Head of Information Security — Risk Group
Anuugya Sarraswat
Banking Risk Management & Cybersecurity Governance Leader
Turning cyber risk into business confidence.
Global cyber security risk governance for regulated financial markets.
0
Years in banking cybersecurity & risk
0
Major cyber incidents through crisis
0+
Security professionals led & mentored
0+
Critical applications assessed & remediated
0
Internal promotions at QIB
THE EXECUTIVE PROFILE
Risk is a business conversation.
The strongest security functions make the board more decisive, the regulator more confident, and the business more resilient.
With 18 years across banking cybersecurity, technology risk, and regulatory governance, Anuugya Sarraswat currently leads Information Security at Qatar Islamic Bank under the Risk Group as an independent Second Line of Defense.
Over 11 years at QIB and four internal promotions, he built the function from inception and became a trusted advisor to the Operational Risk Management Committee, Board Audit & Risk Committee, Qatar Central Bank, and peer CISOs.
His next chapter is intentionally global: bringing second-line risk governance and regulator-aligned security leadership to India’s BFSI and fintech ecosystem, and to regulated markets across Europe, the Nordics, the Middle East, and beyond. His QCB experience transfers naturally to RBI, SEBI, DORA, NIS2, GDPR, and EBA conversations.
CORE EXPERTISE
Make risk legible.
Make resilience repeatable.
A board-to-control perspective across governance, resilience, identity, data, applications, cloud, and emerging AI risk.
SECOND LINE OF DEFENCE
Cyber Risk & Governance
ICT risk, control assurance, risk appetite, KRIs, policy frameworks, and board-ready reporting.
REGULATOR-READY POSTURE
Regulatory Compliance
QCB Technology Risk & Data Protection mapped to NIST, ISO 27001, PCI DSS, CIS Controls, CSA CCM and GDPR.
CALM IN THE FIRST HOUR
Cyber Resilience & SOC/MDR
24×7 SOC oversight, incident response governance, crisis leadership, threat intelligence, and cyber recovery.
CONTROL THE CROWN JEWELS
Identity, Access & Data Security
SailPoint IAM, PAM, RBAC, SoD, Forcepoint DLP, IBM Guardium, encryption, and field-level masking.
SECURE CHANGE AT SCALE
Application & Cloud Security
DevSecOps, secure SDLC, API security, Azure/SaaS governance, third-party ICT risk, and Temenos T24 assurance.
RESPONSIBLE ADOPTION
AI Security Testing & Governance
AI security testing, GenAI risk oversight, prompt-injection defence, input/output validation, vendor risk, and data protection guardrails.
MAKE RISK INVESTABLE
Risk-Based Value & Cost
Build organization-wide cyber risk profiles, connect exposure to business value, and frame estimated control costs for leadership decisions.
CAREER HISTORY
A builder’s track record.
Three roles across 18 years — a deliberate long-tenure pattern built on institutional trust, not title chasing.
Independent Second Line of Defense leader across technology and cyber domains, trusted by the Risk Group, ORMC, Board Audit & Risk Committee, and QCB.
- Built the Information Security function from inception into a 15+ professional multi-domain organisation spanning GRC, SOC, infrastructure and application security, and data privacy.
- Led SailPoint IAM transformation, RBAC redesign, SoD controls, PAM, MFA, and access certification across critical infrastructure, including Temenos T24 migration.
- Delivered SOC/MDR transformation across CrowdStrike, Exabeam CLM, and LogRhythm; National Cyber Drill participation achieved an Excellent rating.
- Owned QCB Technology Risk Circular self-assessment and QCB Data Protection 2026 readiness with clause-level mapping to NIST, ISO 27001, PCI DSS, CIS Controls, and CSA CCM.
- Drafted and executed the bank's Cyber Recovery and out-of-country DR security strategy, including secure replication, isolation, access governance, and recovery assurance.
Architected enterprise security solutions and led multi-disciplinary consulting and engineering teams for global BFSI, telecom, and government clients.
- Designed vendor-agnostic SIEM, IAM, endpoint, and network security architectures.
- Led pre-sales and engagement management for large security RFPs and managed-service transitions.
Held CSO accountability for enterprise security strategy, policy, operations, incident response, and vendor controls.
- Built and led the security team from the ground up.
- Established the operating rhythm across policy, security operations, incident response, and supplier controls.
STRATEGIC PROGRAMS
Proof in the programs.
The work is most visible when a complex mandate becomes a clear operating advantage.
Detection needed to mature across a 24×7 banking environment.
Governed CrowdStrike, Exabeam CLM, LogRhythm, and threat-intelligence integration.
National Cyber Drill participation achieved an Excellent rating.
Access risk needed a lifecycle and governance reset.
Led SailPoint automation, role mining, RBAC, SoD, PAM, MFA, and certification.
Critical infrastructure and Temenos T24 gates received full security sign-off.
Regulatory readiness required clause-level traceability.
Mapped QCB requirements across PDPPL, NIST, ISO 27001, PCI DSS, CIS, and CSA CCM.
A regulator-ready posture with remediation already in motion.
Geopolitical tensions amplified state-sponsored, DDoS, phishing, and remote-access risk.
Validated controls across network, endpoint, email, mobile, remote access, and SWIFT.
Zero successful cyber-attacks and uninterrupted banking operations.
The bank needed recoverability without compromising data integrity.
Designed isolation, secure cross-site replication, DR access governance, and assurance testing.
A BCM-aligned cyber recovery solution built from the ground up.
Cloud adoption needed to move with regulatory confidence.
Governed Azure/SaaS risk assessments, Zero Trust controls, exit strategy, and Windows 365 security.
Secure data boundaries and conditional access across a modern workplace rollout.
CREDENTIALS
Depth that travels.
LEADERSHIP PHILOSOPHY
Calm is a control.
Translate risk to business value. Build teams that can carry the standard. Meet the regulator from a position of confidence.
ENDORSEMENTS
Let the work speak first.
Board and peer endorsements can be added here when supplied.
This section intentionally remains a placeholder — no testimonial content was provided in the source CV.OPEN TO THE NEXT MANDATE
Let’s discuss what needs to be resilient.
Open to opportunities in India and globally — finance, banking, risk, and information security leadership.