Cybersecurity GRC & Risk Automation

Shravya Pasupuleti

TEXAS +1-469-***-**** *****************@*****.*** LinkedIn

Summary

Cybersecurity GRC and Risk professional with 4 years of experience in technology risk, cybersecurity controls, compliance, audit readiness, third-party risk, and remediation across financial services and payments. Skilled in NIST CSF, ISO 27001, PCI DSS, SOC, AWS, cloud security, application security, Python, SQL, and control testing. Experienced in automating GRC workflows and translating technical risks into clear business actions that strengthen controls and compliance. Collaborative partner to security, engineering, compliance, audit, and business teams focused on reducing risk and improving governance.

Skills

Cybersecurity GRC & Risk: Governance Risk & Compliance (GRC), Cybersecurity Risk Management, Technology Risk, IT Risk Management, Risk Assessments, Control Assessments, Control Testing, Risk & Control Mapping, Residual Risk, Risk Registers, Issue Management, Exception Management, Remediation Tracking, Risk Prioritization

Compliance & Security Frameworks: NIST CSF, ISO 27001, PCI DSS, SOC 1, SOC 2, Compliance Assessments, Audit Readiness, Security Assurance, Secure SDLC, Privacy, Data Security

Third-Party Risk: Third-Party Risk Management, Vendor Risk Management, Vendor Due Diligence, Security Questionnaires, SOC Report Reviews, Penetration-Test Report Reviews, Contractual Security Requirements, Compensating Controls

Cloud & Infrastructure Security: AWS, Cloud Security, AWS IAM, Encryption, Network Security, Logging, Configuration Management, Vulnerability Management, Kubernetes, Docker, Serverless Security, Cloud-Native Security

Application & API Security: Application Security, Java, Spring Boot, REST APIs, Authentication, Authorization, Secrets Management, Secure Configuration, Change Management, API Security

GRC & Security Tools: ServiceNow IRM/GRC, Archer IRM, Jira, Microsoft Excel, SharePoint, Power BI, AWS IAM, AWS CloudTrail, AWS Config

GRC Automation & Analytics: Python, SQL, Compliance Automation, Evidence Collection Automation, REST API Integration, Control Inventory Reconciliation, Risk Data Analysis, Compliance Reporting, Workflow Automation

AI & Emerging Technology: Generative AI, AI Governance, Responsible AI, AI Security, AI Risk Assessment, AI-Assisted Compliance Analysis, Transparency, Explainability, Emerging Technology Risk

Audit & Governance: Internal Audit Support, External Assurance Support, Audit Evidence Management, Control Ownership, Assessment Coordination, Root Cause Analysis, Corrective Action Plans, Risk Escalation, Executive Reporting, Cross-Functional Collaboration

Certification

Isc2 certified in cybersecurity

Experience

Cybersecurity Risk & Compliance Analyst PayPal, USA

May 2024 – Current

Directed cybersecurity risk and control assessments across payment platforms, applications and cloud services, mapping safeguards to NIST CSF, ISO 27001, PCI DSS and SOC 1/SOC 2 requirements to identify control gaps, evaluate residual risk and prioritize remediation with cybersecurity, engineering and compliance teams.

Automated compliance evidence collection using Python, SQL and REST APIs, bringing cloud, application and identity evidence into repeatable workflows and reducing manual preparation by approximately 30% for recurring assessments and audit requests.

Evaluated secure SDLC controls across Java, Spring Boot, Node.js and React.js applications running on AWS and Kubernetes, reviewing IAM, authentication, authorization, secrets management, logging and vulnerability remediation to strengthen application risk posture for product and platform engineering teams.

Coordinated third-party risk assessments for technology and payment-service providers, reviewing security questionnaires, SOC reports, penetration-test results and remediation plans while tracking 35+ vendor assessments annually through established risk governance processes.

Strengthened risk and remediation reporting by converting technical vulnerabilities and control deficiencies into clear business-impact statements, maintaining risk registers, documenting exceptions and following corrective actions through closure for security leadership and technology risk partners.

Managed 150+ control evidence artifacts per review cycle, validating ownership, testing status, exceptions and remediation commitments across security and engineering teams to improve evidence traceability and support internal and external assurance activities.

Applied AI-assisted analysis to organize control evidence and identify recurring risk themes, incorporating AI governance, responsible AI, privacy, security, transparency and explainability considerations into reviews of emerging AI-enabled financial-services use cases.

GRC Analyst I Capital One, USA

Oct 2022 – Apr 2024

Performed technology risk and control assessments for banking applications, infrastructure and cloud workloads, mapping controls to NIST-aligned cybersecurity, privacy and data-security requirements to identify deficiencies, assess business impact and establish remediation actions with application owners and security teams.

Assessed AWS security controls across cloud-native and serverless workloads, reviewing IAM, encryption, logging, network security, configuration management and vulnerability controls to validate effectiveness and communicate remediation needs to engineering and infrastructure stakeholders.

Developed Python and SQL reporting workflows to reconcile control inventories, evidence requests, issue status and remediation records, reducing repetitive reporting effort by approximately 25% and improving consistency across recurring GRC activities.

Reviewed application security controls across Java, Spring Boot and REST API-based services, validating authentication, authorization, secure configuration, logging and change-management practices to support secure software delivery and technology risk decisions.

Tracked 100+ control evidence items across recurring assessments and audit requests, validating completeness, ownership and issue status to improve evidence quality and reduce late-stage escalations across technology and cybersecurity teams.

Investigated cybersecurity and third-party technology risks involving vulnerabilities, access controls, service providers and data handling, documenting root causes, compensating controls and residual risk before escalating material findings through established governance processes.

Supported emerging technology risk reviews involving cloud automation and AI-enabled use cases, translating security and governance considerations into clear risk statements and documenting controls for technology leadership and risk partners.

Education

Masters in Computer Science Engineering

International Technological University, San Jose, California

Sep 2015

Contact this candidate