Avinash Pathuri
Summary
Senior Lead Information Security Engineer with 12+ years of experience in Governance, Risk & Compliance (GRC), Security Architecture, Security Exception Management and Enterprise Network Security. Experienced in leading security governance, policy exception management, security risk assessments, and M&A security due diligence for global organizations. Passionate about advancing AI governance and security automation through standardized assessment methodologies, risk-driven decision making, and process transformation.
Overview
12
12
years of professional experience
1
1
Certification
Work History
Senior Lead Information Security Engineer
S&P Global
Hyderabad
07.2025 - Current
- Developed AI governance and risk assessment methodologies using STRIDE threat modeling and MAESTRO framework to evaluate AI-specific risks and standardize security assessments for secure adoption of AI solutions.
- Designed and developed an AI-assisted proof of concept (PoC) to automate M&A security risk assessments by generating consistent risk scores and recommendations, reducing manual effort and standardizing the evaluation process.
- Partnered with cross-functional teams, including infrastructure, cloud, network engineering, and application security, to provide security guidance and assess technology risks for secure business transformation initiatives.
- Led governance activities for network security controls, security policy exceptions, and architecture assessments to ensure consistent risk evaluation and compliance with enterprise security standards.
Lead Information Security Engineer
S&P Global
Hyderabad
07.2023 - 06.2025
- Led security assessments for enterprise infrastructure, network transformation, and cloud initiatives, ensuring technology implementations aligned with organizational security standards and risk management requirements.
- Delivered network security transformation initiatives, including firewall platform migrations, rule base optimization, policy cleanup, and security validation to improve operational efficiency and strengthen the enterprise security posture.
- Conducted security risk assessments for policy exceptions, evaluating control gaps and validating compensating controls to provide actionable risk-based recommendations for secure business operations.
- Facilitated security due diligence for mergers, acquisitions, and divestitures, reviewing technology integrations and assessing connectivity risks to ensure secure business transitions.
Senior Information Security Engineer
S&P Global
Hyderabad
08.2018 - 06.2023
- Assess security risks for policy exceptions by identifying control gaps, validating compensating controls, and delivering risk-based recommendations to facilitate secure business operations.
- Review firewall rules, proxy URL whitelisting, and network access requests via governance platforms like AlgoSec and Tufin, ensuring compliance with enterprise security standards and adherence to least-privilege principles.
- Developed and refined ServiceNow workflows, intake forms, and assessment processes, enhancing data quality, standardization, and operational efficiency in security governance.
Network Security Engineer
Wipro Technologies
01.2017 - 06.2018
- Designed and implemented Software-Defined Data Center (SDDC) security architecture using VMware NSX, enabling secure network segmentation and policy-driven controls.
- Configured NSX firewall rules to enable secure internet-facing access for critical payment applications (e.g., UPI, BHIM) and ensure controlled internal connectivity between application tiers, mitigating security risks.
- Developed low-level design (LLD) documentation for SDDC NSX architecture, outlining security zones, traffic flows, firewall policies, and integration points to enhance security posture.
- Created and maintained CIS-aligned golden images for Windows and Linux servers; remediated reported vulnerabilities and raised exception requests with InfoSec.
- Provisioned and managed Windows and Linux servers on VMware infrastructure, ensuring reliable support for production and non-production workloads.
Information Security Engineer
UBS Financial Services
06.2015 - 05.2016
- Developed Firewall Rule Lifecycle Management (FWRLM) processes to analyze, define, document, and track firewall rule changes, and alignment with security controls.
- Reviewed and validated firewall rule configurations for alignment with internal policies; remediated overly permissive rules in collaboration with firewall implementation teams.
- Documented firewall policy configurations to ensure clarity on rule intent, ownership, and approval for all global and local firewall rules.
- Conducted internet exposure investigations by identifying servers accessible from the internet, validating associated firewall rules, confirming business ownership, and documenting justifications in Tufin Secure Track per UBS governance requirements.
- Identified high-risk exposure scenarios for internet-facing servers lacking approved firewall rules; initiated and led remediation processes.
Network Security Engineer
Accenture
03.2014 - 05.2015
- Facilitated change management and vulnerability management processes, enhancing security posture and ensuring compliance across network infrastructure.
- Verified that firewall configurations and live traffic flows aligned with approved business requirements and security policies, ensuring compliance with organizational and regulatory standards.
- Managed firewall change requests with enterprise change management tools (BMC Remedy), supporting compliance reporting across a global network.
- Streamlined processes for firewall reviews, minimizing effort for future assessments and decreasing operational overhead.
Education
LLB - Cyber Law
Vinayaka Law College
Hyderabad05-2030
B.Tech - Computer Science
Kshatriya College of Engineering
Armoor09-2012
Skills
IBM Open Pages,
IRIUS Risk,
ADSA (Active Directory Security Assessment)
Infosec Policy Exception Assessment (Qualitative Risk Assessment)
SNOW
ADFS role management
Algosec (Orchestration and Automation of firewall rule reviews)
IRIUS Risk
SNOW
Infosec Policy Exception Assessment (Qualitative Risk Assessment))
Certification
CCNA
CEH V8
AWS Solutions Architect - Associate
- ALgosec ASMS Foundations Technical Training
- Algosec Certified AFA Configuration Expert
- GCP - Associate Cloud Engineer
- AZ-500
- AZ-104
- Certified AI Security Professional (Practical DevSecOps)
Accomplishments
- Recipient of the S&P Global CEO Circle of Excellence (1H 2026) – Deal of the Year Award for leading security governance and risk assessment contributions to the Global Mobility Divestiture Program.
- Active participant in leading security conferences (Nullcon, BlueHat, OWASP);
- Winner – BlueHat AppSec Village Competition, recognized for hands-on application security skills and practical vulnerability exploitation and analysis.
Timeline
Senior Lead Information Security Engineer
S&P Global
07.2025 - Current
Lead Information Security Engineer
S&P Global
07.2023 - 06.2025
Senior Information Security Engineer
S&P Global
08.2018 - 06.2023
Network Security Engineer
Wipro Technologies
01.2017 - 06.2018
Information Security Engineer
UBS Financial Services
06.2015 - 05.2016
Network Security Engineer
Accenture
03.2014 - 05.2015
LLB - Cyber Law
Vinayaka Law College
B.Tech - Computer Science
Kshatriya College of Engineering