Varun S. Email & Phone Number

SAN Francisco, CA, US

• Provided strategic vision and led a team of analysts responsible for managing IT risk across the company
• Developed and implemented an enterprise security strategy and framework based on industry standards like NIST CSF, CIS Critical Controls and ISO 2700x to manage cybersecurity-related risk
• Executed assessments against the framework across the IT footprint to set a baseline and develop a maturity roadmap. Presented the results to executive leadership in a non-technical language while correlating technical.
• Established operating policies, procedures and technical security controls which are adequate and appropriate to support the needs of the business while ensuring regulatory compliance
• Used business cases to enlist, educate, engage, and align executive stakeholders to security initiatives and highlight their business value.
• Assisted the Business Development team with meetings, information security questionnaires and RFIs during due diligence process by investors and partners to get new business/investments

Worldwide, OO

• Managed risk assessments, operational process reviews and review of system implementations, applications, and other IT-related risk areas utilizing on-site and offshore resources
• Worked with management and users to identify the business impact of findings, conclude on findings, make practical recommendations, and help prioritize the mitigation efforts
• Served as an integral part of the PMO team to manage the project financials, prepare weekly metrics, management dashboards, program status reports etc.
• Actively participated in eminence building activities and proposal development for prospective engagements
• Worked for Fortune 100 clients in financial services and technology industriesIndustries served:- Financial Services- Technology and Media- Government- Healthcare

Overland Park, KS, US

• Executed over 35 web application security assessments, penetration tests, architecture reviews, and threat modeling
• Engagement activities included - identifying weaknesses and vulnerabilities, creating formal written reports, and presenting findings and remediation advice to client executives and technical staff
• Contributed to internal Fishnet knowledgebase including the development of training material, methods, and tools
• Assisted in project scoping and proposal development for prospective engagements
• Frequently used tools: IBM AppScan, WebInspect, Burp Suite, Nessus, Qualys, Rapid7 NexPose, Metasploit etc.

Cambridge, MA, US

• Changed the 3rd party vendor risk assessment process to improve its performance by 60%
• Performed several security risk assessments in collaboration with senior security engineers
• Communicated with business owners and vendors for information gathering and advise them on ways to mitigate potential risks
• Prepared a Traceability Matrix in support of Payment Card Industry – Data Security Standard certification

Master Of Science, Information Security

Bachelors, Information Technology

Education record