GAURAV KHANNA
BCD Travel
Singapore
1
Certification
23
Years of experience
Seasoned information security professional with 20 years of IT experience, including 14 years in security consulting and risk assessments. Specializes in translating business needs into actionable security requirements and governance. Currently enhancing cloud governance and compliance with PCI DSS, ISO 27001, and NIST SP 800-171. Experienced in developing and testing security frameworks for cloud solutions and implementing network defense strategies.
Work History
Security Analyst II / Internal Auditor
5 Years 9 Months- Assess business processes, solution designs, data flows, and control evidence to identify security gaps and prioritize remediation.
- Designed and conducted a 30-control cloud governance audit across four functions, identifying eight gaps requiring remediation.
- Assessed cloud security and governance for solution approvals, IAM, network segmentation, secure configuration, monitoring, resilience, and system lifecycle to identify and address vulnerabilities.
- Conduct PCI DSS and ISO 27001 assessments of cloud services and database environments, evaluating data flows, access controls, secure configuration, data protection, logging, monitoring, vulnerability management, and operating evidence.
- Developed assessment plans, control mappings, questionnaires, evidence requirements, workpapers, findings, and reports to ensure alignment between control design and operating effectiveness.
- Collaborated with business and technology teams to clarify control ownership and define remediation actions, applying a 'collect once, comply many' approach across NIST SP 800-171, SOC 2, PCI DSS, and ISO 27001 assessments.
Security Consultant
3 Years- Advised internal teams on security requirements, network segmentation, threats, vulnerabilities, and remediation options, facilitating effective implementation of security controls.
- Identified security risks and defined control requirements to support risk treatment decisions through reviews of solution requests, data flows, encryption methods, and network communications.
- Identified security risks and defined control requirements, guiding risk treatment decisions through thorough reviews of solution requests, data flows, encryption methods, and network communications.
- Acted as an information risk liaison, coordinating with business and technology teams to assess third-party systems, review security controls, and support governance and risk treatment decisions.
Security Consultant
2 Years- Led delivery of greenfield, multi-tenant Security Operations Center, enhancing vulnerability management, incident analysis, security monitoring, and operational process design.
- Evaluated security solutions including Microsoft Intune, AirWatch, MobileIron, and Kenna; recommended solutions based on security requirements, operational fit, and risk reduction.
- Developed and reviewed information-security policies, hardening standards, vendor-risk processes, ISO 27001 controls, ITGC assessments, and risk registers for client environments.
- Automated vulnerability-management workflows, optimizing Archer and ServiceNow processes for evidence collection, reporting, navigation, and operational follow-up.
- Supported ISO 27001 implementation and certification readiness, contributing to business continuity planning and security control testing.
Security Operations Lead
3 Years- Built and led 24x7 security operations for a banking environment, integrating Internet Banking and Core Banking System telemetry into SIEM for threat and transaction monitoring.
- Administered RSA enVision and RSA Archer, developing correlation rules, reports, alert-to-incident workflows, data-driven events, escalation paths, and SLA monitoring to enhance security operations.
- Coached SOC analysts, ensuring compliance with ISO 27001 and PCI DSS controls while facilitating disaster-recovery testing, SOP development, incident response, and vulnerability management.
- Upgraded RSA enVision to RSA Security Analytics, tuning monitoring content to enhance detection and response capabilities.
Security Operations / SIEM Specialist
2 Years- Delivered L3 SIEM engineering and operations support, enhancing log parsing and normalization, custom report and alert design, troubleshooting, event monitoring, and investigations to improve security metrics.
- Collaborated with clients, system teams, and database administrators to safeguard critical assets and propose controls that ensured confidentiality, integrity, availability, and auditability.
- Identified and assessed network and information-system vulnerabilities, managing investigations to ensure resolution and bolster security posture.
Security Engineer
1 Year- Conducted proofs of concept for security products and implemented web security, unified threat management, Aruba wireless, Linux hardening, and virtualized Linux environments to enhance overall security posture.
- Designed secure network architectures and hardened systems against evolving threats.
- Implemented vulnerability management workflows across endpoints, servers, and cloud environments.
- Configured firewalls, intrusion detection, and access controls to reduce unauthorized activity.
Technical Support Roles
5 Years- Established foundation in endpoint support, operating systems, hardware, account administration, troubleshooting, documentation, customer service, and team mentoring to enhance team capabilities.
- Self-motivated, with a strong sense of personal responsibility.
- Worked effectively in fast-paced environments.
- Skilled at working independently and collaboratively in a team environment.
Education
Bachelor of Commerce
Skills
SECURITY REVIEW
Design reviews
RISK ASSESSMENT
Context-based risk
CLOUD SECURITY
Cloud governance
Technical breadth
Security assessments
Risk assessments
Control assessments
Data-flow analysis
AWS and Azure security
Privileged access
Network segmentation
Vulnerability assessment
Security monitoring
Linux security
Data encryption. Assurance and governance: PCI DSS
ISO 27001/2002
NIST SP 800-171
SOC 2
Security policies
Risk management
Third-party assessments.
Accomplishments
- Cloud governance: Assessed 30 cross-functional controls and documented eight remediation areas covering governance approval, supplier offboarding, account provisioning, monitoring, decommissioning, and resilience coordination.
- Compliance efficiency: Implemented evidence-reuse practices across NIST 800-171, SOC 2, PCI DSS, and ISO 27001.
- Security and site assessments: Completed security posture assessments across five APAC countries and recommended security improvements.
- Security operations: Built or managed SOC capabilities in banking and multi-tenant environments, including SIEM implementation, workflow integration, monitoring content, and analyst training.
Certification
- CISA
- ISO 27001 Lead Auditor
- PCI DSS-CPISI
- CEH v7
- ITIL v3
- RSA-CSE
- CCNA. Professional development: Cloud Security coursework (Pluralsight).
Section name
Gaurav Khanna | Senior Solutions Security Architect Application
Personal Information
INFORMATION SECURITY
Timeline
Security Analyst II / Internal Auditor
BCD Travel
01.2021 - CurrentRead More
Security Consultant
BCD Travel
01.2018 - 01.2021Read More
Security Consultant
Happiest Minds Technologies
01.2015 - 01.2017Read More
Security Operations Lead
HCL Technologies
01.2012 - 01.2015Read More
Security Operations / SIEM Specialist
IBM India
01.2010 - 01.2012Read More
Security Engineer
Meta Infotech
01.2009 - 01.2010Read More
Technical Support Roles
Stream Global Services Inc.
01.2004 - 01.2009Read More
Mumbai University
Bachelor of Commerce
Read More