Aatif Shamim

Manages technology governance, risk, and compliance functions for a major banking institution with global operations. Conducts comprehensive risk assessments, internal audits against international standards (ISO 9001, ISO 20000, ISO 27001, ITGC), and coordinates with stakeholders to ensure regulatory compliance across multiple jurisdictions. Collaborates with BIG4 audit firms and internal teams to maintain compliance with local and international banking regulations, while overseeing risk mitigation, incident management, and security awareness programs.

• Conducting risk assessments, tracking mitigation plans and developing risk metrics and reports
• Reviewing the technology risk control library to ensure alignment with organizational standards
• Analyzing IT Risk Acceptance based on Risk Ratings & Compensating Controls, and coordinating with stakeholders to obtain approvals
• Performing Quality Checks on Risk Control Self-Assessments (RCSAs) to identify and address gaps
• Conducting internal audits in accordance with ISO 9001, ISO 20000, ISO 27001, ITGC, SIA, ISR and CPR regulations and standards
• Developing, implementing & maintaining Quality Management, Service Management & Information Security Systems
• Gathering Key Risk Indicator (KRI) data and developing action plans for improvement
• Reviewing operational risk incidents in line with the Incident Management policy
• Updating security policies, standards, processes and conducting security awareness programmes
• Working with internal teams and BIG4 audit firms as per the bank's audit calendar and regulators' requirements
• Compliance maintenance and sustenance as per applicable local regulations and banking regulations of global Central/Federal/Reserve banks
• Managing BAU activities including outsourcing assessments, cloud materiality assessments, data residency assessments, enterprise architecture reviews, change management, and DR/BC exercises

Provided technology risk advisory services focused on IT service management, compliance frameworks, and cloud security. Developed and improved service management systems to achieve ISO 20000 certification, created IT risk management frameworks, and conducted cloud security risk assessments. Worked with stakeholders to address audit findings and presented security dashboards to senior management while advising on security improvements based on industry standards.

• Documented, reviewed, maintained and performed gap analyses of IT Service Management (ITSM) policies and procedures
• Improved Service Management System (SMS) domains to obtain ISO 20000 certification
• Developed the IT Risk Management framework and standardized the Risk Register
• Conducted cloud security risk assessments and reported non-conformances
• Followed up with stakeholders on audit findings and presented audit dashboards to senior management
• Assisted with security improvements, advising based on security standards and frameworks
• Designed risk framework and maintained risk register tracking
• Managed risk acceptance, mitigation and baseline with business, process and control owners

Led Information Security Management System (ISMS) operations with focus on maintenance and sustenance for a financial services client. Managed people, processes, and technology across cybersecurity and information security domains, developed and enforced InfoSec policies, and conducted compliance audits against multiple standards. Designed risk frameworks, managed data privacy and security controls, and conducted regular awareness training and security assessments.

• Managing and overseeing the whole ISMS with an objective of maintenance and sustenance
• Managing people, process & technology with respect to CyberSec and InfoSec domain controls
• Developing, enforcing, and maintaining InfoSec policies, procedures and guidelines
• Conducting awareness, training and quizzes
• Periodically conducting MSB, PAR, UAR scans and ARB and SteerCo meetings
• Conducting audits pertaining to different standards, legal, statutory and regulatory requirements
• Keeping track of applicable local regulations and standards as well as international ones
• Managing PII, PHI data privacy, security and retention
• Designing risk framework and keeping track of risk register
• Managing risk acceptance, mitigation and baseline with business, process and control owners

Served as principal consultant focused on establishing and enhancing information security and service management frameworks. Documented and implemented IT policies and procedures aligned with industry standards, reviewed and updated ISMS and ITSMS policies for compliance, and managed change management processes for IT services. Led the development of RSA Archer tool implementation for audit, risk, and policy management modules.

• Documented and implemented IT Policies & Procedures within the organization, ensuring alignment with industry standards
• Reviewed and updated Information Security Management System (ISMS), Information Technology Service Management System (ITSMS) & Information Security Regulation (ISR) policies and procedures
• Managed Change Management for all IT services, including impact assessment, prioritization, scheduling, authorization and implementation
• Orchestrated the development of RSA Archer tool for Audit, Risk and Policy Management modules

Managed IT and cybersecurity operations including audit coordination, risk management, and quality assurance. Conducted gap analyses based on process frameworks, facilitated management review meetings, and developed performance dashboards. Led information security awareness initiatives, performed software quality assurance audits, and managed IT risk across all functions while ensuring closure of audit findings.

• Liaised with Internal & External Audit Teams to ensure comprehensive IT audits
• Conducted Gap Analyses based on process frameworks to identify improvement areas
• Facilitated Management Review Meetings and developed performance dashboards
• Defined and tracked IT KPIs across all IT functions
• Managed IT Risk by identifying, collating, assessing, treating & monitoring risks across IT functions
• Initiated and led activities to raise Information Security Awareness and promote Security Campaigns
• Performed audits as part of Software Quality Assurance; reported non-conformances in Development, Network, Infrastructure, Hardware and Security projects
• Collaborated with relevant teams to ensure closure of audit findings

Provided consulting services focused on security compliance, intellectual property management, and software asset management for prestigious client accounts. Identified security vulnerabilities, ensured compliance with government regulations and standards, and created awareness ecosystems around compliance risks and corporate governance. Managed software licensing reviews, intellectual property protection initiatives, and advised key decision makers on asset management strategies.

• Identified security vulnerabilities and kept track of the latest software updates, achieving compliance with standards and government regulations
• Created an Ecosystem and raised awareness of the risks associated with non-compliance and its impact on Corporate Governance
• Advised on the management of key assets such as Intellectual property, brands and software
• Managed prestigious accounts for engagement with key decision makers of organizations
• Helped find, record, and organize licenses & documentation for each software title & version to create a software license Library
• Assisted stakeholders with IPR and Copyright products, software asset management and software licensing review

Managed business operations with focus on business analysis, strategy development, and project management. Gathered and analyzed requirements for product development, designed and documented strategies for business partner selection, and managed project interdependencies and risks. Recommended business actions based on analytical findings and communicated progress to stakeholders and leadership teams.

• Business analysis activities including gathering requirements & analysis for the product and target industry
• Designed and documented strategy for profiling, screening and selection of business partners
• Identified and managed project interdependencies, gaps and risks as required
• Recommended business actions based on analytical findings; defined new metrics, techniques and strategies to improve performance
• Communicated progress and direction within the team, stakeholders and leadership team

Managed information security, service management, and quality assurance functions aligned with ISO standards (ISO 27001, ISO 20000, ISO 9001). Developed and maintained security and quality management policies, conducted risk assessments and gap analyses, and performed compliance audits. Facilitated process improvements, tracked quality metrics, and coordinated with stakeholders to resolve non-conformances and drive continuous enhancement.

• Developed and maintained information security and service management policies, procedures and guidelines
• Conducted risk assessments based on vulnerabilities and threat values, devised risk mitigation controls
• Performed Gap Analysis in line with ISO 27001 & ISO 20000, providing recommendations
• Conducted service and security management reviews
• Created and updated Quality Management procedures, manuals and templates in line with ISO 9001 standards
• Facilitated teams in identifying process improvements for continuous enhancement of the QMS
• Conducted quality audits, reported non-conformances, and tracked quality metrics and issues
• Coordinated with stakeholders to resolve non-conformances and drive improvements