Abhishek Pandey Deputy Manager at Deloitte. CISSP, CRISC, CRTP, CEH, ISO 27001 LI.
Cybersecurity GRC and risk professional with eight years of experience across Deloitte, EY, and offensive security consulting. I help banks and large enterprises turn regulation (RBI, ISO 27001, NIST) into controls that hold up under audit and attack. My work spans gap assessments, BIA/BCP, AI system risk, SBOM/CBOM frameworks, and hands-on VA/PT, backed by Python tooling that removes manual effort. I partner with CISOs and security leaders to establish audit-ready compliance, defensible controls, and resilient architectures.
About Me
Cybersecurity professional with eight years of experience in cyber risk, governance, and offensive security, advising regulated enterprises across banking and technology. As a Deputy Manager at Deloitte and a CISSP and CRISC holder, I help organizations meet regulatory expectations and strengthen their security posture.
At Deloitte, I developed and implemented SBOM and CBOM frameworks for one of India's largest private sector banks, giving the bank visibility into its software components and cryptographic assets. I also conducted gap assessments against RBI regulations on IT outsourcing and IT governance, risk, controls, and assurance (GRCA), identifying compliance gaps and recommending actionable remediation. I have led a team of four to deliver assessments within agreed timelines.
I have also performed security control testing for a leading FAANG technology company, evaluating control effectiveness, identifying gaps, and assessing compliance with established security requirements.
Earlier in my career, including at EY, I worked across cyber threat intelligence, risk management, red teaming, and incident response. My engineering background lets me build tools that simplify configuration reviews and automate reporting. I also hold ISO/IEC 27001:2022, CRTP, and CEH certifications.
I believe security culture starts with awareness, and I have trained more than 9,000 people on online risks and safe practices. I am also exploring how AI and machine learning can strengthen threat detection and incident response. My goal is to grow into a CISO role that aligns security strategy with business objectives, and I welcome conversations with CISOs and security leaders.
Mission
“To make security compliance practical, measurable and defensible for the organisations that safeguard people’s money and data.”
Vision
“A resilient digital ecosystem where governance, offensive insight and automation work as one.”
Work Experience
Deputy Manager
Deloitte India (Mumbai, IN)- Team Leadership: Lead a high-performing team of four security consultants to deliver rigorous risk assessments, gap audits, and regulatory milestones within agreed corporate timelines.
- RBI Regulatory Gap Assessments: Direct comprehensive compliance reviews aligning tier-1 banking architectures against RBI MD ITGRCA 2023 (IT Governance, Risk, Controls, and Assurance) and RBI Master Directions on IT Outsourcing, presenting board-level remediation roadmaps.
- Enterprise SBOM & CBOM Deployments: Spearheaded the development and enterprise rollout of Software Bill of Materials (SBOM) and Cryptography Bill of Materials (CBOM) frameworks for one of India’s largest private-sector banks, delivering deep visibility into software dependencies and cryptographic assets.
- Strategic Risk Advisory: Advise regulated financial institutions on risk management, BIA/BCP, and resilient IT governance architectures.
Security Control Testing Specialist
Leading FAANG Technology Company- Control Effectiveness Testing: Executed end-to-end technical and operational security control evaluations across critical cloud and infrastructure environments.
- Gap Identification & Benchmarking: Identified control deficiencies against enterprise global security policies and industry baselines, formulating actionable mitigation strategies.
- Compliance Assurance: Validated operational effectiveness of controls protecting customer data, identity perimeters, and internal networks.
Consultant - C2
Ernst & Young LLP (Mumbai, IN)- Team Leadership & Project Delivery: Led multi-disciplinary teams executing cybersecurity engagements valued at $60,000+ across enterprise clients, managing 25 distinct security activities per project.
- BFSI GRC & BIA/BCP: Guided clients through ISO 27001:2022 implementation, Business Impact Analysis (BIA), Business Continuity Planning (BCP), and AI system risk assessments.
- Program Maturity Valuations: Completed 8 comprehensive Cybersecurity Program Maturity (CPM) audits across domains.
- Third-Party Risk Management (TPRA): Designed vendor risk assessment programs, establishing rigorous KPIs, KCIs, and KRIs to monitor supply chain exposure.
- Audit Automation (Award Winner): Developed custom Python (openpyxl) automation scripts replacing manual Cisco switch/router configuration audits, achieving a 98% efficiency gain and winning the prestigious EY Client Extraordinaire Award (2024).
- Offensive Simulation & Incident Response: Ran SOC attack simulations, threat hunting, and containment operations for ransomware and phishing incidents.
Cyber Security Engineer
CyberSmithSECURE Pvt. Ltd. (Mumbai, IN)- BFSI Penetration Testing: Spearheaded large-scale VAPT for an international commercial bank, discovering 1,000+ vulnerabilities (with 10+ critical gaps in fund transfer mechanisms) while maintaining an audited false-positive rate of only 0.02%.
- Mumbai CID Digital Forensics Support: Provided digital forensics and packet trace assistance to Mumbai Police CID during a transnational job fraud syndicate investigation spanning 40 countries, recovering $250,000 and aiding 50,000+ victims (earned formal appreciation letter from the DCP).
- Threat Hunting & Social Engineering: Conducted proactive OSINT investigations and simulated spear-phishing drills to harden organizational perimeters.
- Security Awareness: Developed and delivered hands-on cyber awareness and threat intelligence workshops.
Associate Developer
Synergy Infotech (Pune, IN)- Engineering Foundation: Developed and maintained web applications utilizing HTML, CSS, JavaScript, and backend databases.
- Secure Coding: Implemented defensive validation filters against OWASP Top 10 vectors including SQL Injection and Cross-Site Scripting (XSS).
Education
Bachelor of Engineering (B.E.) in Information Technology
Strong technical engineering foundation covering computer networks, operating system internals, cryptographic algorithms, distributed systems, database management, and object-oriented software engineering.
Diploma in Cyber Law
Specialized legal training in the Information Technology Act 2000, Section 65B electronic evidence admissibility, transnational jurisdictional challenges, intellectual property in cyberspace, and privacy regulations.
Key Projects
SBOM & CBOM Governance Architecture
Architected comprehensive Software Bill of Materials (SBOM) and Cryptography Bill of Materials (CBOM) frameworks for one of India's largest private sector banks. Created an automated catalog of open-source components, cryptographic algorithms, and cipher suites to mitigate software supply chain risks and prepare for post-quantum cryptographic transitions.
RBI IT Outsourcing & IT GRCA Master Directions Framework
Directed compliance gap assessments against RBI Master Directions on IT Outsourcing and IT Governance, Risk, Controls, and Assurance (GRCA). Led a team of four to review core IT architectures, vendor risk governance, and assurance frameworks, delivering prioritized executive roadmaps for senior leadership.
Security Control Effectiveness Testing
Executed rigorous technical control testing for a leading FAANG technology corporation. Tested identity perimeters, network access controls, logging, and data protection mechanisms against global security baseline mandates, evaluating operational effectiveness and documenting remediation pathways.
Cisco Switch & Router Audit Automation Engine
Engineered an automated compliance assessment script in Python (openpyxl) to ingest raw Cisco CLI running configurations, evaluate them against hardened CIS and NIST benchmarks, and generate formatted executive audit spreadsheets instantly.
Transnational Job Fraud Forensics & Syndicate Dismantling
Assisted the Mumbai Police Crime Investigation Department (CID) during a multi-jurisdictional cyber fraud investigation spanning 40 countries. Traced email packet routing, phishing domains, money trails, and electronic footprints to identify syndicate operators.
International Bank VAPT
Directed an extensive vulnerability assessment and penetration test across online banking portals, internal API gateways, and fund settlement architectures, detecting 1,000+ flaws including 10+ critical logic exploits with an audited 0.02% false-positive rate.
Skills & Capabilities
GRC & Governance
Offensive Security
Defensive Ops & Forensics
Scripting & Tooling
Certifications & Credentials
- Security and Risk Management
- Asset Security & Security Architecture
- Communication & Network Security
- Identity & Access Management (IAM)
- Security Assessment and Testing
- Enterprise Risk Identification & Assessment
- Risk Response & Mitigation strategies
- Information Security Control monitoring
- Risk-aware corporate decision framework
- Designing & implementing ISMS policies
- Conducting compliance gap analyses
- Annex A security controls deployment
- Leading audit readiness checks
- Active Directory Infrastructure Attack
- Kerberos attacks & abuse methods
- Domain admin privilege escalation
- Bypassing modern endpoint security
- System hacking & scanning networks
- Vulnerability analysis methodology
- Malware threat modeling
- Web application penetration testing
- Understanding security layers
- Operating system security configs
- Network security topologies
- Active directory policy mapping
Achievements & Recognition
Mumbai Police CID Commendation
Received official appreciation from the Deputy Commissioner of Police (DCP), Cyber Crime, for leading digital forensics that dismantled a transnational job fraud ring across 40 countries, safeguarding 50,000+ victims.
EY Client Extraordinaire Award (2024)
Awarded for developing an openpyxl-powered Python configuration auditing suite that automated manual Cisco network audits, cutting turnaround time by 98% while ensuring zero false negatives.
Individuals Trained in Cyber Awareness
Believing security culture begins with human awareness, conducted specialized training sessions for over 9,000 students, professionals, and corporate personnel on online safety, social engineering, and threat avoidance.
BFSI Vulnerabilities Discovered
Uncovered 1,000+ vulnerabilities (including 10+ critical logic flaws in banking transfer workflows) during international bank VAPT assessments with an independently audited false-positive rate of just 0.02%.
Cyber Security Tools & Assessments
Articles, Publications & Blog
Let’s Talk
Direct Channels
Direct Hot-line
Email Endpoint
Operational Base
Mumbai, Maharashtra, IN