SANA PARVEEN
Hyderabad,Telangana
Summary
Audit and compliance professional specializing in ISO 27001, Swift CSP, and COSO, with expertise in network security audits and cybersecurity GRC. Developed policies, managed external auditors, and ensured compliance for international clients. Delivered risk mitigation and strengthened governance frameworks across multinational organizations in BFSI, IT services, and telecom.
Overview
1
1
Certification
10
10
years of professional experience
Work History
Senior Associate- Consultant Lead Auditor ISO and Cyber Security GRC
Coforge LTD.
03.2025 - Current
- Led ISO 27001 audits for global banking & telecom clients.
- Managed ISO 9001 & 27001 audits for Fortune 500 clients.
- Conducted SWIFT CSP audits for banking customers, validating controls against SWIFT mandatory requirements.
- Delivered audit reports to executive leadership across Europe & North America.
- Lead internal and external audits, including SWIFT compliance reviews, COSO framework assessments, and regulatory audits.
- Coordinated third-party audits such as Zero Trust assessments, ensuring adherence to industry best practices and regulatory requirements.
- Developed compliance dashboards and mentored junior auditors, enhancing team skill sets and improving audit accuracy.
- Improved audit turnaround time by 30% through streamlined documentation.
- Reduced non-conformities by 25% via proactive compliance strategies.
- Strengthened audit readiness by implementing control testing, evidence collection, and remediation tracking processes.
- Designed risk mitigation strategies and trained teams on compliance.
- Developed and implemented governance frameworks to enhance organizational compliance.
- Spearheaded continuous process improvements by developing and maintaining cybersecurity governance policies, procedures, and documentation to strengthen the organizational compliance posture.
- Established standardized frameworks for vulnerability management, patch management, and user access reviews to strengthen organizational security posture.
- Implemented governance controls for Microsoft Defender onboarding and Sentinel log management, ensuring compliance with enterprise monitoring standards.
- Conducted comprehensive risk assessments to identify, evaluate, and prioritize cybersecurity risks across systems and processes.
- Partnered with technical teams to drive risk mitigation strategies, facilitate risk acceptance decisions, and ensure timely remediation.
- Delivered clear and actionable risk reporting to senior stakeholders, enabling informed decision-making and alignment with business objectives.
- Acted as a trusted advisor to cross-functional teams, bridging governance requirements with technical execution.
- Presented risk findings, audit outcomes, and compliance metrics to executive leadership and external auditors.
- Collaborated with business units to embed GRC principles into operational workflows, fostering a culture of compliance and accountability.
- Led ISO 27001 certification audits for Banking clients, ensuring compliance with information security standards
- Reduced audit findings through proactive control implementation and continuous monitoring.
- Streamlined vulnerability management lifecycle, reducing remediation timelines and increasing response efficiency.
- Enhanced compliance maturity by aligning cybersecurity governance with industry frameworks (ISO 27001, NIST, COSO, SWIFT and SOC 2).
- Managed Cybersecurity GRC programs, aligning risk management with ISO and regulatory frameworks.
- Drafted and implemented policies and procedures for ITIL service management and ISO 20000 compliance
- Customer: IsDB (Islamic Development Bank)
- Managed Cybersecurity GRC programs, aligning risk management with ISO and regulatory frameworks.
- Drafted and implemented policies and procedures for ITIL service management and ISO 20000 compliance
- Customer: IsDB (Islamic Development Bank)
Information Security Lead
SAT Microsystems
10.2022 - 03.2025
- Conducted risk assessments to identify vulnerabilities using tools like Nessus & Defender and established controls to mitigate risks effectively.
- Identified and mitigated critical risks, reducing the organization's overall risk exposure.
- Delivered detailed risk assessment reports to senior leadership with actionable insights and recommendations, enhancing strategic security decisions.
- Collaborated with stakeholders to define and document risk mitigation plans, reducing Critical & high-priority risks by 100%.
- Achieved 100% compliance during external audits by maintaining a comprehensive and up-to-date risk register.
- Developed and implemented comprehensive information security policies and procedures aligned with industry standards (e.g., ISO 27001, NIST).
- Collaborated with cross-functional teams to create access management policies, while ensuring least-privilege principles across all systems.
- Established a role-based access control (RBAC) model, streamlining user provisioning and minimizing excessive access rights.
- Conducted periodic access reviews for critical systems and applications to validate appropriate user access levels, reducing unauthorized access risks by 100%.
- Automated access review workflows using SailPoint, streamlining review processes for faster and more accurate access validation.
- Provided actionable reports and dashboards to leadership, showcasing progress, trends, and compliance status for access reviews.
- Partnered with third-party vendors for risk assessments of external systems, ensuring compliance with organizational security standards.
- Reported on key performance indicators (KPIs) such as incident response times, vulnerability management status, compliance adherence, and risk mitigation progress.
- Provided actionable recommendations during stakeholder meetings to address security gaps and improve the organization's security posture.
Senior Specialist
HCL Technologies
06.2020 - 10.2022
- Conducted risk assessments to identify vulnerabilities using tools like Nessus & Defender and established controls to mitigate risks effectively.
- Conducted comprehensive risk assessments for IT systems, applications, and business processes to identify vulnerabilities and evaluate potential impacts.
- Identified and mitigated critical risks, reducing the organization's overall risk exposure.
- Collaborated with stakeholders to define and document risk mitigation plans, reducing Critical & high-priority risks by 100%.
- Delivered detailed risk assessment reports to senior leadership, highlighting actionable insights and recommendations to enhance decision-making.
- Achieved 100% compliance during external audits by maintaining a comprehensive and up-to-date risk register.
- Developed and implemented comprehensive information security policies and procedures aligned with industry standards (e.g., ISO 27001, NIST).
- Collaborated with cross-functional teams to create access management policies, while ensuring least-privilege principles across all systems.
- Established a role-based access control (RBAC) model, streamlining user provisioning and minimizing excessive access rights.
- Conducted periodic access reviews for critical systems and applications to validate user access levels, ensuring a 100% reduction in unauthorized access risk.
- Automated access review workflows using SailPoint improving review efficiency.
- Provided actionable reports and dashboards to leadership, showcasing progress, trends, and compliance status for access reviews.
- Partnered with third-party vendors for risk assessments of external systems, ensuring compliance with organizational security standards.
- Provided actionable recommendations during stakeholder meetings to address security gaps and improve the organization's security posture.
Process Developer L2
Genpact
09.2018 - 12.2019
- Collaborated with the team to collect data on vulnerabilities, risks, and security controls, organizing and presenting it clearly to stakeholders.
- Supported the preparation of weekly and monthly reports on key information security activities, including system updates, security incidents, and compliance checks.
- Documented updates on incident management and risk assessment, ensuring reports maintained accuracy and clarity for stakeholders.
- Participated in team meetings with stakeholders to understand how security issues are identified, tracked, and resolved.
- Learned to create simple charts and dashboards using tools like Excel to show trends and summarize security progress.
- Assisted in reporting processes, learning to present technical information clearly for diverse team members.
Process Associate
Unisys
08.2016 - 07.2018
- Reviewed and analyzed existing processes, recommending and implementing updates that enhanced operational efficiency.
- Monitored and maintained production equipment to ensure smooth operations and minimize downtime.
- Managed supplies and inventory to maintain optimal stock levels, preventing production delays.
- Ensured compliance with safety and quality guidelines, contributing to a secure and high-standard production environment.
- Conducted process audits to pinpoint inefficiencies, facilitating targeted improvements.
- Assisted with process-related troubleshooting and resolving issues to maintain production timelines.
- Supported process improvement initiatives to enhance productivity and operational effectiveness.
Education
M.Com - Management &Information Technology
Osmania University
B.Com CA - Bachelor - Computer applications
Osmania University
Skills
- ISO standards compliance
- Cyber risk management
- Internal and external audits
- COSO framework implementation
- Third-party risk management
- Vulnerability management
- Audit oversight
- Nessus and Azure Defender
- SIEM management
- Policy development
- Network security assessments
- Risk mitigation
Personal Information
Title: Consultant Audits and Cyber Security (GRC)
Certification
ISO 27001 (2022), MOR- in training, ITIL V 4
Timeline
Senior Associate- Consultant Lead Auditor ISO and Cyber Security GRC
Coforge LTD.
03.2025 - Current
Information Security Lead
SAT Microsystems
10.2022 - 03.2025
Senior Specialist
HCL Technologies
06.2020 - 10.2022
Process Developer L2
Genpact
09.2018 - 12.2019
Process Associate
Unisys
08.2016 - 07.2018
M.Com - Management &Information Technology
Osmania University
B.Com CA - Bachelor - Computer applications
Osmania University