Mukesh Arya

• Responsible for developing, implementing, and managing the organization's information security compliance program. This includes ensuring that the organization's policies, procedures, and controls are aligned with applicable laws, regulations, and industry standards • Working with other executives to ensure that the organization's information security program is aligned with the organization's overall business goals • Working with internal and external stakeholders to identify and mitigate risks to the organization's information assets • Developing implementing, and managing the organization's information security compliance program • Conducting regular assessments of the organization's information security posture • Maintaining up-to-date knowledge of information security best practices and regulations • Preparing and delivering reports on the organization's information security compliance status • Stay up-to-date on the latest information security threats and trends • Provide advice and guidance to senior management on information security matters • Build and maintain relationships with key stakeholders • Manage the information security budget • Provide security training to employees

• Policy Design & Development (Accomplished) – Formulating and communicating policies options and recommendations; developing a clear narrative for the policies and business cases including clear problem definition and objectives; considering impact of policy to strategic plans, community needs, complementing programs and policies across the service. • Critical Thinking and Problem Solving (Accomplished) – Responsible for ensuring the implementation, enhancement, monitoring and enforcement of the information security and information technology risk policy framework. Fostering a risk culture and building a technology/IT risk management framework, which considers industry best practices (CPS 234) and the needs of the local businesses. Supporting the risk owners and the local IT Management to establish appropriate risk metrics (KRIs) and related thresholds (appetite and tolerances). • Digital and Technological Literacy (Applied) – Assisting management and other key stakeholders with understanding and implementing information security responsibilities. Identifying significant threat changes and exposures to threats of assets associated with information security. Creating and maintaining IT Risk Dashboards and regular metric deliverables. Maintaining a risk register, ISO27005 based risk assessment from identifying risks and working with risk owners to deploying controls that mitigate risks. Development and deployment of Risk management to Group standards. Implementing the Group IS Risk Management Program • Working Collaboratively (Leading) – Building a culture of collaboration across the organization; looking for and facilitating opportunities to collaborate with external stakeholders; identifying and overcoming barriers to communicate with internal and external stakeholders. Owning the Risk Framework and deliverables.

Responsible for establishing and governing an enterprise wide data governance implementation roadmap Responsible for rolling out an enterprise wide data governance framework Resolving escalated issues from Business and Functions for data governance Supporting adherence to data governance principles, policies and procedures to achieve Data Governance purpose Contributing to the establishment of the data governance structure, running and maintenance of this structure to support the strategic objectives Collaborating with leadership across the business, to understand business data needs and ensuring the Governance function provides the appropriate involvement and engagement Managing and promoting data as a strategic asset and driving data governance operations, data quality, security and other controls to sustain data integrity

Regulatory and Legislative Compliance Monitoring, Analysis and Reporting Establishing a Risk, Compliance and Regulatory framework for the various projects within the business and sensitizing relevant internal stakeholders. Document existing controls within the business processes in order to monitor and assess their adequacy and effectiveness of the controls. Perform risk assessments on new projects Engage with the outsourced service providers to assess levels of risk and compliance third party risk management (TPRM). Recommend areas of improvement and identify action items to be put in place to rectify areas of non-compliance. Developing and enforcing the data protection and privacy policies and anchor compliance with the privacy laws applicable to the business Implementation and Compliance according to Data Privacy Policy requirements (DPP) Review and update relevant DPP policies and communicate the same to the larger organization Privacy Assessments of new processes and ad hoc requests and highlight risks pertaining to the same Stakeholder management Analyze complaints (internal and external) for trends and report’s findings to relevant stakeholders Liaise with External Regulatory Stakeholders Engage with Internal (Project Support) and business stakeholders. Key performance indicators: Engaging with the business regarding the compliance and regulatory requirements when developing new products. Assist with any compliance training and awareness programs and reviewing training material to ensure that it is in keeping with the defined standards. Record the controls that are being implemented within the business against the specific regulatory environment in the form of risk management plans. Audits on going processes to assure continued compliance Assist in managing, resolving and reporting audit exceptions. Follows up on the implementation of management action plans to address any identified control gaps

• Audit Optimization o Assisting in preparation for audits that assess services managed for client o Coordinating responses on both preliminary and final audit observations o Track audit actions to closure • Security Management o Working with client service managers/ delivery heads to identify and assess security risks and issues o Reporting on status of security risks and associated actions to internal and client management o Ensuring responses on security risks are regularly reviewed and, where needed, updated o Track security remediation actions to closure working with stakeholders • Security Awareness and Performance o Ensuring awareness on actual security and compliance related requirements with the Client and Internal Stakeholders o Demonstrating effective risk awareness in order to ensure an appropriately targeted and risk focused audit approach • Driving monthly and quarterly review of and reporting on client’s Information Security & Compliance performance • Identifying key issues impacting businesses and IT areas under review, presenting and agreeing with management practical, commercial actions for the mitigation of associated risks; monitoring progress and resolution of outstanding audit recommendations • Developing and provisioning of audit services to the wider Internal Audit departments including continuous risk monitoring, and periodic analysis of IT performance and Key Risk Indicators (KRI- s) • Performing, supporting and leading where directed, the planning, fieldwork, and reporting of internal audit engagements to deliver agreed assurance objectives to established standards and timelines agreed with client • Ensuring implementation of GDPR controls • Performing additional responsibilities as assigned related to Information security- Overseeing DLP incidents, Security incidents etc.

Responsible for planning, executing and managing various IT security consulting and assessment projects for clients. Performing Control Assurance / Security Assessments / SSAE16 / ISO 27001 audit engagements for various clients. Understanding various business processes and computer processing environments Identifying the various control requirements in the process. Developing audit check points and work programs Performing Gap Analysis and Identifying Control Weakness Recommend process changes to eliminate/reduce impact of gaps identified Discussions of key issues identified during the assignment and provide value-added recommendations to the client’s management with committed implementation time-frames

• Evaluating, implementing information security standards, procedures guidelines across the org • Conducting internal audit based on ISO27001, IT general controls and to check compliance of information security • Report audit findings, keep track of non conformity and make recommendations for the corrective action plan for noted control deficiencies and improvements • Conducting Information technology risk assessments • Reviewing host configurations introduced to equipment's and software’s for removal of non- essential services and default settings that could threaten security in accordance with the Security Policy • Supporting security incident response processes in the event of security breaches by providing logging sharing audit information and by providing incident reporting • Implementing and managing security incident management process according to the security policy and maintaining a security corrective action tracking • Designing and implementing security services required to protect the confidentiality, integrity, privacy and authenticity of the information stored in the environment and exchanged between organizations and with any Third Party Vendor(s) in accordance with the Security Policy • Facilitating External clients audits • Performing application Risk assessment • Conducting Policies & Procedure review & formulating policies and procedure

• Conducting various application audits based on defined policies and procedures • Report audit findings, keeping track of Non conformity and making recommendations for the corrective action plan for noted control deficiencies and improvements in operation • Liaising with different Business groups and support functions for collection of evidences and artifacts based on IT General controls • Developing quarterly audit plans, managing team. • Conducting internal audits according to bank’s policies, procedures and regulatory requirements. • Maintaining and tracking Risk register, reviewing capacity utilization report and validating COCA (Control Objectives-Control activities) / control applicability matrix • Responsible for engagements (including audits and reviews) focused on Information Technology General Controls (ITGC), application audits • Imparting information security & audit training's within organization.

• Facilitating External Audits and Conducting Internal Audits based on defined policies and procedures • Report audit findings, keep track of Non conformities and make recommendations for the corrective action plan for noted control deficiencies and improvements in operation • Liaising with different Business groups and Support functions for collection of evidences and artifacts based on ITGC controls • Conducting audit trainings • Planning and execution of Internal and External audits • Ensure Closure of the Non conformities with appropriate measures • Conducting Information security awareness trainings for different business group and support functions