YD 

Selected work

Professional & Academic projects 

Selected work demonstrating measurable impact

01 — Professional

Full-Time

  • CLOUD SECURITY

    Cloud Security Assessment

    PWC

    Conducted cloud security assessment covering 12 AWS services across 8 domains

    • Delivered a risk-prioritized remediation roadmap
    IAMCompute Services - EC2, LambdaVPCLogging & Monitoring - AWS CloudTrail, AWS ConfigStorage Services - S3, EBSSecurity & Compliance Services - AWS Certificate Manager, KMSApplication Integration Service - SNSNetwork & Content Delivery Service - Amazon CloudFront 
    AWSAWS Service Security Best PracticesCIS AWS Benchmarks
  • CYBER GOVERNANCE

    Policy Development

    PWC

    Developed 17 domain-specific system security policies balancing regulatory requirements, team's technical capabilities, and business needs

    • Reduced risk exposure window by over 50%  
    • Eliminated recurring audit findings 
    • Supported successful acquisition of the payment aggregator license for business expansion
    Access ManagementAnti-MalwareAsset ManagementEncryption ManagementData ClassificationCloud SecurityThird-Party Risk ManagementChange ManagementException ManagementVulnerability ManagementSecure CodingLog ManagementInformation and Media HandlingPassword & Account ManagementPatch ManagementSOC ManualDLP Incident Management
    NIST 800-53NIST 800-61 ISO 27001ISO 27002Confluence OWASP Top 10
  • TPRM

    Third Party Risk Management Program Optimization

    PWC

    Optimized the vendor security program (600+ vendors), improving assessment rigor and accelerating assessment completion timelines by 30%

    • Improved assessment quality and throughput by ~30% within two quarters
    • Updated and re-structured the risk profile questionnaire for vendor profiling
    • Standardized assessment scoping mechanism for repeatable and consistent use
    • Trained the team on vendor assessment best practices 
    SIG LiteCIS AWS BenchmarksISO 27001ServiceNow
  • DATA PRIVACY

    Privacy Operations 

    CAPGEMINI

    Developed GDPR compliant records of processing activities (RoPA) and conducted privacy impact assessments (PIA) for 16 regional and 6 global engagements spanning Europe, India, China, and the US  

    • Identified, assessed, communicated, treated, and monitored critical data processing risks
    • Established end-to-end data mapping
    • Established audit-ready compliance with stringent regulatory and client contractual requirements
    GDPRHIPAACCPA
  • INFORMATION SECURITY

    Information Security Risk Management

    CAPGEMINI

    Conducted end-to-end asset-based risk assessments for 22 engagements

    • Identified, assessed, communicated, treated, and monitored critical information security risks 
    • Established audit-ready compliance with stringent regulatory and client contractual requirements
    ISO 27001ISO 27005
  • BUSINESS CONTINUITY

    Business Continuity Management

    CAPGEMINI

    Developed end-to-end tailored business continuity plans for 22 engagements 

    • Enhanced operational resilience 
    • Established financial, legal, operational, and reputational impact at minutes, hourly, daily, weekly, and monthly service disruption levels 
    • Established operational criticality at service/product, process, and activity level  
    • Mapped asset-to-service dependencies to ensure continuity of operations as per the committed RTO, MAO, and RPO  
    • Conducted threat assessment and identified plausible continuity strategies to ensure  continuity of operations as per the committed RTO, MAO, and RPO     
    ISO 22301Tabletop Exercise

02 — Academic

Part-Time Experiential Projects

  • CLOUD COMPUTING CAPSTONE

    Cloud Infrastructure & Security

    INDIANA UNIVERSITY

    Deployed AWS Well-Architected Framework compliant environments 

    • Architected a highly available two-tier AWS web application with ALB-fronted EC2 Auto Scaling in a segmented custom VPC and a private RDS MySQL database; secured credentials via Secrets Manager and least-privilege IAM roles
    • Provisioned a hardened AWS environment (EC2, S3, VPC, IAM) using Terraform IaC modules and version-controlled security baselines
    AWS Well-Architected FrameworkTerraformInfrastructure-as-Code
  • CYBER RISK MANAGEMENT CAPSTONE

    Cybersecurity in the Post-Quantum World

    MCKINSEY & COMPANY AND INDIANA UNIVERSITY

    Developed a risk-based PQC transition strategy, clarifying near-term leadership investment priorities and system design imperatives to enable seamless cryptographic transitions for achieving digital resilience in the post-quantum world

    • Threat outlook
    • Key systems and data at risk
    • Top 5 PQC transition challenges
    • PQC transition scoping strategy
    • Crypto agility maturity measurement
    Cryptographic Agility Maturity Model (CAMM)FIPS 203 (ML-KEM)FIPS 204 (ML-DSA)FIPS 205 (SLH-DSA)
  • CYBER CLINIC

    Cyber Risk Assessment 

    TANDEM AND INDIANA UNIVERSITY

    Conducted HIPAA gap assessment and quantitative cyber risk assessment using FAIR model

    • Identified 20+ gaps and quantified risk in dollar value 
    • Delivered a cost-effective and risk-prioritized remediation roadmap
    • Delivered a NIST 800-61 aligned incident response plan
    HIPAAHIPAA Security RuleHIPAA Privacy RuleNIST 800-61ISO 27001
  • RESEARCH ASSISTANT

    Smart, but Safe? Assessing the Health of Medical Device Cybersecurity

    INDIANA UNIVERSITY

    Co-authored a law review article examining medical device cybersecurity governance gaps in the U.S., with a particular emphasis on the evolving role of AI

    • Approved for publication and forthcoming in the Minnesota Journal of Law, Science, and Technology
    FDAAI Governance
  • RESEARCH ASSISTANT

    Agentic AI: The Layered Security Approach

    INDIANA UNIVERSITY

    Defined security control requirements and guardrails for AI Agents 

    • Conducted AI impact assessment using ISO 42005
    • Applied CSA's MAESTRO framework to identify threats, vulnerabilities, risks, and mitigations across the seven-layer reference architecture for agentic AI 
    MAESTROOWASP LLM Top 10OWASP Top 10 for Agentic ApplicationsAI Risk Management
  • EXPLOITING & PROTECTING WEB APPLICATIONS

    Web Application Security

    STANFORD UNIVERSITY

    Exploited OWASP Top 10 web application vulnerabilities in a simulated environment

    • Articulated the vulnerability POC, risk, ease of exploitation, business impact, and appropriate mitigations 
    OWASP Top 10Burp Suite
  • NETWORK SECURITY

    Network Security Project

    STANFORD UNIVERSITY

    Exploited network vulnerabilities in a simulated environment

    • Articulated the exploitation procedure step-by-step and mitigations to be put in place  
    NmapMetasploitHydraWireshark