Name : Jayant Kumawat
Role : GRC & IT Risk Analyst
Speciality : Vulnerability Management · TPRM · ISO 27001 · IT Risk
Focus : Technical Security × Governance × Risk
Current : Building deeper expertise in AI Governance
Location : Pune, IndiaI work at the intersection of technical security and governance — turning vulnerability data, third-party risk, and security controls into decisions that leadership can act on.
My work focuses on identifying security exposure, assessing risk, improving governance, and communicating technical findings in a business-ready format.
Platforms → Qualys VMDR · Tenable.SC · Nessus
Methods → Vulnerability Assessment · CVSS · Risk-Based Prioritisation
Activities → Asset Exposure · Remediation Tracking · SLA Monitoring
Reporting → Executive Dashboards · Risk Metrics · Stakeholder Reporting
Focus: Designing and operating vulnerability management processes across large-scale IT/OT environments.
Frameworks → ISO/IEC 27001 · ISO 27001:2022
Activities → Risk Registers · Control Mapping · SoA · Audit Readiness
Controls → Annex A · Information Security Controls
Reporting → Management Reporting · Risk Communication
Focus: Building practical security governance programs that connect controls, risk, evidence, and business requirements.
Assessment → Vendor Security Reviews · Due Diligence
Evidence → SOC 2 Type II · ISO 27001 Certification Scope
Method → Vendor Tiering · Exposure Assessment
Outputs → Risk Assessments · Questionnaires · TPRM Processes
Focus: Assessing vendor exposure and translating third-party security information into structured risk decisions.
Focus → AI Governance · AI Vendor Risk
Frameworks → NIST AI RMF · ISO/IEC 42001 Fundamentals
Approach → Applying TPRM Methodology to AI Vendor Assessments
Status → Currently Learning / Self-Directed Study
Focus: Understanding how established governance and third-party risk practices can be applied to AI adoption and AI vendor risk.
Vulnerability Management
├── Enterprise vulnerability assessment
├── Risk-based prioritisation
├── CVSS-based analysis
├── Remediation SLA tracking
└── Executive vulnerability reporting
Third-Party Risk Management
├── Vendor security assessment
├── SOC 2 Type II review
├── ISO 27001 scope review
├── Vendor tiering
└── Due-diligence questionnaires
GRC & IT Risk
├── ISO 27001-aligned governance
├── Risk register development
├── Annex A control mapping
├── Statement of Applicability
└── Leadership / board-ready reporting
A self-built Information Security Management System covering:
- Risk Register
- Tangible & Intangible Asset Register
- Statement of Applicability
- Core Information Security Policies
- Control Mapping
- Third-Party Risk Management Process
- Vendor Tiering
- Due-Diligence Questionnaires
End-to-end vulnerability management program design using Qualys, including:
- Vulnerability findings and asset exposure tracking
- Remediation SLA monitoring
- Risk-based prioritisation logic
- Executive dashboards
- Stakeholder reporting
A socket-based cybersecurity learning project for:
- TCP port scanning
- Service identification
- Banner fingerprinting
- Basic web-server assessment
- Multi-target scanning
- Structured security reporting
| Credential / Program | Issuer / Source | Status |
|---|---|---|
| 🛡️ Qualys Certified Specialist — VMDR | Qualys | ✅ Certified |
| 📋 CISA — Certified Information Systems Auditor | ISACA | 🔄 In Progress |
| 🔐 ISO/IEC 27001:2022 — Information Security Controls & Implementation | Professional Development | ✅ Completed |
| 🕸️ OWASP Top 10 — Deep Dive | OWASP | ✅ Completed |
| 🌐 Ethical Hacking — Network Scanning | Nmap & Nessus | ✅ Completed |
Certification status is presented based on the latest profile information supplied for this README.
learning = {
"ai_governance": [
"NIST AI RMF",
"ISO/IEC 42001 fundamentals"
],
"application": [
"AI vendor risk assessment",
"TPRM methodology for AI adoption"
],
"direction": "Security Governance × AI Risk"
}01 Technical Security
Understand vulnerability exposure and security findings.
02 Risk Thinking
Translate technical findings into business risk.
03 Governance
Connect risks with controls, frameworks, evidence, and accountability.
04 Third-Party Risk
Assess vendors using structured security and exposure criteria.
05 Executive Communication
Turn complex security information into clear decision-support reporting.
Current_Focus:
- GRC & IT Risk
- Vulnerability Management
- Third-Party Risk Management
- ISO 27001 Governance
Emerging_Focus:
- AI Governance
- AI Vendor Risk
- Responsible AI Security Practices
Long_Term:
- Security Governance
- AI Security & Risk
- Cybersecurity ConsultingOpen to opportunities across GRC, IT Risk, Vulnerability Management, and Third-Party Risk.
Security becomes actionable when technical exposure is translated into business risk.