with the company's strategic objectives.Partnered with inter-company teams spread across 5 continents and 14 countries to ensure the information security policies are properly implemented to safeguard client and company data, as well as ensuring internal processes and adherence to global standards. I also spearheaded the development and delivery of a security awareness and training program entitled 'Human Firewall', fostering a culture of security throughout the organization.- Lead the development and implementation of information security policies and procedures for compliance with ISO 27001, PCI DSS, SOC 2 Type 2, HITRUST, NIST, CMMC, and other regulatory standards.- Developed holistic models for assurance and compliance with the company’s Information Security and Certifications programs. - Conducted gap analysis, ISO 27001, ISO 27701, PCI DSS audits, and SOC 2 Assessments. Prepared the teams for external audits.- Administered internal and external vulnerability assessment, ASV, and penetration testing of the production environment, with the associated remediation efforts. - Supported the business continuity, and disaster management programs to ensure the resilience and continuity of critical business operations.- Drove the implementation of Afiniti's comprehensive information security and privacy awareness & training program to promote a culture of security.- Maintain the Cyber Security Event Response Procedure (CSERP) to proactively detect and respond to security events systematically.- Oversight and governance of the internal client assurance audit program using control self-assessment principles.- Interact directly with clients to support and meet their information security requirements. Show less

Managing and administering information security and compliance practices in Systems Limited and Visionet Systems Inc. globally. Working with the global team to ensure successful information security practices implementation. Performing internal compliance functions on ISO 27001, PCI DSS, SSAE 16, and Information Security Guidelines.Responsibilities:• Leading with the implementation of information security policies and procedures for compliance with ISO 27001 security standards, PCI DSS… Show more Managing and administering information security and compliance practices in Systems Limited and Visionet Systems Inc. globally. Working with the global team to ensure successful information security practices implementation. Performing internal compliance functions on ISO 27001, PCI DSS, SSAE 16, and Information Security Guidelines.Responsibilities:• Leading with the implementation of information security policies and procedures for compliance with ISO 27001 security standards, PCI DSS Standards, and other regulatory standards and guidelines• Conducted internal SSAE 16, ISO 27001, and PCI DSS audit • Working in the development of a holistic approach to all compliance standards such as ISO 27001, PCI DSS, SSAE 16, and ISO 9001 & CMMi.• Ensure compliance with service industry standard of SSAE 16 (aka SAS 70)• Performing with vulnerability assessment and management of the internal company environment • Govern risk management program• Performed risk assessments of OT and industrial control systems, identifying vulnerabilities in ICS protocols, hardware, networking and applications. Aligned assessment methodologies to IEC 62443 and NIST SP 800-82 standards.• Oversee the company’s security awareness training program• Work with clients on projects ranging from risk analysis/management, vulnerability management, security policy documentation, ISMS & BCMS Consultancy, etc.• Experienced with software licensing & provisioning mechanisms. Show less

Implementation and overlooking of information security practices in TRG/ IBEX globally. Work closely with the global team to ensure the effectiveness of TRG/ IBEX Global’s information security program. Performing training on ISO 27001, PCI DSS, and Information Security Guidelines.Responsibilities:• Leading with the implementation of information security policies and procedures for compliance with ISO 27001 security standards, PCI DSS Standards, and other regulatory standards and… Show more Implementation and overlooking of information security practices in TRG/ IBEX globally. Work closely with the global team to ensure the effectiveness of TRG/ IBEX Global’s information security program. Performing training on ISO 27001, PCI DSS, and Information Security Guidelines.Responsibilities:• Leading with the implementation of information security policies and procedures for compliance with ISO 27001 security standards, PCI DSS Standards, and other regulatory standards and guidelines• Conducted internal PCI DSS and ISO 27001 audit for all TRG global sites which involves frequent travels to the USA, Philippines, and other global sites. • Worked in the development of PCI Compliant applications.• Initiation of service industry standard of SSAE 16 (aka SAS 70) and US Safe Harbor laws• Performing with vulnerability management of the company environment • Participate in risk analysis and management, also maintain a risk metrics program• Enforcing company policies and reporting to management when necessary for corrective action to be taken• Participate in the company’s security awareness training program• Review and analyze audit logs from systems, network devices, anti-malware, applications, and IDS\IPS systems, and report findings to management. Report on levels of risk from the findings.• Work with clients of TRG on various projects ranging from risk analysis/management, vulnerability management, security policy documentation, etc.• Experienced with software licensing mechanisms. Key contributions:• Helped TRG/ IBEX Global successfully certify with PCI Certification• Worked with PCI QSA on compliance with the TRG/ IBEX Global PCI Certification in US & PHI sites• Worked with PCI QSA Penetration Testing teams for PCI DSS Compliance requirements• Implementation and compliance of HIPAA/ HITECH Show less

Mcb House

Implementing information security strategy and addressing compliance with regulatory bodies, PCI-DSS, ISO 27001, BASEL II EFT guidelines, SBP (Central Bank of Pakistan) information security policies , standards and guidelines implementation, internal and external audit findings analysis and remediation.Responsibilities: • Monitoring compliance with the organization’s information security policies, procedures, standards and guidelines among employees, contractors, alliances, and other… Show more Implementing information security strategy and addressing compliance with regulatory bodies, PCI-DSS, ISO 27001, BASEL II EFT guidelines, SBP (Central Bank of Pakistan) information security policies , standards and guidelines implementation, internal and external audit findings analysis and remediation.Responsibilities: • Monitoring compliance with the organization’s information security policies, procedures, standards and guidelines among employees, contractors, alliances, and other third parties to refer and escalate the non- conformances to appropriate management.• Providing written reports on all issues regarding non-compliance to information security policies and procedures.• Providing expert security involvement in the lifecycle of business and infrastructure projects including architecture reviews, application design, penetration testing and vulnerability scanning.• Assisting in maintaining frameworks for security risk management, disaster recovery and business continuity.• Execution of information security risk assessments and C.S.A (control self-assessment) as an internal assessor for information security processes.• Managing bank wide third party IT Security Audits/Assessments with Big Four audit firms. Show less

Major Role in definition, documentation, implementation, training of policies & procedure and requirements for the security standard. Actively working to establish organization-wide security standards (Payment Card Industry, ISO 27001, SAS No.70). Responsibilities:• Developing a comprehensive security program to establish Information Security • Assist in IT Security Strategy development and implementation• Formulation and implementation of information security policies… Show more Major Role in definition, documentation, implementation, training of policies & procedure and requirements for the security standard. Actively working to establish organization-wide security standards (Payment Card Industry, ISO 27001, SAS No.70). Responsibilities:• Developing a comprehensive security program to establish Information Security • Assist in IT Security Strategy development and implementation• Formulation and implementation of information security policies, standards, procedures, and guidelines• Actively working on implementation and roll out of enterprise wide vulnerability management, Antivirus, Antispyware• Evaluate the IT security risk that the organization is exposed to and develops strategies based on OCTAVE to minimize the risk• Plan and perform information systems audits, network security and physical security audits.• Perform technical security assessment of core applications• Facilitate in code security reviews, application and network vulnerability scans and penetration tests• Actively involved with network and application controls, security incident management• Liaison with internal & external auditors, Qualified Security Assessor and Approved Scanning Vendor• Assist in planning information security awareness program by utilizing different awareness channels such as portal, trainings, workshops, emails, etc.• Coordinate with vendors for product updates and new product evaluation for system updates and future expansion plans• Member of the InfoSec Process Group (ISPG)Key contributions:• Primary team member in implementation of ISO 27001 certification for 3 years• Key player in implementation and compliance of PCI DSS for 4 years• SAS 70 Type 1 Certifications • Team lead for Disaster Recovery and Business Continuity Planning & its testing Show less

Played major part in CMMI (Capability Maturity Model Integrated (CMMI) v 1.2 Level 2) based process definition, documentation, implementation, training and institutionalization of processesResponsibilities:• Performed process Internal Auditing, monitoring of software processes and work products• Have performed software quality control and testing activities• Implementation assistance and training of US Policy & Regulations such as Anti Money Laundering (AML) activity… Show more Played major part in CMMI (Capability Maturity Model Integrated (CMMI) v 1.2 Level 2) based process definition, documentation, implementation, training and institutionalization of processesResponsibilities:• Performed process Internal Auditing, monitoring of software processes and work products• Have performed software quality control and testing activities• Implementation assistance and training of US Policy & Regulations such as Anti Money Laundering (AML) activity, Regulation-P based on the Gramm-Leach-Bliley Act 1999 and Regulation-E based on the Electronic Funds Transfer• Member of Software Engineering Process Group (SEPG)Key contributions:• Acted as the On-site Coordinator for the SCAMPI class A appraisal and as appraisal team member(ATM) in SCAMPI class B & C appraisals• Automation of Business Processes using JBPM (JBoss Business Process Management)• Initiative taken with the HR Team in Documentation and implementation of Level 2 Process Area People Capability Maturity Model for Level 2 Process Area Show less

Masters Business Administration, Management Information Systems

Bachelor In Computer Science (Honuors), Software Engineering

Intermediate, Pre-Engineering

O Level, Igcse

Ibm Guardium Technical Enablement

Education record

Iso 27001 Lead Auditor