Looking for a job

Amit Pandey

@amitpandey9

GRC and information security leader at HSBC, strengthening BCBS 239 data controls and aligning privacy, AI ethics, and risk governance.

India

Message

At HSBC, I manage the control environment for BCBS 239, focusing on data aggregation, risk reporting, and audit readiness. I work to improve data quality controls and align data privacy, AI ethics, and emerging technology risks with a proactive risk strategy.

At Standard Chartered, I spearheaded the bank-wide Data Privacy Transformation Program and advised executives on AI governance and regulatory compliance. Across financial services and government projects, I have worked on privacy frameworks, cyber resilience, GRC automation, and data center assurance.

Experience

Work history, roles, and key accomplishments

Current

Sr. Asso. Director

Current

HSBC

Jan 2026 - Present (9 months)

Managing the control environment to ensure full adherence to BCBS 239 principles, focusing on data aggregation and risk reporting. Leading audit readiness, infrastructure oversight, and data governance initiatives.

BCBS 239 Data Governance Risk Management Audit Readiness Privacy By Design Data Quality AI Governance Controls Rationalization Policy Alignment

Partner

Standard Chartered

Jun 2021 - Dec 2025 (4 years 6 months)

Spearheaded the bank-wide Data Privacy Transformation Program (DPTP), managing operational rollout, governance, and control mechanisms across multiple business units. Advised C-suite on AI governance and compliance.

GDPR CCPA Privacy RCSA Risk Management TPRM PIA PRA TPPA AI Governance Automation Data Protection Vendor Management Cross Border Compliance

Lead Consultant GRC

WIPRO Limited

Aug 2019 - Jun 2021 (1 year 10 months)

Cultivated partnerships with key risk stakeholders to align risk assessment needs with business objectives. Directed global Third-Party Risk Management (TPRM) teams and led cross-functional efforts that improved compliance adherence by 15%.

GRC TPRM OneTrust NIST Information Technology Security Special Publications (SP) 800 Series ISO 27001 Risk Assessment Control evaluation Stakeholder Management Compliance Frameworks

GRC Lead

Tech Mahindra

Sep 2018 - Aug 2019 (11 months)

Advanced enterprise architecture and process modeling, establishing security standards in accordance with PCI DSS and ISO 27001. Managed ICS risks and ensured effective PCI DSS risk management for the Hong Kong region.

PCI DSS ISO 27001 Enterprise Architecture Risk Management OT ICS Risk Assessments Security Integration Governance Compliance

Senior Consultant, Risk Advisory Services

Ernst and Young India

Aug 2017 - Aug 2018 (1 year)

Developed Data Privacy Impact Assessments and Records of Processing Activities (ROPA), identifying personal data processing workflows. Evaluated client privacy standards for GDPR conformity and managed third-party risks.

GDPR Data Privacy PIA RoPA Privacy Impact Assessment Third Party Risk Management Internal Audit Privacy Controls

Assistant Manager

Deloitte Touche Tohmatsu India

Jul 2015 - Jul 2017 (2 years)

Conducted Third-Party Assessments for the Madhya Pradesh State Data Center, Transport Department SDVRM systems, and e-procurement platforms. Facilitated ISO 27001 and ISO 20000 certification and supported ERM programs.

ISO 27001 ISO 20000 Third Party Risk Management Data Center Audits GRC Tooling Compliance Monitoring Vendor Risk Management

Consultant

Ernst and Young India

Dec 2012 - Jun 2015 (2 years 6 months)

Delivered technical implementation and management services, ensuring timely service delivery by SLAs and government audit support. Assisted in IT and non-IT infrastructure audits and conducted inventory audits.

Program Management SLA Audit Support Inventory Management Process Optimization BPR FRS RFP MOU'S Data Center Assessment

Analyst

Netlink Software Pvt Ltd.

Mar 2011 - Nov 2012 (1 year 8 months)

Supported a mega digitization project requiring digital interfaces and infrastructure for paperless digitization. Covered 1.25 crore population via 8000 Android tablets.

Digitization Android Project Management Data Collection Infrastructure