Abhishek Pandey Cybersecurity GRC & BFSI Specialist
Deputy Manager at Deloitte India specializing in banking compliance, risk governance, and software supply chain security. Developing CBOM/SBOM frameworks, leading regulatory gap assessments for RBI directions, and designing control matrix methodologies for enterprise financial networks.
Professional Experience
Deputy Manager
Deloitte India (Mumbai, IN)- Regulatory Gap Assessment: Lead comprehensive cybersecurity compliance audits aligning banking core IT infrastructure with RBI MD ITGRCA 2023 (IT Governance, Risk, Controls, and Assurance) and RBI MD IT Outsourcing guidelines.
- CBOM & SBOM Frameworks: Design and deploy structured governance frameworks for Cryptography Bill of Materials (CBOM) and Software Bill of Materials (SBOM) to secure the software supply chain across critical BFSI platforms.
- Risk & Maturity Valuations: Direct specialized security risk assessments, threat modeling, and control maturity audits for major cooperative and public sector banks, delivering actionable remediation roadmaps to executive leadership.
Consultant - C2
Ernst & Young LLP (Mumbai, IN)- Team Leadership & Project Delivery: Led teams delivering cybersecurity projects valued at $60,000 across multiple organizations, executing 25 distinct security activities per project with high client satisfaction.
- BFSI & Enterprise GRC: Managed comprehensive cybersecurity portfolios covering DLP, Risk Assessment, Web Application Firewalls (WAF), and general compliance checks.
- Program Maturity: Completed eight Cybersecurity Program Maturity (CPM) audits across 5 domains, validating alignment with strict industry and privacy regulations.
- Risk Assessment & Modeling: Executed Third-Party Risk Assessments (TPRA) for critical external partners, establishing key risk metrics (KPIs, KCIs, KRIs) to strengthen resilience.
- Offensive Testing & Auditing: Conducted SOC attack simulations and performed thorough configuration reviews (Windows, Linux, Cisco network switches, routers, and firewalls).
- Automation: Designed custom openpyxl Python automation scripts to replace manual device config audits, enhancing efficiency by 98% and winning the EY Client Extraordinaire Award (2024).
- Incident Response: Managed response efforts for ransomware attacks and phishing incidents, mitigating exposure and coordinating restoration of compromised endpoints.
Cyber Security Engineer
CyberSmithSECURE Pvt. Ltd. (Mumbai, IN)- BFSI Bank VAPT: Led a major Vulnerability Assessment and Penetration Testing (VAPT) engagement for a large international bank, discovering 1,000+ vulnerabilities (with 10+ critical gaps) while maintaining an exceptional false-positive rate of 0.02%.
- Mumbai CID Digital Forensics: Supported Mumbai CID during a high-profile, cross-border digital forensics job fraud investigation affecting 40+ countries and 50,000 victims, resulting in the recovery of $250,000 and direct appreciation from the DCP.
- Threat Hunting & Social Engineering: Conducted proactive network threat hunting and simulated phishing exercises to evaluate staff awareness and reinforce email security.
- Technical Training: Created and delivered internal training modules on the Cyber Kill Chain, Open Source Intelligence (OSINT), Google Dorking, and Threat Intelligence.
Associate Developer
Synergy Infotech (Pune, IN)- Secure Web Development: Designed, developed, and maintained responsive websites utilizing HTML, CSS, and JavaScript.
- Security Best Practices: Implemented basic security filters on input fields, sanitizing queries to protect against SQL injections and Cross-Site Scripting (XSS).
Governance & Technical Credentials
- Security and Risk Management
- Asset Security & Security Architecture
- Communication & Network Security
- Identity & Access Management (IAM)
- Security Assessment and Testing
- Enterprise Risk Identification & Assessment
- Risk Response & Mitigation strategies
- Information Security Control monitoring
- Risk-aware corporate decision framework
- Active Directory Infrastructure Attack
- Kerberos attacks & abuse methods
- Domain admin privilege escalation
- Bypassing modern endpoint security
- Designing & implementing ISMS policies
- Conducting compliance gap analyses
- Annex A security controls deployment
- Leading audit readiness checks
- System hacking & scanning networks
- Vulnerability analysis methodology
- Malware threat modeling
- Web application penetration testing
- Understanding security layers
- Operating system security configs
- Network security topologies
- Active directory policy mapping
Cyber Security Tools & Assessments
Articles & Publications
Published Work
Securing Core Banking Systems: A GRC Implementation Strategy
A comprehensive guide on deploying Annex A controls and CRISC frameworks to secure legacy core banking databases against remote threat vectors.
Read PublicationThe 98% Automation Leap: Cisco Configuration Audits at Scale
Technical analysis of leveraging Python openpyxl scripts to automate network compliance audits, reducing manual overhead for EY clients.
Read PublicationTracking Transnational Crime: Tracing Forensics in 40 Countries
A case study analysis on cross-border job fraud forensics, detailing electronic evidence collection and coordination with international police agencies.
Read PublicationTechnical Insights
Active Directory Forest Security: A CRTP's Guide to Domain Containment
Practical defense guide outlining delegation abuse mitigations, tier administration setups, and Kerberoasting threat monitoring inside Active Directory.
Read InsightThird-Party Risk Assessments (TPRA) in BFSI: A Compliance Blueprint
Establishing structured vendor onboarding security checklists, aligning risk scoring with business impact, and designing KPIs/KRIs.
Read InsightThreat Hunting IOCs: Building a Standardized Lifecycle Management Policy
Explaining how to manage IOC expiration dates, false positive feedback loops, and SIEM rule updates in high-volume Security Operation Centers.
Read InsightForensics & Mitigation Case Studies
Cross-Border Job Fraud Investigation
Supported Mumbai CID during a global investigation tracking cybercriminals operating across 40 countries. Used advanced OSINT, digital footprints analysis, and network packet forensics to trace syndicates defrauding over 50,000 victims.
BFSI Vulnerability Assessment
Led a massive penetration test engagement for a global financial institution. Discovered over 1,000 vulnerabilities (10+ critical logic exploits in fund transfer modules) with a near-zero false positive rate of 0.02%, preventing major operational and financial risk.
Ransomware Containment & Forensics
Spearheaded containment, isolation, and digital forensics during two concurrent active ransomware attacks at an enterprise client. Successfully minimized threat propagation, reverse-engineered malware attack vectors, and safeguarded critical backups.
Cyber Security Capability Matrix
GRC & Governance
Offensive Security
Defensive Ops & Forensics
Scripting & Tools
Secure Communication
Direct Channels
Secure Hot-line
+91-976-862-0271
Email Endpoint
Operational Base
Mumbai, Maharashtra, IN