Karunesh Arora

About Karunesh Arora

Cybersecurity & Risk Leader with a proven track record of transforming risk assessment, governance, and control programs within complex financial institutions. I specialize in bridging the gap between technical risk mandates and practical business execution—empowering organizations to meet regulatory demands while enhancing operational resilience.My strength lies in building governance program across the organization and for translating risk concerns into actionable workflows, I’ve helped institutions significantly improve their risk posture and compliance outcomes.Specific successes within financial institutions include- RISK CONTROL SELF-ASSESSMENT (RCSA): Collaborate with process owners to document workflows and procedures as they relate to Risk Control Self-Assessment (RCSA) and identify controls/develop RCSA Key Metrics- AUDIT SUPPORT: Support/evaluate/interpret/address audit findings and observations and act as primary on IT processes. Document remediation plans for issues identified as part of various assessments to completion. Work with IAA to address observations and findings. Take charge of FED MRA findings as findings relate to Controls and Control Objectives. Track and maintain inventory and analyses of issues and incidents within OpenPages- BOARD-LEVEL RISK MANDATE: Defined key activities, set up formal Issue Management processes, and returned mandated risk, regulatory, and compliance program to original timeline. Moved issue status from 75% red/yellow status to 90% green status- NIST FRAMEWORK: As a cybersecurity and risk governance executive, I specialize in translating complex regulatory mandates—like NIST CSF and SSDF—into enterprise-wide strategies that drive resilience, accountability, and secure innovation. I lead cross-functional initiatives that embed security into the software development lifecycle, align DevSecOps practices with compliance objectives, and operationalize governance frameworks across financial ecosystems- RISK AND COMPLIANCE: Designed and executed enterprise RCSA programs with embedded DevSecOps controls, reducing audit findings by 40%. Delivered WORM-compliant solutions for FFIEC mandates, ensuring immutable logging and evidence retention. Partnered with regulators and auditors to remediate high-priority issues, improving risk posture from 75% red/yellow to 90% green.SPECIALTIESManagement & Stakeholder EngagementRisk Portfolio Vision, Strategy & ExecutionEnterprise Risk Management FrameworksRisk Rating, Control & RemediationRCSA / FED MRA / OCC Findings

Experience

1. VP - Application Security Governance

   Wells Fargo

   Dec 2024 — Present · New York, NY, US

   As Vice President of Application Security Governance at Wells Fargo, I lead strategic initiatives to fortify the security posture of enterprise applications across a complex financial ecosystem. My role focuses on embedding security into the software development lifecycle, driving compliance with internal and regulatory standards, and fostering a culture of secure coding practices. Implemented risk‑based vulnerability management, improving remediation SLAs and reducing critical findings across CI/CD pipelines for high‑availability SaaS products.Key responsibilities include:Overseeing governance frameworks for application security across business unitsPartnering with engineering, risk, and compliance teams to align security objectivesEnsuring Application Security Practices are adhered and reported on periodic basisDriving adoption of DevSecOps methodologies and automated security toolingReporting on security metrics and risk posture to executive leadershipI’m passionate about building resilient systems and empowering teams to innovate securely

Education

• New York Institute of Technology

  M.S, Computer Sciences

• Amrutvahini College of Engineering , Amrutangar, Tal.Sangamner, Dist. Ahmednagar 422608

  Bachelors, CS