Anjdeep Gumani

Director-level consulting CISO and Practice Lead, driving large-scale cybersecurity engagements and strategic
business development across financial services, government and defence. Leads consulting teams with personal
accountability for client outcomes, practice growth and commercialisation of new security capabilities.

Led a portfolio of high-profile cybersecurity engagements spanning transformation, assurance and audit for major
financial services clients, including regulated banks, global insurers and the UKs financial regulator.
• Lloyds Banking Group: Led a £4m+ security transformation programme, managing a team of circa 20
consultants and delivering 128 transition plans across 26 business units.
• Financial Conduct Authority (FCA): Led a cyber security audit on behalf of the FCAs internal audit function
assessing its Cyber Supervision function, a regulator-side audit and assurance perspective involving direct
interviews with senior FCA stakeholders.
• Beazley Group Ltd: Performed a global cyber security audit spanning Information Management, Threat and
Vulnerability Management, and Security Operations, initiating a follow-on Symantec DLP opportunity.
• Old Mutual Wealth: Contributed to a £1.5m security-only bid covering Target Operating Model design, risk
assessment and security strategy.

Senior advisory role within the cyber practice, advising CISOs and C-level executives on cybersecurity strategy,
cyber risk management and large-scale transformation.
• JP Morgan: Delivered a £2.5m cyber strategy review combining threat intelligence mapped to the NIST
capability framework, culminating in a fully costed five-year cyber security strategy.
• ABB Information Systems Ltd: Grew the engagement from an initial £4m projection to over £10m in delivered
revenue, expanding into security architecture, vendor management and ICS security.
• Schroders Plc: Executed a security strategy and change management review; initial £900k projection grew to
over £1m delivered.
• Henderson Global Investors: Led a deep-dive into the clients Risk Management framework covering UK and
Japan, aligning cyber risk reporting with the firms enterprise risk framework; grew the engagement from an
initial £90k to circa £350k.
• Investec Asset Management: Supported the CISO in securing budget to invest in the organisations security
posture following an effective Board and Audit Committee presentation.
• Butterfield Bank: Delivered a global cyber maturity assessment on behalf of the clients internal audit
programme.
• Led a security transformation engagement for a multi-national corporation headquartered in Zurich, managing a
team of 5 consultants to deliver a target operating model and a new set of policies and standards.

VP-level regional information security owner for UK/EMEA at a globally regulated investment bank, managing a
team of five across Information Risk, Governance, Third-Party Risk, Application Security, DLP and Security
Awareness.
• Led security initiatives across UK and 8 EMEA countries including Application Criticality Evaluations,
coordinating penetration testing and security controls deployment across 200+ applications.
• Directly executed Data Protection Impact Assessments on information types including personal data, and led
DLP incident response in collaboration with HR.
• Established an EMEA-wide Security Champions Network and coordinated first-line Risk Control Self
Assessments (RCSA) across BCM, Operational Risk and Application Classification.
• Developed and led the security due diligence methodology for Societe Generale CIB joint ventures, with
specific delivery in Morocco and Istanbul, adapting rules in Turkey to comply with local regulatory requirements.
• Identified and reported toxic combinations of access and privileges across user populations as a risk
intelligence exercise, and led toxic combination identification as part of an EMEA-wide Segregation of Duties
(SoD) programme.

Risk consultant for key business lines including Middle Office, HR, COO, Accounts and Finance, and IT. Managed
and supervised an application security consultant; coordinated Risk Control Self-Assessments and permanent
supervision controls.
• Led Application Criticality Evaluations and implemented tracking sheets and dashboards to manage reporting of
application security controls.
• Implemented a fast-track supplier assessment methodology for market applications in collaboration with the
Sourcing team, embedding it into BAU operation and handing it over to the sourcing and security teams for
ongoing use.

Owned and managed UK ISO 27001 certification and EMEA risk register; lead auditor for internal/external cyber
security audits and third-party assurance assessments across UK, France, Hungary and Austria, applying ISO
27001, COBIT and ITIL audit methodology.