SubasishSahoo

Program Governance & Service Management: Govern VM KPIs, including SLA adherence, remediation ageing, vulnerability backlog, scan coverage, risk exposure, exception management and service quality; drive stakeholder actions, remediation outcomes and continuous service improvement. Client & Executive Stakeholder Management: Serve as a primary client and senior stakeholder interface, translating technical exposure data into business risk, remediation priorities, program insights and executive-level recommendations.

• Lead an enterprise-wide Vulnerability Management and CTEM program for a global, multi-country environment covering 60K+ assets across on-premises, cloud, and hybrid infrastructure.
• Own the end-to-end CTEM lifecycle across Discover, Validate, Prioritise, Mobilise, and Monitor, driving continuous exposure visibility and measurable remediation outcomes. Govern vulnerability remediation through risk-based prioritisation, SLA tracking, and remediation ageing, exception/risk acceptance and escalation management.
• Prioritise vulnerabilities using CVSS, exploitability, EPSS, CISA KEV, threat intelligence, MITRE ATT&CK, asset criticality and business risk to support threat-informed remediation decisions. Design and execute customised vulnerability assessments across Windows, Linux, cloud workloads and applications using Qualys VMDR, Tenable Nessus, Rapid7 InsightVM and Microsoft Defender.
• Validate findings, investigate false positives, tune scanning approaches and coordinate remediation with infrastructure, application, patching and security teams. Act as a client and senior stakeholder interface, presenting exposure posture, remediation progress, risk trends, exceptions and program maturity to leadership.
• Participate in developing Power BI and Excel executive dashboards, translating technical vulnerability data into business-focused risk insights, remediation priorities, and investment discussions. Coordinate geographically distributed teams and cross-functional stakeholders to maintain service quality, delivery timelines and remediation commitments.
• Support ISO 27001-aligned governance, risk register management, control reviews, audit readiness and evidence preparation for internal and external assessments. Drive continuous improvement of VM/CTEM processes through workflow automation, data integration, operational standardisation, and emerging AI-assisted security use cases. Support integration of vulnerability information with downstream security, remediation and governance workflows to improve visibility, prioritisation, and remediation tracking.

Led application security and vulnerability management activities while managing a 5-member team, coordinating assessments, remediation, stakeholder engagement, risk escalation, and timely delivery.

• Conducted manual and automated vulnerability assessments for enterprise web applications using Qualys and Burp Suite, applying OWASP Top 10 principles.
• Performed vulnerability analysis and basic penetration testing to identify exploitable weaknesses and provide remediation recommendations.
• Led and coordinated a 5-member application security/testing team, managing execution planning, daily reporting, stakeholder communication and risk escalation.
• Coordinated onsite/offshore delivery and ensured testing activities, findings and remediation validation were completed within agreed timelines. Supported security improvement initiatives by translating technical findings into actionable remediation recommendations.

Security testing and secure SDLC support for enterprise Radiology and Oncology platforms.

• Led application security and QA activities for enterprise Radiology and Oncology platforms, supporting secure SDLC and risk reduction. Conducted vulnerability assessments using Qualys, Nessus, Burp Suite and manual security testing
• Coordinated vulnerability remediation with development teams, including finding validation, retesting and regression testing. Supported security testing during QA audits and contributed to secure SDLC and application security improvements.
• Led a 10-member testing team, coordinating execution, reporting, stakeholder communication and issue escalation.
• Supported automation of operational processes using Blue Prism, providing an early foundation in security workflow automation and process optimisation.

• Delivered functional and automation testing using Selenium, Xframium, Maven, Jira and Page Object Model.
• Supported client reporting, defect management and release validation.

• Worked across requirement analysis, UI development, test scenario design and application validation.
• Recognized with a Pat on the Back award for delivery contribution.