Most recent seventeen years of experience in Information Systems Audit, IT Security & Governance domains, within Banking, Finance, Health & IT Sectors in Sri Lanka. A demonstrable 27 years of overall working experience while the initial ten years into retail branch banking, credit and internal audit, with an audit exposure to treasury & international department functions. Serving at mid managerial levels on a steady career progression, participating in respective Steering Committees representing my domains, being a mentor and a leader towards my teams achieving targets while maintaining effective stakeholder relationships. Focused on further expanding my career exposure while adding immediate strategic value. Key expertise Enterprise Level Application Reviews - Systems including Core banking (AS 400 platforms), Card Payment System, Treasury, International trade & Finance, HRM, Internet Banking, SWIFT.IT General Control / IT Infrastructure Reviews – Physical and Environment Security, Logical access, Information classification, Data backup management, Windows Domain and Endpoint security, Firewall rule bases, vendor & service level agreements.Vulnerability Assessments - Initiating VA with third-party Computer Emergency Readiness Teams and monitoring implementation of recommendations.IT Governance & Compliance Reviews / IT Security policy development – ISO 27001 Framework implementation & carrying out reviews, Identification of IT Assets, Performing Risk Assessments, GAP analysis and Development of IT Security Policies.Business Continuity & Disaster Recovery – Planning and testing of critical IT environments for systems recovery and availability, with respective IT teams.Incident reporting – Analyzing root cause of IT incidents with respective IT operational staff & monitoring resolutions.Systems / Business Analysis – Systems pre & post implementation reviews, verifying functionalities and requirement gathering, embedding security controls into proposed system requirements, planning, and assisting UAT’s for user departments.Investigations - Providing systems and technical consultation on fraud investigations.Training and awareness on IT Security & user responsibilities to different layers of the organization, including to the corporate management.Familiarity with frameworks, guidelines & security standards - ISO 27001, 27005, 22301, 31000, COBIT-5, ITIL frameworks, HIPAA, PCI-DSS, FFIEC-guidelines, Data Privacy, GDPR and OWASP.Familiar with - Microsoft office packages, GRC tools, NAC, IPS & SIEM.