Sudhansu Kumar

Seasoned Information Security, Security Assurance & GRC Leader with nearly 15 years of experiencein cybersecurity governance, risk management, compliance, audit readiness, commercial security, and security architecture across cloud, IoT, software, hardware, and AI environments. Expertise in technical risk assessment, continuous control monitoring, third-party assurance, AI governance, and security transformation, with a strong ability to align security priorities with business objectives and technology decisions. Targeting VP - Information Security, Head of Cybersecurity, or CISO-track leadership roles focused on strengthening governance, managing enterprise & AI risk, ensuring regulatory readiness, and building resilient security programs.

• Led enterprise security strategy, GRC frameworks, operating models, policies, and roadmaps, aligning security and risk priorities with business objectives and executive requirements.
• Delivered 13+ consecutive years of external audits with 0 major nonconformities across ISO 27001/27701/42001, SOC 2 Type II, SOX ITGC, NIST, HIPAA, GDPR/DPDP, CMMC, EU RED 18031 and PCI-DSS, strengthening audit readiness and regulatory assurance.
• Reduced open enterprise vulnerabilities by 85% through structured technical risk assessments, risk-based prioritization, remediation governance, and continuous control monitoring.
• Reduced manual GRC effort by 50% and audit-preparation time by 40% by automating controls, evidence collection, and compliance workflows.
• Strengthened commercial security and customer assurance, reducing RFP and security-questionnaire response time by 60% through standardized security documentation, control libraries, and AI-assisted workflows.
• Managed 500+ third-party security assessments, implementing risk-based assurance and streamlined onboarding processes that improved vendor onboarding speed by 30%.
• Established an AI Governance Committee and developed governance controls for AI, LLM, and agentic-AI adoption, supporting ISO/IEC 42001, EU AI Act & NIST AI RMF readiness & responsible technology use.
• Provided security architecture & technology risk advisory across cloud, software, hardware, IoT, and emerging technology environments, including 5+ Fortune 500 client engagements.
• Led data protection initiatives across 10,000+ endpoints, reducing high-risk data egress by 40% through DLP governance, monitoring, and policy enforcement.
• Built organization-wide security awareness through training for 2,500+ employees, strengthening understanding of security, compliance, and technology risk requirements.

• CCSK (Certificate of Cloud Security Knowledge) v4
• AZ-500: Microsoft Certified Security Engineer
• Exam 534: Architecting Microsoft Azure Solutions
• Proofpoint Certified AI Email Security Specialist & AI Data Security Specialist

• Security Strategy: Developed security operating models, governance structures, risk appetite frameworks & multi-year roadmaps aligned with business and technology priorities.
• Audit & Compliance: Led 13+ consecutive years of external audits with 0 major nonconformities across ISO/IEC 27001, 42001, SOC 2 Type II, SOX ITGC, NIST, HIPAA, CCPA, DIFC R 10 and GDPR.
• Technology Risk: Assessed security risks across cloud, on-premises, IoT, hardware, software, and AI, maintaining enterprise risk registers & conducting quarterly CxO reviews of treatment and acceptance decisions.
• AI Governance: Built the AI Management System (AIMS) and agentic-AI governance framework covering AI risk assessments, model and connector reviews, data protection, and acceptable-use requirements; founding member of the AI Governance Committee, supporting ISO/IEC 42001, EU AI Act DIFC R10 & NIST AI RMF readiness.
• Security Architecture: Provided strategic oversight across cloud and enterprise security architecture, vulnerability management, IAM/PAM, Zero Trust, DLP, SOC/SIEM & secure software practices.
• Third-Party & Commercial Security: Builds risk-tiered vendor assurance and customer-trust programs (Trust Centre, CAIQ/SIG, RFPs, security documentation) that shorten sales cycles and strengthen enterprise assurance.
• Cross-Functional Leadership: Partners with engineering, product, legal, privacy, and business teams to embed security in key decisions and build trust with customers, auditors, and leadership.
• Executive Reporting: Presented quarterly security and technology risk updates to CxOs and the Board, covering security posture, key exposures, priorities, and treatment decisions.

Enterprise Security Operating Model, GRC Automation & Audit Assurance | Program Owner & Audit Lead

• Scaled an enterprise security operating model without added headcount, defining governance, control ownership, risk workflows, and a 115-control framework mapped across ISO, SOC 2, SOX, NIST, HIPAA, PCI-DSS, CSA CCM, and FedRAMP.
• Automated continuous monitoring and evidence collection through Sprinto, reducing manual GRC effort by 50%, audit preparation by 40%, and mapping reviews by 30%; led 13+ consecutive external audits with zero major nonconformities.

AI Governance & ISO/IEC 42001 | AI & Agentic AI Security | Program Owner

• Established the AI Governance Committee and enterprise controls for AI/ML, GenAI, LLMs, and agentic AI—including policies, risk assessments, approval gates, model/data/connector reviews, guardrails, and audit evidence—enabling responsible adoption and ISO/IEC 42001 readiness.

Enterprise Risk, Vulnerability Management, DLP & TPRM | Technical Risk Program Owner

• Established enterprise technology-risk visibility across cloud, on-premises, IoT, hardware, software, and AI through recurring assessments, control testing, risk registers, SLAs, and executive dashboards—reducing open vulnerabilities by 85%.
• Deployed DLP across 10,000+ endpoints, cutting high-risk data egress by 40%, and automated risk-tiered TPRM to reduce assessment and onboarding timelines by 30%.

AI-Assisted RFP & Customer Assurance | Program Owner

• Built an approved-content RAG-based security response capability using CAIQ/SIG libraries and reviewer workflows, cutting RFP and questionnaire turnaround by 60% and accelerating enterprise sales without added headcount.

• Business & Security Alignment: Connects security priorities with business goals, helping leadership balance growth, customer needs, regulatory requirements, and security risks.
• Security Program Development: Builds clear roles, processes, and ways of working that strengthen security capabilities & support organizational growth.
• Risk Management: Prioritizes security issues based on business impact, exposure, regulatory requirements, and customer expectations, focusing resources on the areas that matter most.
• Cross-Functional Leadership: Works across technology, product, engineering, legal, privacy, compliance, and business teams to make security part of key business and technology decisions.
• Security by Design: Integrates security and privacy earlier into product, cloud, application, and technology development, reducing downstream remediation requirements by 30%.
• Operational Improvement: Simplified security processes and decision-making, contributing to a 20% improvement in operational efficiency and a 40% increase in timely closure of security actions.
• Emerging Technology: Guides the secure adoption of AI, cloud & other new technologies, balancing innovation with practical security and risk controls.
• Stakeholder Engagement: Builds trust with customers, auditors, business leaders, and internal teams through clear communication, consistent processes, and transparent reporting.

Management Representative and Standing Member of Information   Security Steering Committee, AI Governance Committee (AIGC), Change   Advisory Board (CAB), Privacy Committee, and RFP & Customer   Assurance Response Team.

| •Strategic Leadership | •Executive Communication | •Business Acumen | •Strategic Decision-Making | •Cross-Functional Collaboration | •Negotiation & Influence |

ISO 27001 | ISO 27701 | ISO 42001 | SOC 2 Type II | SOX ITGC | NIST CSF | NIST SP 800-53 | NIST AI RMF | PCI-DSS | HIPAA | GDPR | DPDP | EU AI ACT | CSA CCM | FedRAMP | AWS | Microsoft Azure | Microsoft 365 | Sprinto | ServiceNow GRC| Jira | OpenAI | DLP | TPRM | RAG | SCRUT.ai | OneTrust | MS Purview | DSPM | Crowdstrike Falcon & CSPM |  Crowdstrike AISPM | SecPod | ServiceDesk+ | Wazuh | Zluri IGA | JIRA | Confluence | Vanta | PowerShell | Zero Trust Architecture | DIFC R10 | EU RED 18031 |