Dhriti Gupta

AI solutions for third-party risk management

• Product Owner for six cyber and TPRM products, owning the full build from UI design and Python/Java services to PostgreSQL data models and policy documentation.
• Architected from scratch a GenAI-augmented TPRM tool using retrieval-augmented generation (RAG) and agentic workflows in LangChain, adding critical features of OSINT to trace open source CVEs and Threats Resolve Nth party,Concentration risk and Threat management Issue. The tool will Chalk out and resolve the major Supply chain problem.

AI solutions for cyber security

• Delivered four end-to-end proofs of concept for Markets: a technology and cyber risk scorecard, a capability mapping engine, cyber resilience analytics and a cyber stress-testing tool covering bank wide applications and also sourcing threat from OSINT and used Agentic workflows to streamline it.
• Authored three white papers on cyber security, recognised at board level alongside the proofs of concept.
• Stood up the cyber security and TPRM domains from scratch, defining security posture, risk posture and control baselines, with AI governance aligned to ISO/IEC 42001.

OCC regulatory data governance

• Architected an data governance operating model for the second line of defence, covering data risk, TPRM, business continuity and disaster recovery and technology and cyber risk for OCC requirement.
• Decomposed artefacts across 33+ upstream systems using enterprise metadata repositories (Collibra, MetaManager) to extract data dictionaries, schema mappings and interface contracts.
• Defined logical to physical data models and system of record mappings for end to end traceability in Technology and Cyber Operational Risk (TCCORO).
• Engineered automated lineage pipelines using ETL metadata harvesting (Informatica), with rule-based data quality thresholds and lineage visualisation dashboards.
• Orchestrated multi-stage data syndication and OCC closure workflows, with evidence-driven validation and control sign-off for TCCORO and the Technology Risk Scorecard (TRS).
• Governed SIT, DIT and UAT for critical releases, assuring test coverage and production readiness.

• Control framework architecture: Designed the intra-group sourcing control framework across TDI. Mapped vendor and service controls to NIST CSF functions, NIST SP 800-53 control families, ISO 27001 Annex A, COBIT, ITIL service management and PCI DSS requirements. Defined KRIs/KPIs, RACI and service delivery controls for the CFT division.
• ITGC and application controls testing: Led SOX IT control testing (test of design, test of operating effectiveness, data extraction and analysis) across ITGC domains: logical access, change management, computer operations and backup/recovery. Also tested automated application controls (ITAC). Ran RCSA cycles, escalated control deficiencies to the CTO, and drove ECB, PRA and RBI remediation with second-line controllers.
• IT audit coverage: Ran end-to-end audits across cyber security, network security, cloud controls, BC/DR, ITGC and application controls. Covered evidence collection, sampling, gap analysis and remediation tracking through to closure.
• Vendor security controls (IAM and data protection): Implemented GLBA, DORA, GDPR and PCI DSS control requirements for third parties, including IAM and MFA enforcement, access reviews, information security questionnaires, residual risk calculation, and remediation and exit plans. Orchestrated workflows across Archer (GRC), ServiceNow, Coupa and Ariba.
• Application security and entitlements: Governed SDLC security gates and entitlement controls for 450 applications across their full lifecycle, from production onboarding to decommissioning. Owned incident management plans with IT application owners, supported L2/L3 production issues, and introduced chatbot automation for support workflows.
• DORA and outsourcing compliance: Assessed ICT outsourcing materiality and local regulatory requirements across 40 countries, including MAS, HKMA and IFSC GIFT City. Aligned vendor contracts to TPRM, ERM and non-financial risk frameworks.
• Technical delivery: Engagement Manager for 16 projects and 3 products covering IT delivery, cyber assessment, country compliance and cloud services. Tracked test effort against budget and quality-reviewed the non-financial risk framework for operational resilience and information security.

• TPRM operations: Operationalised the TPRM framework for APAC and EMEA, issuing and assessing DDQs and IRQs across operational risk, operational resilience, business continuity, information security, ABAC and tax evasion controls; tailored questionnaires to each engagement and produced executive summaries.
• Assurance evidence review: Verified SOC 2 Type 2, ISAE 3000/3402 and ISO 27001 reports against control frameworks, and validated vendor incident response, business continuity and resilience plans as part of each assessment.
• Risk domain coverage: Assessed vendors across all third-party risk domains, including cyber, resilience (physical, information, transaction processing), financial crime (ABC, AML, sanctions, fraud), legal, model, financial viability, ESG and geopolitical risk.
• Residual risk and remediation: Reviewed residual risk questionnaires and validated engagement classification against the TPM process, updating pre-assessments and IRQs when triggered; coordinated remediation between third parties, SROs and internal teams.
• IT SOX audit: Planned and scoped IT SOX audits, defining key controls, test plans and testing methodology; reported control testing results with actionable recommendations.
• Tooling, QA and training: Tested Archer system enhancements and took part in UAT; ran quality checks on vendor processes with periodic performance metrics for stakeholders; wrote SOPs and FAQs and trained staff on TPRM onboarding and risk assessment.

• Third-party cyber risk programme: Owned the third-party information security risk programme within the CISO’s end-to-end cyber risk lifecycle, covering contractual security clauses, KPI thresholds and governance actions; supported the threat management lead on practice strategy.
• TPRM framework and tiering: Developed and implemented the TPRM framework, policies and procedures to meet regulatory requirements; tiered third parties by inherent risk and defined assessment methodologies, criteria and ongoing KPI-based monitoring of internal IT vendors.
• Security control assessment: Built vendor questionnaires on ISO 27001, NIST and PCI DSS; ran cyber, cloud and application security risk assessments and IT vendor due diligence covering security controls, compliance posture and financial viability.
• Second-line IT resilience: Managed IT resilience for the bank’s internal functions as second line of defence, contributing to the design of new and redesigned processes, risk control objectives and control testing.
• Audit and compliance: Handled internal, operational and RBI audits, including report drafting and mandatory compliance, reducing compliance errors from 30% to 2%.
• Client due diligence and payments operations: Performed KYC and beneficial ownership checks (MOA, AOA, board resolutions, ROC and INC-20A verification) across listed companies, SPVs, co-operatives, foundations and funds; oversaw SWIFT remittances, nostro and suspense account reconciliation, and LEA and tax notices.

• Third-party risk: Governed third-party management policies and processes end to end. Coordinated third-party reviews and ran due diligence on external vendors, scaled to the services each provided.
• Vendor onboarding and assessment: Managed client and vendor onboarding, and led operational risk and security assessments where new technology integrations were required.
• Third-party incident management: Led incident response with third parties and internal teams. Drove root-cause analysis and corrective actions for breaches and incidents, and convened stakeholders to prevent recurrence.
• Business continuity: Performed application criticality assessments and business impact analyses, and prepared BCP plans for critical applications.
• Information security: Helped design and implement an ISMS aligned to ISO 27001, and monitored security controls protecting data, systems, applications and networks. Ran Qualys verification scans to confirm vulnerability remediation.

• Verify the closure of audit issues and recover the same as well.
• Highly skilled in researching issues and finding solution and best alternatives to tax issues.
• Journal posting, balance sheet and trail check and taxation