Uzma Nehal

Skills

IT Audit & Internal Controls: IT General Controls (ITGC), Access Security, Change Management, IT Operations, SDLC Controls, Control Design Assessment, Control Effectiveness, Control Gap Analysis, Audit Evidence Review, Audit Documentation
Risk & Assurance: IT Risk Assessment, Technology Risk, Internal Control Assessment, Control Deficiency Identification, Risk Mitigation, Risk Remediation, Management Action Plan Follow-Up, Third-Party Risk Management (TPRM)
Audit & Assessment Activities: Walkthroughs, Stakeholder Interviews, Evidence Collection and Validation, Control Testing, Risk and Control Workshops, Sampling and Review Procedures, Audit Reporting
Frameworks & Standards: SOC 2, ISO/IEC 27001, ISO 31000, NIST CSF, NIST SP 800-53, NIST SP 800-50, CMMC, COBIT, PCI-DSS
Tools & Technologies: RSA Archer, ServiceNow, Qualys, Nessus, FortiSIEM, Cisco Umbrella

About

Cybersecurity Risk and IT Audit professional with 7+ years of experience in technology risk, IT audit, and compliance, including consulting experience with Accenture and PwC and engagements supporting financial-services organizations. Certified Information Systems Security Professional (CISSP), ISO 31000 certified, and ISO/IEC 27001 certified. Experienced in assessing IT General Controls (ITGC), conducting risk assessments, walkthroughs, control testing, evidence reviews, and identifying control deficiencies and remediation opportunities. Strong background in SOC 2, ISO/IEC 27001, NIST SP 800-53, COBIT, PCI DSS, and third-party risk management (TPRM) with proven ability to communicate risk and control observations clearly to business and technology stakeholders.