Cyber and Regulatory Expert +
Entrepreneur

I specialise in solving problems using practical strategic and artificial intelligence solutions for cybersecurity, governance, risk and compliance

Experience
Completed
Clients
Commitments
What I Love Doing
Addressing complex challenges with a practical approach typically requires a mix of technological innovation, collaboration with skilled individuals, and strategic improvements in processes.

SERVICES
Security By Design
Security by Design is a proactive approach to embedding security into every stage of infrastructure, software, and product development. Rather than addressing vulnerabilities reactively, this method ensures that security considerations are integral from the outset, reducing risks and enhancing compliance. It's a strategic way to future-proof systems against evolving cyber threats while maintaining business integrity.
Benefits:
• Reduced Risk: Minimise the likelihood of security breaches with proactive protection.
• Cost Efficiency: Save time and money by addressing security early and avoiding expensive post-launch fixes.
• Enhanced Compliance: Ensure systems meet regulatory requirements from the beginning, simplifying audits.
• Improved Trust: Build confidence with stakeholders by demonstrating a commitment to security.
• Future-Proof Systems: Stay ahead of emerging threats by embedding security into the core of your infrastructure.
• Business Continuity: Protect critical operations by minimising disruptions caused by potential cyber threats.
Services Process
• Risk Assessment: Identify potential threats and vulnerabilities early in development.
• Architecture Review: Incorporate security best practices into system architecture design.
• Security Controls Integration: Implement layered security controls tailored to the business environment.
• Threat Modeling: Continuously analyse and simulate potential attack vectors to pre-emptively mitigate risks.
• Compliance Alignment: Ensure all security measures meet regulatory and industry standards.
• Ongoing Monitoring & Testing: Regularly monitor and test systems to ensure continued security as they evolve.

SERVICES
Cyber Implementation
Cyber Implementation focuses on seamlessly integrating advanced cybersecurity solutions into the client's existing systems and processes. This service ensures security measures are deployed efficiently and aligned with business goals, providing comprehensive protection without disrupting operations. Tailoring the implementation to specific needs enhances the client's overall cybersecurity posture.
Benefits:
• Tailored Solutions: Receive customised security measures that address specific organisational risks.
• Minimal Disruption: Seamlessly integrate security without interrupting business operations.
• Enhanced Protection: Strengthen defence mechanisms across all client infrastructure layers.
• Regulatory Compliance: Ensure systems comply with industry regulations and standards during implementation.
• Scalable Solutions: Implement flexible security strategies that grow with the clients evolving needs.
• Increased Operational Efficiency: Improve overall efficiency by securing systems while maintaining business continuity.
Services Process
• Assessment of Existing Infrastructure: Evaluate current systems to understand security gaps and requirements.
• Custom Solution Design: Develop a tailored security strategy that aligns with organisational objectives.
• Integration of Security Solutions: Implement cutting-edge tools and technologies across the entire IT infrastructure.
• Collaboration with Stakeholders: Work closely with internal teams to ensure smooth deployment and minimal disruption.
• User Training & Awareness: Equip employees with the knowledge to maintain security protocols post-implementation.
• Post-Implementation Support: Provide ongoing support and fine-tuning to ensure continuous optimisation of security measures.
Some of the technology we have implemented:
- Sophos MTR
- Veeam
- Sailpoint IDM
- CheckMarx
- Secureworks Taegis
- Rapid 7 InsightIDM

SERVICES
Regulatory Advisory
Regulatory Advisory provides expert guidance on navigating complex regulatory frameworks, including Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) compliance. We help clients secure essential licenses such as MAS CMS, RMO, PSA, and others in the financial sector. Our service specialises in banking regulations and ensures that security and operational practices align with regulatory requirements, minimising risk while supporting sustainable growth.
Benefits:
• Expert Guidance: Receive expert advice on regulatory requirements, ensuring compliance with MAS CMS, RMO, PSA, and other financial regulations.
• Streamlined License Applications: Benefit from a smooth, efficient process for obtaining essential licenses, such as banking and payment services.
• Reduced Risk: Minimise legal and regulatory risks by aligning operations with current and future regulatory standards.
• Enhanced Governance: Strengthen internal controls, governance, and reporting mechanisms to meet strict regulatory requirements.
• Regulatory Confidence: Build trust with regulators and stakeholders by demonstrating proactive compliance efforts.
• Business Continuity: Ensure the client always complies with evolving regulations, allowing uninterrupted growth and operations.
Services Process
• Regulatory Landscape Assessment: Analyse relevant regulations, including AML, CFT, MAS CMS, RMO, PSA, and industry-specific guidelines, to identify compliance requirements.
• Gap Analysis: Conduct a detailed review to pinpoint areas where the client's practices fall short of regulatory standards, providing a clear roadmap to achieve full compliance.
• License Application Support: Help prepare and submit applications for banking and payment licenses, including MAS CMS, RMO, PSA, and related documentation.
• AML & CFT Policy Development: Design and implement robust AML and CFT policies to ensure compliance with local and international standards.
• Stakeholder Coordination: Facilitate collaboration with internal teams, external auditors, and regulators to align efforts and ensure smooth communication throughout the compliance process.
• Ongoing Compliance Monitoring: Track regulatory changes in AML, CFT, and other areas to adapt the client's strategy and maintain long-term compliance.
Additional Offerings
- Policy and Procedure development
- Enterprise Risk Assessments
- Risk Management Platform
- AML and CFT Procesures
- License Application Submission and Support
- AML Manual

SERVICES
Cyber Security Advisory
Cyber Security Advisory provides tailored strategies to safeguard clients from evolving cyber threats. By assessing current vulnerabilities and developing comprehensive security frameworks, we help businesses strengthen their cyber defences, meet compliance standards, and align security practices with business objectives. Our advisory services ensure clients can confidently navigate today's complex cyber landscape.
Benefits:
• Tailored Security Solutions: Receive customised cybersecurity strategies that address specific organisational risks and align with business needs.
• Proactive Threat Mitigation: Stay ahead of emerging cyber threats through ongoing threat analysis and up-to-date defence strategies.
• Regulatory Compliance: Ensure clients meet necessary regulatory requirements, reducing the risk of fines or legal issues.
• Enhanced Security Posture: Strengthen your cybersecurity framework, protecting critical assets from potential breaches.
• Business Continuity: Minimise downtime and operational disruptions with a solid, well-integrated security strategy.
• Long-Term Support: Benefit from continuous advisory and monitoring services that ensure your cybersecurity measures evolve with new threats and business changes.
Services Process
• Initial Risk Assessment: Conduct a thorough evaluation of the organisation's cybersecurity posture to identify vulnerabilities and gaps.
• Threat Landscape Analysis: Proactively dissect the latest cyber threats and trends relevant to the business's industry to craft robust defence strategies and instill a sense of preparedness.
• Security Strategy Development: Craft a tailored cybersecurity strategy that perfectly aligns with business goals, incorporating preventive, detective, and responsive measures to ensure comprehensive protection.
• Compliance Alignment: Ensure all recommended security solutions meet applicable regulatory standards and industry best practices.
• Implementation Roadmap: Provide a clear, actionable roadmap for implementing and integrating security solutions within existing systems.
• Ongoing Advisory & Monitoring: Offer continuous advisory services to adapt to emerging threats, monitor systems, and fine-tune security measures as needed.
- Classical problem solving
- ISO27001
- IDO 27017
- ISO 27018
- ISO 42001
- Policy creation across technology and risk

SERVICES
Trusted Advisor
As a Trusted Advisor, I offer ongoing strategic guidance to clients, helping them navigate complex cybersecurity, compliance, and digital transformation challenges. I act as a long-term partner, providing expert advice that aligns with business objectives and fosters sustainable growth. This service ensures that businesses can confidently make informed decisions while staying resilient against risks.
Benefits:
• Expert Strategic Guidance: Receive ongoing, high-level advice tailored to your organisation's unique needs and objectives.
• Proactive Risk Management: Stay ahead of emerging risks and threats with insights and recommendations that enhance your security posture.
• Enhanced Decision-Making: Make more informed business decisions by leveraging my experience and expertise in cybersecurity, compliance, and digital strategy.
• Long-Term Partnership: Benefit from a continuous advisory relationship, ensuring consistency and trust as your business evolves.
• Optimised Security & Compliance: Maintain alignment with industry standards and regulatory requirements, reducing risk and ensuring compliance.
• Business Growth Support: Foster sustainable growth by aligning your cybersecurity strategies and operational practices with long-term business goals.

SERVICES
Forensic Investigation
Forensic Investigation is a specialised service for identifying, analysing, and addressing cyber incidents such as data breaches, system intrusions, and fraud. Using advanced investigative tools and methodologies, we help clients uncover the root cause of security incidents, gather critical evidence, and provide actionable insights for remediation. This service supports legal and regulatory requirements while ensuring business continuity.
Benefits:
• Rapid Response: Minimise damage with immediate identification and containment of threats.
• Comprehensive Investigations: Gain deep insights into the root cause of incidents through thorough forensic analysis.
• Legal & Regulatory Support: Ensure compliance with legal and regulatory requirements by collecting and preserving admissible evidence.
• Actionable Insights: Receive detailed reports with clear recommendations to strengthen future security measures.
• Business Continuity: Restore operations quickly and effectively, minimising downtime and disruptions.
• Future Risk Mitigation: Implement long-term security enhancements based on findings to prevent repeat incidents and enhance overall resilience.
Services Process
• Incident Identification & Containment: Swiftly identify the breach or attack to ensure the integrity of our systems. Secure and preserve digital evidence following industry-standard protocols, contain the threat, and prevent further damage. Your quick action is crucial in these moments.
• Evidence Collection: To ensure integrity, secure and preserve digital evidence following industry-standard protocols.
• Root Cause Analysis: Conduct a detailed investigation to determine the source of the attack and the methods used by attackers.
• Impact Assessment: Our expertise is crucial in evaluating the extent of the breach, including compromised data and affected systems. We need a thorough assessment to understand the full impact.
• Reporting & Documentation: Provide clear, comprehensive reports that outline findings, actions taken, and recommendations for remediation.
• Post-Incident Remediation: Assist with system recovery and implementing long-term security measures to prevent future incidents.
- Magnet Axiom Tools
- Our Tools can be deployed in any country
- Only need to know access
- PII assessments
- Malware analysis
- We work with the top insurance companies
My Recent Engagements
The case studies showcase my expertise in various areas, from conducting vulnerability and penetration testing to providing strategic cyber risk assessments and regulatory advisory. Each study highlights successful engagements where I've helped clients.

Case Study
Improving Bank's Security Posture Through Security Testing.
A global bank underwent a series of assessments to verify the effectiveness of security controls on its payment servers.




Project Background
ICICI Bank is India's largest private sector bank, with a presence in 17 countries, including Singapore. ICICI Bank offers corporate and retail customers a wide range of banking products and financial services. ICICI requested Pragma to conduct a vulnerability and penetration testing assessment of the FAST payment servers hosted in Singapore and to provide a report on the vulnerabilities found and the associated risks.
This assessment's purpose was to verify the effectiveness of ICICI's security controls to secure business-critical information. ICICI's internal networks, including systems and applications, are important as they are used to process FAST payments. If accessed inappropriately, they could cause reputational damage and financial loss to ICICI and its management.
The Project
The nature of the testing performed was designed to replicate the threat of an attacker wishing to gain access to ICICI computer systems or data through an unknown weakness in the systems and security mechanisms in place. To test ICICI's ability to defend against direct attack, Pragma executed a comprehensive network vulnerability scan using Rapid 7 insightVM, exploiting weakened services, client-side attacks, and server-side attacks.
The Results
The report represented the findings from the assessment and the associated remediation recommendations to help ICICI strengthen its security posture. Pragma identified various issues, a few of which should be considered for remediation according to ICICI bank risk and patch management processes. If desired, a few issues could be remediated, but they do not represent a vulnerability.

Case Study
Providing a Fintech with Technical Support in Compliance with the Monetary Authority of Singapore (MAS) Technology Risk Management
Pragma signed up with the client as they needed a partner with expertise in technology risk and cybersecurity to support them in achieving the MAS license.




Project Background
The client provides an asset tokenisation and investment management platform where investors can easily access and invest safely and transparently in asset-backed security tokens.
The client's operations fall under the MAS regulatory requirements. To continue its operations and provide a safe platform for its customers, the Client must hold a capital markets services (CMS) licence to conduct activities regulated under the Securities and Futures Act and comply with MAS Technology Risk Management and MAS Notice 655 Cyber Hygiene.
The client required a partner with expertise in technology risk and cybersecurity to support them in achieving the MAS licence.
The Project
Given the size and complexity of the project, Pragma worked closely with the client to understand the scope and resources needed. The first scope involved compliance implementation with MAS TRM and MAS Notice 655 Cyber Hygiene. Pragma's team produced and implemented policies, documents, and checklists to support client compliance.
Pragma then assisted in reviewing and fulfilling the required MAS CMS licence application forms and liaised with the authorities from the MAS on any queries during the application.
Pragma's security specialists performed penetration tests and vulnerability assessments to ensure the platform was resilient against cyber threats. Pragma also performed a mobile application security test to identify vulnerabilities and a source code review to identify any vulnerabilities in the application code.
The Results
The client met the regulatory requirements and achieved the MAS license and increased its customer base by providing a functional and secure platform.
With the licence, the client can now provide real estate investment models for asset owners and investors by issuing asset-backed security tokens for fractional ownership in a regulated environment and is one of the first platforms to do so.

Case Study
Identity Access Management Implementation
The client sought Pragma's services to improve security posture and comply with FIEA and PIPA.




Project Background
Mizuho Bank, Ltd. is a Japanese banking and financial services company headquartered in Tokyo, Japan. Mizuho Bank approached Pragma to help them implement an identity access management (IAM) solution to enhance their security posture. After evaluating their needs and requirements, we recommended SailPoint.
This industry-leading IAM solution would meet their needs and comprehensively solve their identity and access management challenges. Mizuho Bank faced several challenges managing identities and access across their systems and applications. They needed a solution that could provide a centralised view of identities and access, streamline access requests and approvals, and provide granular control over access to sensitive resources. They also needed to ensure they complied with regulatory requirements such as the Financial Instruments and Exchange Act (FIEA) and the Personal Information Protection Act (PIPA).
The Project
Our team worked with Mizuho Bank to implement SailPoint IdentityIQ, a comprehensive IAM solution to help them meet their objectives. We started by analysing their current environment and identifying their identity and access management challenges. Based on our assessment, we designed and implemented a solution that included the following components:
1. Identity Governance: We implemented SailPoint's Identity Governance module to give Mizuho Bank a centralised view of identities and access across their systems and applications. This module allowed them to streamline access requests and approvals, enforce separation of duties (SoD), and provide granular control over access to sensitive resources.
2. Access Management: We implemented SailPoint's Access Management module to provide Mizuho Bank with a single sign-on (SSO) solution that would simplify access to their applications and systems. This module also provided multifactor authentication (MFA) capabilities to enhance the security of their access controls.
3. Compliance Management: We implemented SailPoint's Compliance Management module to help Mizuho Bank comply with regulatory requirements such as the FIEA and PIPA. This module provided automated workflows to manage access certifications and ensure appropriate and compliant access.
The Results
Our implementation of SailPoint IdentityIQ has helped Mizuho Bank improve its security posture and enhance its identity and access management capabilities. The solution has provided them with a centralised view of identities and access, streamlined access requests and approvals, and provided granular control over access to sensitive resources. The SSO and MFA capabilities have improved the user experience while enhancing security, and the compliance management capabilities have helped them ensure compliance with regulatory requirements.

Case Study
Investigating a Cybersecurity Breach for a Sports Equipment Retailer
The company engaged Pragma to investigate the cybersecurity breach on their systems.




Project Background
The sports apparel company is one of Australia's largest winter sports equipment retailers. It is the destination for all the best skiing, snowboarding and outdoor sports brands. Founded in 1985, the company operates a website that generates 20% of its gross revenue.
During one of its routine checks, the sports apparel company discovered a password-stealing Trojan on its website. Kaspersky Labs verified the detection to be a true positive; however, their web host could not detect and remove the infection. Shortly after the detection, The sports apparel company received reports that their customers' credit card details were being mined.
The Project
The sports apparel company engaged Pragma to investigate the cybersecurity breach on their systems. Pragma discovered that the website is extremely vulnerable to SQLi and other attacks due to obsolete backend software and operating system deployment.
As the site has been attacked multiple times and contains notable security vulnerabilities in the hosted platform, Pragma agreed with the client and their insurers to temporarily host the platform on Pragma's CloudControl platform, which includes security monitoring, network security and Distributed Denial Of Service ("DDOS") protection.
The Results
Pragma eradicated all traces of the malware and upgraded various components of their website. As part of the migration to the CloudControl platform, Pragma reviewed the client's system architecture and identified and patched a vulnerable component to SQL injection ("SQLi").
During the month the website was hosted on Pragma's CloudControl platform, 7,829 threats were blocked, including 116 further SQLi attempts. The increased network security rejected all these attacks. The website is now stable and threat-free.
My Experience
My Education
My Skills
I leverage my unique skills to solve problems, assist clients in protecting against threat actors, and establish successful businesses.
My Client's Stories
Enabling clients to navigate their digital transformation with confidence through expert cybersecurity solutions.
Let's work together!
I love to make it very difficult for hackers to take advantage of companies.
-
Phone
+65 9180 1882 -
Email
manish@chawda.me