Ayush Rai

Background

About Ayush Rai

I lead and drive the organization’s InfoSec GRC function, working directly with the CISO and executive leadership to shape enterprise-wide security, compliance, and risk governance strategies. I bring deep InfoSec GRC expertise across Consulting, IT Distribution & Cloud Platforms, E-commerce, and BFSI sectors. I’ve built and scaled high-performing GRC teams, implemented governance frameworks from the ground up, and led cross-functional initiatives to strengthen the security posture, including emerging areas like AI risk governance and compliance. I spearhead cloud and AI security programs from the ground up, governed RBI’s CSITE/CSAP assessments, control testing, third-party risk management, audit readiness, policy lifecycle management, incident response, phishing campaigns, and enterprise AI security frameworks—aligning them with evolving regulatory and threat landscapes. With a seasoned perspective on both technical and regulatory domains, I guide strategic security initiatives, mentor GRC professionals, and ensure leadership has real-time visibility via security metrics into compliance health, risk posture, AI governance maturity, and remediation progress. I bring experience across the second and third lines of defence, driving governance, risk, and compliance across key domains in Information Security and IT audit, including: NIST CSF NIST AI RMF ISO27001 ISMS ISO42001 AIMS SOX Audits SOC2 Audits PCI-DSS Audits NYDFS Attestation Third-Party Vendor Risk Assessment Vulnerability Remediation Policy Development & Review Risk Assessment aligned with NIST Framework Enterprise Risk Register Maintenance Information Security Awareness Campaigns ITGC/GITC and ITAC RBI CSITE/CSAP Incident Response Management Coordination of Internal & External Audits, VAPT, and Risk Assessments Proficient in leading GRC operations using the following tools: OneTrust – Third-Party Risk Assessment AuditBoard – NIST Risk Assessments SOXHUB – SOX Control Testing Documentation & Tracking CyberGRX – Vendor Risk Assessment HyperProof – PCI-DSS Coordination & Evidence Management KnowBe4 – Phishing Campaigns & End-User Awareness SecureCode Warrior – Secure Development Training Programs