Kishan Mundra

About Kishan Mundra

I’m Kishan, and for the past ~10 years in consulting, I’ve worked closely with banking and financial services organizations on one recurring problem not the absence of controls, but the absence of clarity.Controls exist. Policies exist. Frameworks exist.Yet ownership is fragmented, risk is not clearly understood, and decisions are often reactive rather than intentional.My work focuses on changing that.I operate at the intersection of cyber risk, governance, and business decision-making assisting organizations move from fragmented security efforts to structured, risk-driven models that enable clarity, prioritization, and confidence.This includes designing and operationalizing enterprise frameworks that strengthen governance, support regulatory compliance, and build operational resilience, while aligning with global regulations and standards such as NIST, ISO 27001, UAE IA, GDPR, RBI Master Direction, DoRA, DPDPA etc.At the same time, I believe governance without visibility is incomplete. A key part of my work has been bridging governance with technology using security driven technology platforms and security analytics to bring visibility, actionable insight into how risk manifests in real-world operations and governance.What I find most meaningful is working across diverse teams security, technology, business, and leadership simplifying complexity, aligning perspectives, and facilitating decisions that balance risk with business priorities. This often involves executive reporting, regulatory engagement, and shaping how organizations think about security beyond compliance. Having worked with teams across the US, Europe, Singapore, and the GCC(UAE, Qatar), I have witnessed that while regulatory environments differ, the underlying challenge remains the same making security meaningful, not just compliant.If there’s one principle I consistently come back to, it’s this:Security is not about adding more controls: it’s about enabling better decisions.Areas of focus:• Cyber Governance, Risk & Compliance (GRC)• Enterprise Cyber Risk Management• Operational Resilience (BIA, BCP, Recovery)• Regulatory Compliance & Privacy (RBI Master Direction, UAE IA, DoRA, GDPR, DPDPA)• Technology Enablement, Board Visibility, and Security Analytics

Experience

1. Manager - IT Advisory and Technology Risk

   KPMG India

   Sep 2023 — Present · Gurugram, IN

   Lead cyber risk and governance engagements for banking and financial services clients, focusing on enterprise risk management, regulatory compliance, operational resilience, and privacy. Design and operationalize risk-driven security frameworks, working with cross-functional teams and leadership stakeholders to enable regulatory alignment and support risk-informed decision-making.Key EngagementsEnterprise Cyber Risk & Control Governance Framework | Leading UAE Bank (11 Geographies)Built enterprise control framework (500+ controls, 30+ domains), enabling risk-driven governance, control ownership (3LoD), and regulatory alignment across global operations.Cyber Risk & Resilience | IFSCA-Regulated GIFT City Banking OperationsAdvised on cyber risk and resilience (BIA, BCP, recovery), identified 10+ gaps, and enabled regulatory readiness for new banking operations.Enterprise Privacy Program (GDPR-Aligned)| Multi-Geography BankingOperationalized privacy program across 170+ applications and 500+ RoPA records, enabling scalable GDPR-aligned governance and risk mitigation.ISO 27001:2022 ISMS Modernization & CertificationLed ISMS transformation, control alignment, and audit readiness, ensuring successful certification under ISO 27001:2022.UEBA & Insider Threat Detection EnablementDefined 70+ use cases and operationalized UEBA detection, preventing 30+ anomalous user activity cases within a quarter.

Education

• PES University

  Bachelor of Engineering (BE), Electrical and Electronics Engineering

  2012 — 2016

• GrowthX®

  Product and Growth Program

Skills

• C
• Microsoft Excel
• Powerpoint