Verizon

Distinguished Engineer

• Prepared Verizon managed security services platform for ISO 27001 certification making it available for sale ahead of schedule
• Identify, analyze, develop end-to-end risk assessment processes to mitigate business partner and third party risk (vendor risk management)
• Quantify risks based on scope and impact, create mitigation strategies, influence adoption and added them to risk register for monitoring 
• Analyzed systems, applications and project, operation risk and established security controls improvement initiatives resulting in $5 M upfront cost reduction 
• Lead cross-functional application and vendor reviews for technology, business process, Information security and regulatory risk collaborating with business, privacy and legal teams
• Evaluate cloud security posture, assessed risks  and designed controls to remediate audit deficiencies 
• Reporting status of key risk initiatives to management via dashboards
• Awarded two Spotlight Awards for contribution to a confidential project, and three Patent Awards

Principal Risk Management

Advisor and subject matter expert on technology, operational, financial, and/or information risks and control mechanisms to prevent fraud, abuse, strategic, reputational, and operational risks
Reviewed Gift Card and Credit Card projects for  Fraud, Credit and Payment Systems and suggested controls to mitigate / keep risk within acceptable limits for Bill To Cash.
Evaluated new products, processes and projects for fraud and credit risk, and suggested appropriate controls as needed.
Manage projects, provide requirements and testing support for Bill To Cash
Review and document root cause analysis of fraud issues. After analysis suggest mitigation. Monitor progress and report once issues are fixed.
Collaborate with Tax, IT Security, Legal and Compliance teams to ensure that risk is handled adequately for platforms, portals and infrastructure.

New Product Risk

Developed business requirements for new system and process implementations and enhancements that impacted data privacy, OFAC and other regulatory requirements
Collaborate with functional teams in developing business requirements and business controls in implementation plans
Drove process improvement and control implementation projects, while dealing with ambiguity
Developed documentation of processes, risks, and controls and worked with owners to assign accountability

Verizon Global Fraud Operations

• Lead the multiple audit planning, scoping, execution, and reporting based on identified risks for applications, systems and business processes
• Performed assessments and audits, suggested control improvements, documented technical issues to get multiple stakeholders to agree on recommendations  
• Audited against various frameworks, it audit and assurance standards like ISO 27001, SSAE 16, SSAE 18 SOC, CIS, NIST CSF, and others

Verizon Internal Audit

Rutgers University

• Lecturer for 400 level course in Information Security
• Rated 4.6 / 5.0 by students

Lecturer

Harman International

• Lead Foreign Corrupt Practices Act (FCPA) audits in Brazil and U.K. 
• Lead IT and integrated audits saving Harman International over twice our department budget for the year. 
• Evaluated purchase application and transactions, and detected double payments leading to the software vendor agreeing to return 1.5 million dollars during a Purchase Card audit.
• Prepared detailed documents, reports and observations supporting audit findings. 
• Design reports and data visualization dashboards for SOX audits.

Senior IT Auditor

Kershaw K. Khumbatta P.C

Associate

Open Information Systems Security Group

Vice President

Synerzy Software Solutions Inc.

Risk Assessment, Review and remediation of Systems and Processes.

Senior Consultant

Clayton Holdings Inc.

SOX IT Specialist

Prudential Financial and Management Services Ltd.

Managed engagements for IT Risk Assessments, Security Reviews, Pre- and Post-Implementation Reviews, Application Reviews  documentation and testing.

I am a risk management professional, leading system and process improvements with business owners to reduce risk. Guide business teams on Third-Party compliance and vendor assessment for risk mitigation to achieve business objectives. I anticipate bottlenecks and manage escalations. I use data to manage risk, quantify the impact, and translate risk metrics for business stakeholders. 
I help business owners execute cybersecurity strategies and accept risks appropriately based on quantified risk appetite.
With over 15 years of experience identifying, assessing, and driving remediation for information security professional risks in applications, I understand unique client challenges across multiple industries.
I am a sought-after resource to review risks in emerging tech like cloud security, blockchain, AWS security, and complex risk assessments.

Niloufer holds multiple certifications in IT Security (CISSP, CCSP), Risk (OPEN Fair), Privacy (CDPSE), Audit (CISA, CIA), and Fraud (CFE). She is a Certified Public Account licensed to practice in New Jersey. And a Chartered Global Management Accountant (CGMA).

Niloufer has authored two patents for System For And Method of Generating Visual Passwords (US 9,171,143 B2) and Establishing An Alternate Call Path Using Short-Range Wireless Technology (US 9,392,523).
Niloufer teaches part-time at Rutgers University, the state university of New Jersey, and is the organizer of the largest cybersecurity career MeetUp group and creator of the YouTube Channel "Cybersecurity Career Talks."

Niloufer co-founded two nonprofits Step Up Skill in 2020 and (ISC)2 New Jersey Chapter in 2012.

Niloufer Tamboly

Paysign, Inc.

Information Security Manager

Purdue University

CNIT 471 : Vulnerability Analysis and Testing , CNIT 271: Cybersecurity Fundamentals II

As a Teaching Assistant for the advanced security course, my role encompasses a range of responsibilities aimed at providing students with valuable insights and hands-on experience in vulnerability analysis and network penetration testing. With a deep understanding of the methods, techniques, and tools required to assess the security of computer networks, infrastructure, and applications, I am dedicated to fostering a secure learning environment.

My responsibilities include facilitating practical exercises and creating a safe space for students to explore and apply their knowledge in a controlled setting. I ensure that our activities align with ethical standards and legal considerations, avoiding any potential risks to network availability and maintaining a strong focus on the importance of ethical hacking.

Over the course of my tenure as a Teaching Assistant, I have had the privilege of guiding and mentoring more than 500 students, helping them develop essential skills in the field of advanced security. My commitment to promoting a hands-on learning experience and ensuring the responsible use of security testing techniques has been instrumental in shaping the next generation of cybersecurity professionals.

Graduate Teaching Assistant

Vail Systems

In my role at Vail Systems, I took the lead in automating critical security checks, focusing on threat detection within a substantial portfolio that encompassed over 10,000 Jira Tickets and 2000 Confluence Pages. Leveraging my expertise, I harnessed the power of API calls and caching mechanisms to optimize vulnerability detection processes. Furthermore, I spearheaded the implementation of advanced detection mechanisms and precise vulnerability scans, enhancing our ability to identify and catalog sensitive information instances, such as API keys, SSNs, and Credit card numbers.

To bolster our security efforts, I deployed Truffle Hog, effectively mitigating false positives and eliminating more than 500 inaccurate findings. This involved seamlessly integrating the entire security scanning process into our CI/CD pipeline through Jenkins and GitLab, ensuring continuous automated security checks. Additionally, I conducted a comprehensive review of security architecture standards, covering critical areas such as AWS security, authentication mechanisms, Docker container standards, and web application security standards. My meticulous analysis and documentation spanned over 5 Security Confluence Pages, affirming our commitment to robust security practices and industry-leading standards.

Security Engineer Intern

KPMG

During my tenure at KPMG as Risk and Control Advisor, I played a pivotal role in enhancing the cybersecurity landscape for diverse clients. I customized information security incident management policies, tailoring them to the unique needs of a prominent blockchain enterprise. By aligning these policies with the client's IT Line of Defense model and ISO27001 standards, I substantially fortified their digital resilience, enabling a proactive defense against cyber threats.

Additionally, I led the end-to-end implementation, documentation, and testing of SOX controls for a prominent Oil and Gas Client. My efforts ensured compliance with industry standards while minimizing operational risks. My role extended to conducting over 15 gap assessments across frameworks such as CIS, PCI-DSS, NIST 800-53, HIPAA, HITRUST, ISO 27001, and CSF. These assessments, including thorough Third-Party Risk Management (TPRM) and Business Impact Analysis (BIA) evaluations, strengthened the client's risk management framework, aligning it with industry-leading standards.

Furthermore, I orchestrated the scoping, design, and operational effectiveness walkthroughs for controls based on the Cloud Security Alliance's Cloud Control Matrix (CSA-CCM) framework. This initiative aimed to enhance security measures for cloud deployments using platforms like AWS, GCP, and Azure Cloud. In addition, I facilitated the integration of identity and access management controls, deploying actual control descriptions for over 50 controls. This fortified our defense against external security threats.

In the realm of cloud-based applications, specifically Azure, I devised a comprehensive set of security measures. My role extended to executing more than 20 controls within ServiceNow, ensuring compliance with Sarbanes-Oxley and GDPR legal and regulatory reporting requirements. This multifaceted experience underscores my commitment to bolstering security measures and achieving compliance in dynamic environments.

Associate Consultant

Tata Consultancy Services

As an ISM under Delivery Risk and Governance Domain, I conducted over 25 ISMS and QMS audits for the Administration and Infrastructure teams.  My responsibilities extended to reviewing security training materials and BCP/DR reports with a focus on the principles of Confidentiality, Integrity, and Availability This ensured that the organization continued to comply with ISO 9001 and ISO 27001 standards, maintaining robust security practices. I took the initiative to organize the InfoSecurity Fest, a large-scale event involving more than 52,000 associates.

Furthermore, I played a pivotal role in directing the efficient installation of physical security controls, guaranteeing compliant network architecture at two new locations with a combined associate capacity of 20,000. I also spearheaded the integration of EDR and Security Information and Event Management (SIEM) solutions to enhance real-time threat monitoring and incident response capabilities. I also actively engaged in authorizing over 50 Vulnerability Assessment (VA) exceptions and Firewall reconciliation reports for PaloAlto and Cisco, ensuring precise configuration management.  As part of the CSO initiative, I conducted active reconnaissance scans through PowerShell scripts, leading to the discovery and mitigation of over 20 obsolete versions of internal Firewalls and Routers. 

My role also encompassed investigating more than 20 security violations related to sensitive data, providing valuable insights that informed Human Resources in executing disciplinary actions, thereby upholding security standards.  In addition to these responsibilities, I facilitated more than 10 external audits, including SOC1 and SOC2 assessments, ISO 27001 certifications, and ISO 22301 TUV re-certifications for the fiscal year 2020-21.  Lastly, I managed over 40 onboarding sessions, with a primary focus on information security awareness, fostering a culture of security consciousness within the organization.

FLYTTA

In my role, I spearheaded initiatives to streamline operations and enhance security measures, showcasing a strong commitment to efficiency and compliance. By developing scripts that automated routine tasks, I achieved a notable 25% reduction in manual hours while ensuring adherence to critical application security standards such as OWASP Top 10 and compliance requirements. Additionally, I implemented RESTful APIs to optimize data exchange processes, enhancing efficiency and enabling seamless communication. Leveraging my expertise, I successfully reduced query times by 40% through strategic database optimization, utilizing indexes and normalization techniques to improve performance.

Collaborating closely with the Cloud-Based Analytics team, I played a pivotal role in investigating client-reported issues, aligning with CIS controls to address concerns effectively. Furthermore, I designed and developed a location services application, utilizing AngularJS, MySQL, and Flask server technologies. This innovative solution automated processes that previously required manual intervention, resulting in a significant 35% reduction in operational overhead. Throughout these endeavors, I prioritized security considerations, ensuring that robust security measures were embedded throughout the development lifecycle.

Moreover, I actively utilized version-control systems, code review tools, and Agile management practices to foster collaborative teamwork and ensure project success. By integrating security considerations into every stage of development, I contributed to a culture of security awareness and compliance, ultimately driving synergy and efficiency within the team.

Software Automation Engineer Intern

Model United Nations

Oversaw logistics and delegate affairs for the 3rd successive year of MUN at BVRIT. Additonally, took up the responsibility to wind up all the fiscal estimates for the campaign.

Deputy Secretary General

Digital Ozone

Content Writer

I was responsible for engaging the students in Model United Nations conference having said that it could majorly contribute to the political aspect and could also change the perspective students had towards politics. Since it was the first time, our team had to give it everything to try and involve most of the students and at the end we pulled off a remarkable campaign.

Under Secretary General - Delegate Affairs

Elyuxen

I started off my political experience by writing articles which were more inclined towards central government. Managed to publish around 4 articles/ week. Mainly had a predilection towards student union politics and my endeavour was to reciprocate that in my college. Inspired by Shashi Tharoor and Sachin Pilot

Freelance Columnist

As an experienced Information Security Manager, I specialize in Delivery Governance, Risk & Security, and possess a proven track record of assessing organizational security measures to identify potential vulnerabilities and implement effective controls as per ISO 27001 standards. With expertise in DLP, VAPT, incident management and response, endpoint detection, forensic imaging, and more, I have a strong background in managing security audits, investigations, and reconciling ACL's & Firewall Rules.

With a keen eye for detail, I have conducted business impact, legal & regulatory assessments, performed control scoping for over 100 control objectives, and upscoped and downscoped FCM & Sarbanes-Oxley (SOX)-related cloud applications. I have translated technical, legal, and regulatory compliance obligations into cohesive security controls and executed implementation, documentation, and testing of controls under the company's SOX corporate governance program.

taplio

The Battle

Niloufer Tamboly

Anirudh Vempati

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?