Summary

Overview

Work History

Education

Skills

Timeline

Language Known

Certification

Rishav Mishra

Senior Security Consultant

Bengaluru

Summary

As a Senior Security Analyst with 4 years and 11 months of experience in securing cloud systems, specializing in AWS,Azure security, log analysis, web application security testing, network scanning, and monitoring. Strong hands-on experience in conducting security assessments,risk assessments, compliance audits, and providing security recommendations to enhance infrastructure protection for financial clients.

Overview

years of professional experience

Certificates

Work History

Senior Consultant - Risk Advisory

Deloitte

03.2025 - Current

Conducted security compliance assessments for multiple financial clients, addressing key security domains to ensure adherence to regulatory and industry standards, such as PCI DSS and SEBI Cybersecurity Guidelines.
Managing the Azure CPSM tool to ensure the organization complies with CSPM standards and security frameworks.
Developed and managed policies in the Azure and AWS environments, depending upon client requirements.
Performed AWS cloud walkthroughs, identifying misconfigurations and non-compliant resources across multiple environments (prod, non-prod, dev), and provided actionable recommendations to enhance security posture.
Conducted security architecture reviews for financial institutions, identifying vulnerabilities, and providing mitigation strategies to strengthen security.
Evaluated the ServiceNow platform's security, focusing on incident and change management processes, and offered recommendations for improvement.
Conducted security assessments across five financial client engagements, using a customized AWS checklist for services like IAM, S3, CloudTrail, CloudWatch, GuardDuty, Security Hub, and others, tailored to each client's needs.
Analyzed AWS resources for misconfigurations and security risks, ensuring alignment with best practices (NIST, PCI DSS, AWS FSBP, etc.). Provided detailed reports with remediation steps to enhance security.
Worked directly at client locations to assess AWS security configurations. Utilized the customized checklist to ensure comprehensive reviews across critical services, improving overall security posture.

Senior Risk Analyst

Al Rajhi Bank(Deloitte-Onsite)

09.2024 - 03.2025

Supported the development of new business initiatives with comprehensive risk assessments and mitigation strategies.
Collaborated closely with stakeholders across different functions in order to obtain necessary information for detailed risk assessments.
Collaborated with cross-functional teams to identify, assess, and mitigate emerging risks in a timely manner.
Streamlined data collection processes for more efficient analysis, enabling faster identification of trends and potential issues.
Performed internal audits of security controls in the bank, ensuring that it complies with international security frameworks and standards.

Consultant Risk Advisory

Bank of New York Mellon(PwC)

Mumbai

05.2021 - 08.2024

Implemented robust security protocols, including VPCs, Security Groups, NACLs, and IAM policies, fortifying the AWS cloud infrastructure and enhancing data protection for over 100 clients.
Designed IAM and KMS key policies to ensure secure access control and data encryption, reducing the risk of unauthorized access.
Led active measures based on AWS GuardDuty findings, reducing risks by 30%, and enhancing overall project security.
Safeguarded company infrastructure by implementing and managing AWS WAF and AWS Shield, effectively mitigating multiple DDoS attacks, and maintaining uninterrupted service availability.
Contributed to the security automation scripts using AWS Lambda and EventBridge, enhancing the efficiency of security controls and response mechanisms.
Conducted investigations into GuardDuty findings, leveraging CloudTrail API activity to identify and analyze security incidents.
Conducted a third-party risk assessment for bank subcontractors in collaboration with stakeholders.
Successfully configured and managed rulesets to filter and inspect incoming and outgoing traffic using AWS Network Firewall Manager.
Proficient in AWS CloudWatch for monitoring and analysis of AWS resources, including setting up alarms, creating custom dashboards, and utilizing CloudWatch Logs for troubleshooting and performance optimization.
Securing critical data in S3 and DynamoDB by implementing encryption with KMS to ensure data loss prevention.
Managed and optimized AWS resources, including EC2 instances, S3 buckets, and Lambda functions, to achieve cost efficiency.
Configured PrismaCloud for AWS resource monitoring, ensuring compliance with industry standards and regulations.
Proficient in security frameworks and standards such as NIST, CIS, and AWS FSBP, with demonstrated experience in applying them to secure cloud environments, ensuring compliance, and adherence to industry best practices.
Developed and refined security documentation, policies, procedures, and guidelines, using the reference of the AWS Well-Architected Security pillar and AWS best practices for the Financial Services industry.
Deployed a static website with S3, CloudFront, Route 53, and ACM. And utilized the code pipeline for implementation.
Hands-on practice in Infrastructure as Code (IaC) service for managing AWS infrastructure with Terraform.
Responsible for container security best practices and securely stored container images using ECR, reducing potential security breaches.
Optimized application infrastructure by implementing an application load balancer for ECS containers, resulting in increased scalability and a reduced response time of 50% during high-traffic periods; enhanced user experience, and minimized service disruptions.
Managed secrets for Docker containers, including the configuration of AWS Secrets Manager to securely store and access sensitive environment variables, ensuring compliance with security best practices, and minimizing the risk of unauthorized access.
Patched critical updates via AWS Systems Manager, reducing system vulnerabilities by 40%, and enhancing network security.
Utilized AWS Inspector to conduct regular security scans, identifying and mitigating over 50 critical security misconfigurations, and preventing potential breaches.
Proficient in Docker, including experience writing Dockerfiles for containerized applications.
Demonstrated expertise in implementing best practices for CI/CD pipelines using AWS CodePipeline and AWS CodeBuild to automate the build, test, and deployment processes efficiently, and reliably.
Familiarity with Kubernetes architecture and management of Kubernetes clusters, highlighting a proven ability to seamlessly deploy and oversee containerized applications across various environments.
Good knowledge in writing Kubernetes Pod YAML files to define containerized applications, as well as BuildSpec YAML files to orchestrate build processes, ensuring seamless integration and deployment within Kubernetes environments and CI/CD pipelines.
Exposure to SAST and DAST tools like HCL AppScan, SonarQube, and OWASP ZAP.
Good knowledge of Continuous Integration/Continuous Delivery using modern DevOps tools such as Git, GitHub, and Jira.
Spearheaded efforts to achieve regulatory compliance in line with industry standards such as GDPR or PCI DSS.
Adhered to industry-standard PCI security protocol, processing purchases and transactions using theft prevention methods.
Ensured compliance with industry standards such as ISO 27001 or PCI-DSS through diligent adherence to guidelines during daily tasks.

Education

Bachelor's Degree - Electronics and Telecommunication Engineering

Kalinga Institute of Industrial Technology

Odisha

08-2021

Skills

Security Tools: Cloud-native security tools, Azure Defender for Cloud, Security Hub, Nmap, Wireshark, Metasploit, Burpsuite, Qradar

Monitoring Tools: CloudWatch, CloudTrail, DataDog, Service Now

Compliance and Security Standards: ISO 27001, PCI DSS, OWASP Top 10, NIST SP 800-53

Scripting: Python, PowerShell

Network Protocols: IP, DNS, DHCP, HTTP, HTTPS, SSL/TLS, TCP

Penetration testing, VAPT, Threat Hunting

Business Communications

Strategic Planning

Project Management

Risk Management

Troubleshooting