Shubhankar Mehrotra

+ Conducted recurring vulnerability assessments using Nessus and Tenable across infrastructure and application
environments; applied structured threat modeling to prioritize remediation based on CVSS score, exploitabilty, and
business impact — contributing to a 78% reduction in operational risk.
«Investigated security alerts in Splunk and Cisco Sourcefire; refined correlation logic and alert thresholds, reducing false
positives by 72% and improving reliability of monitoring outputs. Documented incident findings, root causes, and
remediation actions to support aut readiness and internal control validation.
+ Mapped identified vulnerabilties and control gaps to ISO 27001 Annex A and NIST CSF categories to support structured risk
reporting and remediation tracking. Maintained remediation tracking dashboards and followed up with system owners to
ensure timely closure of high-risk findings.
+ Engineered and enforced RBAC policies and user entitlement reviews across enterprise systems, reducing over-privieged
access and aligning identity and access controls with least-privilege principles across production environments.
+ Developed Python scripts to automate log parsing and anomaly detection workflows, improving efficiency of security
operations and enhancing visibility into suspicious activities. Developed and enforced security policies aligned with secure
Gevelopment and operational best practices, reducing employee-caused security incidents by 80%.
+ Conducted risk assessments by leveraging ISO 27001 and NIST CSF frameworks across internal IT systems and legal
workflows, identifying compliance gaps and recommending control enhancements to reduce exposure. Collaborated with
global teams to align security posture with regulatory standards, improving audit readiness and reinforcing client trust
+ Conducted penetration testing and security assessments on web applications; designed custom test cases and identified
approximately 15 security vulnerabilities across multiple domains. Authored comprehensive penetration testing reports
detailing isk impact and actionable remediation strategies.

•
Conducted recurring vulnerability assessments using Nessus and Tenable across infrastructure and application environments; applied structured threat modelling to prioritize remediation based on CVSS score, exploitability, and business impact — contributing to a 78% reduction in operational risk.
•
Investigated security alerts in Splunk and Cisco Sourcefire; refined correlation logic and alert thresholds, reducing false positives by 72% and improving reliability of monitoring outputs. Documented incident findings, root causes, and remediation actions to support audit readiness and internal control validation.
•
Mapped identified vulnerabilities and control gaps to ISO 27001 Annex A and NIST CSF categories to support structured risk reporting and remediation tracking. Maintained remediation tracking dashboards and followed up with system owners to ensure timely closure of high-risk findings.

•
Conducted recurring vulnerability assessments using Nessus and Tenable across infrastructure and application environments; applied structured threat modelling to prioritize remediation based on CVSS score, exploitability, and business impact — contributing to a 78% reduction in operational risk.
•
Investigated security alerts in Splunk and Cisco Sourcefire; refined correlation logic and alert thresholds, reducing false positives by 72% and improving reliability of monitoring outputs. Documented incident findings, root causes, and remediation actions to support audit readiness and internal control validation.
•
Mapped identified vulnerabilities and control gaps to ISO 27001 Annex A and NIST CSF categories to support structured risk reporting and remediation tracking. Maintained remediation tracking dashboards and followed up with system owners to ensure timely closure of high-risk findings.