PRAKRITI SONI
Associate Director - Internal Audit
Gurugram,HR
Summary
Information Security, Internal Audit and GRC professional with 12+ years of experience across information security audits, technology risk and control testing, third-party risk management (TPRM), privacy compliance and security governance. Experienced in building TPRM programmes, leading risk assessments, evaluating control design and operating effectiveness, supporting ISO 27001 implementation, and coordinating SOC 1 and SOC 2 audits. Skilled in engaging senior stakeholders, translating regulatory and contractual requirements into practical controls, identifying control gaps, and driving remediation. CISA and CRISC certified, with ISO 27001 and ISO/IEC 27701 credentials.
Overview
13
13
years of professional experience
5
5
Certifications
Work History
Associate Director - Internal Audit
Marsh
09.2025 - Current
- Drive ISO 27001:2022 implementation across the organization, including policy mapping, development of the Statement of Applicability (SoA), and coordination with cross-functional stakeholders to support certification within defined timelines.
- Strengthen the information security control environment by monitoring alignment with applicable industry regulations, internal policies and organizational security standards, and supporting risk mitigation.
- Lead audit management and stakeholder coordination for SOC 1 Type 1 and SOC 2 Type 2 engagements, facilitating audit planning, evidence coordination and execution.
Associate Manager Information Security
Accenture Solutions
03.2022 - 09.2025
- Performed international, on-site third-party risk assessments for a critical U.S.-based vendor, including stakeholder interviews, evidence validation, site walkthroughs, risk analysis, and assessment reporting.
- Led end-to-end testing of Design (ToD) and Test of Effectiveness (ToE) for controls across high-risk technology processes supporting UK and European clients; developed test procedures, documented results, and escalated control deficiencies.
- Built and implemented a Third-Party Risk Management (TPRM) programme for a US-based client, developing the TPRM policy, standard operating procedures (SOPs), Risk Assessment Questionnaires and conducting pilot assessments.
- Drove automation of third-party risk assessments for a European client by defining the automation approach, translating assessment requirements into control logic and partnering with engineering teams.
- Led a management information (MI) team conducting risk analysis, root cause analysis and trend forecasting; developed Power BI dashboards and presented key control indicators (KCIs) and key performance indicators (KPIs) to support monitoring and leadership decisions.
MANAGER INFORMATION SECURITY
Publicis Groupe
Gurugram, Haryana
12.2018 - 03.2022
- Managed information security risk assessments for internal business accounts and third-party vendors, including cloud service environments across SaaS, IaaS and PaaS.
- Assessed vendor security controls against contractual requirements and recognized standards, including ISO 27001, HITRUST, PCI DSS and HIPAA; identified control gaps, evaluated residual risk and recommended risk treatment actions.
- Partnered with process owners and control stakeholders to communicate remediation plans and track issue closure through governance workflows and GRC platforms.
- Documented assessment outcomes and evaluated alignment with regulatory obligations, organizational security requirements while defining risk tolerance.
SR. SECURITY ANALYST
Accenture Solutions
01.2016 - 11.2018
- Served as Account Information Security Lead (AISL) for a European client, supporting GDPR compliance and the implementation and effectiveness of Technical and Organizational Measures (TOMs).
- Conducted Privacy Impact Assessments (PIAs), evaluated project-level privacy requirements and advised stakeholders on the design and implementation of privacy controls.
- Developed information security policies, procedures and standards for an Australian client, aligning documentation with ISO 27001, industry practices and client-specific risk requirements.
INFORMATION SECURITY ANALYST
Tech Mahindra Ltd.
04.2014 - 01.2016
- Conducted information security audits and facilitated external audits to assess compliance with organizational policies, procedures, control frameworks and ISO 27001 requirements.
- Supported Business Continuity Planning (BCP) site outage activities and information security incident management, collaborating with cross-functional teams on root cause analysis and corrective actions.
- Delivered information security awareness sessions for Project Managers and Delivery Heads, prepared monthly compliance reports, and supported RFP responses.
- Reviewed client contracts, Master Service Agreements (MSAs) and Statements of Work (SOWs) to identify security and compliance gaps and recommend appropriate actions.
Education
MBA - Information Security
Symbiosis Centre For Information Technology
Pune, India03.2014
Bachelor of Science - Information Technology
ACET Baru Sahib
Solan, India05.2011
12th - Science
St. Luke's Sr. Secondary School
Solan, India03.2007
10th - Science
St. Mary's Convent School
Kasauli, India03.2005
Skills
Information Security Audit & Assurance
IT Risk Management
Governance Risk & Compliance
Third Party Risk Management
Vendor/Supplier Risk Assessments
ITGC Compliance
ISO 27001 Implementation
SOC 1 & SOC 2 Audits
ISO 27701 (PIMS)
Privacy Impact Assessments
Security Governance & Policies Development
Stakeholder Management
Certification
CISA (Certified Information Systems Auditor) Certified
Timeline
Associate Director - Internal Audit
Marsh
09.2025 - Current
Associate Manager Information Security
Accenture Solutions
03.2022 - 09.2025
MANAGER INFORMATION SECURITY
Publicis Groupe
12.2018 - 03.2022
SR. SECURITY ANALYST
Accenture Solutions
01.2016 - 11.2018
INFORMATION SECURITY ANALYST
Tech Mahindra Ltd.
04.2014 - 01.2016
Bachelor of Science - Information Technology
ACET Baru Sahib
12th - Science
St. Luke's Sr. Secondary School
10th - Science
St. Mary's Convent School
MBA - Information Security
Symbiosis Centre For Information Technology