Open to opportunities

Suchit Iyer

@suchitiyer

I build compliance-ready security frameworks and uncover web, API, and network vulnerabilities.

I've delivered risk assessments, pentest assurance, and audit-ready security documentation at AXA, helping align global applications with regulatory risk appetites and AXA's Pentest Framework.

Previously, I built HIPAA- and ISO27001-compliant security frameworks for US healthcare and IT startups, led penetration testing for Fortune 500 clients at EY, and performed application and network vulnerability validation at Indusface. My work spans GRC, SOC2, HIPAA, ISO27001, web/API/network VAPT, threat modeling, cloud security, policy development, and incident-response planning.

Experience

Work history, roles, and key accomplishments

Associate Consultant – Risk, Compliance & Security

AXA

Nov 2023 - Nov 2025 (2 years)

Orchestrated comprehensive security risk assessments across global applications, identifying critical gaps and aligning risk posture with regulatory appetites. Validated external penetration testing reports to ensure adherence to AXA's Pentest Framework and collaborated with DevSecOps to integrate security testing into the SDLC.

Risk Assessment Penetration Testing Security Audits DevSecOps SDLC Documentation

Independent Information Security Consultant

Freelance

Apr 2022 - Oct 2023 (1 year 6 months)

Consulted for US-based Healthcare and IT startups to build HIPAA and ISO27001-compliant security frameworks from scratch. Executed end-to-end VAPT for web applications and APIs, providing actionable remediation roadmaps and authored security policies and incident response plans.

HIPAA ISO 27001 VAPT Web Application Security API Security Security Policies Incident Response

Consultant – Cyber Security

Ernst & Young (EY)

Jun 2021 - Mar 2022 (9 months)

Led high-stakes Attack & Penetration Testing across databases, IT infrastructure, and cloud environments for Fortune 500 clients. Performed in-depth analysis of penetration testing results and translated technical findings into executive-level risk reports.

Penetration Testing Vulnerability Assessment Cloud Security Risk Reporting Database Security

Information Security Specialist

Navaera Worldwide

Sep 2020 - Jun 2021 (9 months)

Partnered with architects, engineers, and project managers to ensure application and infrastructure security and compliance for SOC2 and ISO27001 audits. Executed rigorous vulnerability assessments and penetration tests on infrastructure and applications.

SOC2 ISO 27001 Vulnerability Assessment Penetration Testing Security Awareness

MSS Engineer

Indusface Pvt Ltd.

Mar 2018 - Aug 2020 (2 years 5 months)

Performed manual validation of application and network layer vulnerabilities and developed custom WAF rules to mitigate real-time threats. Analyzed logs using ELK and other analytical platforms for troubleshooting and incident response.

WAF ELK Stack Incident Response Log Analysis