Karthikeyan Ganesan

With 19 years of experience in Information Security and IT GRC, specializing in conducting comprehensive risk assessments, evaluating internal controls, and ensuring compliance with a wide range of regulatory frameworks, including NESA, PCI DSS, ADHICS, GDPR, SAMA, and the Central Bank of Bahrain (CBB).

Solid background in IT audits, privacy assessments, third-party risk evaluations, and business continuity reviews, delivering actionable insights to improve risk management and control effectiveness.

Proven track record in implementing and auditing international standards and frameworks including ISO 27001, ISO 27701, COBIT, ITIL, and ISO 9001 to strengthen information security governance.

Adept at developing, reviewing, and enhancing IT policies and procedures to align with audit findings, business objectives, and evolving regulatory requirements.

• Certified Information Systems Auditor (CISA)
• Lead Auditor for BCMS ISO 22301:2019 (BSI)
• ISO 27701 & GDPR Certified Lead Implementer Professional (BSI)
• Internal Quality Auditor for ISO 27001, ISO 9001, ISO 20000
• NCEMA Business Continuity Lead Auditor
• ITIL Intermediate Certified
• CSQA (Certified Software Quality Analyst)

• Designed and implemented robust IT Governance, Risk, and Compliance (GRC) frameworks tailored to industry needs, ensuring alignment with regulatory requirements from authorities such as the Saudi Central Bank (SAMA), Central Bank of Bahrain (CBB), UAE’s NESA and ADHICS, GDPR, etc.
• Developed and maintained Cybersecurity, IT governance, Data privacy, and Business continuity management frameworks and policies in compliance with international and regional standards, including ISO 27001, ISO 27701, and ISO 22301.
• Led IT security risk assessments, IT audits, third-party/vendor evaluations, and control testing, addressing sector-specific threats and enhancing the organization’s security posture.
• Delivered full-cycle Data Privacy Management engagements, including Data Privacy Impact Assessments (DPIAs), with a focus on compliance in regulated environments across various industries.
• Managed internal, external, and regulatory audits; conducted business impact analyses, disaster recovery drills, and developed BCP/DR plans to ensure operational continuity and audit readiness.
• Defined and tracked IT governance KPIs and conducted enterprise-wide security awareness programs to align security initiatives with business objectives and foster a culture of compliance.

• Successfully implemented GRC programs for several customers from different domains such as Banking, Insurance, Automotive, Government, Manufacturing and logistics.
• Spearheaded the ISO 27001 certification program for multiple clients.
• Drove enhanced security controls projects to safeguard sensitive data for multiple clients.
• Conducted over 100 third-party information security and risk assessments.