Neha Bakshi

With over 14 years of experience in Governance, Risk, and Compliance (GRC), Risk management and Data Privacy , I bring strong expertise in technology risk oversight, third-party risk assessments, and Risk and Control Self-Assessments (RCSA). I have led cross-functional engagements to evaluate control design and effectiveness related to data security, system availability, and infrastructure integrity, with a credible challenge mindset.

My work includes executing structured, data-driven risk reviews and providing insights on technology and cybersecurity risks through exploratory analysis using SQL and Excel. I have actively contributed to strengthening oversight mechanisms by integrating control testing and issue tracking processes across second-line functions.

In addition, I have supported the development and review of Information Security/data privacy policies, conducted privacy impact assessments, and advised on compliance with evolving privacy regulations such as DPDPA , in collaboration with legal and IT teams.

• Certified Information Security Manager (CISM)
• Certified Data Privacy Solutions Engineer (CDPSE)
• Certified Payment Industry Security Implementor (CPISI – PCI DSS, ID-224046)
• Data Security Council of India Certified Privacy Professional (DCPP)
• Udemy Certifications: ISO 31000 -Operational Risk Management, Network Security, ISO27001:2022

• ISO 31000 - Risk Management
• Network Security
• Cloud Security
• Enterprise Risk Management
• Data Privacy
• Agile and Kanban
• ITIL Awareness
• AWS Cloud Practitioner
• Introduction to Agile
• Introduction to Analytics
• Insurance Domain
• Data Warehousing

• Lead and coordinate Risk and Control Self-Assessments (RCSA) across technology and business functions, providing credible challenge on control design and operational effectiveness related to data security, availability, and architecture.
• Perform comprehensive third-party risk assessments, including onboarding due diligence, RFP evaluations, and ongoing monitoring, ensuring vendor compliance with internal security standards and regulatory expectations.
• Drive cross-functional collaboration with Legal, IT, Information Security, Compliance, and Risk teams to assess, escalate, and remediate control gaps or emerging risks.
• Actively participate in working groups and governance committees, supporting structured decision-making, risk oversight, and policy alignment initiatives.
• Maintain and regularly update data protection, cybersecurity, and risk management policies and procedures to reflect changes in regulatory requirements and internal controls.
• Align business processes and operational practices with evolving regulatory mandates such as the Data Privacy Act of India (DPDPA, 2023), GDPR, UIDAI guidelines, and other applicable privacy and risk standards.
• Conduct Data Privacy Impact Assessments (DPIAs) for high-risk processes and systems.
• Manage and support internal and external IT audits, coordinate evidence collation, and drive mitigation of identified risks.
• Facilitate recurring meetings and stakeholder touchpoints, including issue resolution forums, stand-ups, and risk remediation planning sessions.