T

Tony Varghese

About

Detail

Information Security Program Leader | Cybersecurity & GRC Strategist | Risk Management Professional | CISM, CDPSE
Oklahoma, United States

Timeline

work
Job

Résumé

Jobs verified_user 0% verified
  • Objectstream Inc
    Program Manager
    Objectstream Inc
    May 2026 - Current (6 months)
  • Independent Consultant
    Managing Consultant - Cybersecurity and Risk Advisory
    Independent Consultant
    Jan 2025 - Current (1 year 10 months)
    As an independent consultant, I partner with a diverse portfolio of clients, from government agencies and financial institutions to technology startups. I specialize in bridging the gap between strategic cybersecurity governance and hands-on technical assurance. My work focuses on building and maturing security programs, ensuring regulatory compliance, and architecting secure, resilient cloud and infrastructure environments. A key part of my practice involves providing technical advisory services, helping clients select the right security technology stack, and developing foundational security charters and operational playbooks.

    GRC Strategy & Frameworks | Cybersecurity Governance | AI Governance (ISO/IEC 42001) | Risk Management
  • EIL Global
    Principal Cyber, GRC & Cloud Transformation Architect
    EIL Global
    Mar 2026 - Jun 2026 (4 months)
  • Government of Sharjah Sharjah Digital Department
    Manager - Information Security
    Government of Sharjah Sharjah Digital Department
    Jan 2017 - Dec 2024 (8 years)
    In my role as Manager - Information Security at the Government of Sharjah - Sharjah Digital Department, I oversaw a wide range of security initiatives, from Security Operations Centre (SOC) management to Cloud Security implementation. I successfully led the team in developing and implementing innovative Cyber Security solutions, resulting in enhanced threat detection and response capabilities.

    Cybersecurity Governance | IT Governance | Business Continuity & DR (ISO 22301, NCEMA) | IT Service Management (ISO/IEC 20000) | ISO/IEC 27001 | ISO/IEC 27002 | ISO/IEC 27005 | NIST CSF | NIST SP 800-53 | NIST SP 800-171 | NIST SP 800-37 (RMF) | SOC 1 / SOC 2 / SOC 3 | PCI DSS | FedRAMP | Security Operations Center (SOC) | SIEM | EDR | PAM
  • Government of Sharjah Sharjah Digital Department
    Senior Information Security Analyst
    Government of Sharjah Sharjah Digital Department
    Sep 2015 - Dec 2016 (1 year 4 months)
    In my role as Senior Information Security Analyst, I was the lead in building the Information Security program from the ground up. I drove the execution of multiple security projects, established governance processes, and managed security awareness and change management initiatives across government entities. I conducted workshops with stakeholders to align IT and business objectives with security requirements, and laid the foundation for future SOC and SIEM capabilities.

    Cybersecurity Program Development | Governance & Compliance | Security Awareness & Training | Workshops & Stakeholder Engagement | Project Management | Risk Assessments | ISO/IEC 27001 | UAE IA/NESA | Change Management | Cloud & Infrastructure Security
  • Abu Dhabi Media ADM
    Project Manager And Consultant - Information Security
    Abu Dhabi Media ADM
    May 2014 - Sep 2015 (1 year 5 months)
    • Providing cybersecurity consulting services to the organisation, developing, and implementing effective security policies and procedures, conducting security assessments and audits, and leading incident response efforts in the event of a security breach.
    • Managing various security projects to ensure they are delivered on time and within budget by developing and maintaining project schedules, budgets, and resource plans, and communicating project status, risks, and issues to stakeholders and key decision-makers.
    • Identifying and mitigating project risks and issues to ensure project success by working with cross-functional teams, including Infrastructure, Network, application development, and IT security to identify and address
  • ISYX Technologies
    Project Manager -Information Security
    ISYX Technologies
    Apr 2014 - Sep 2015 (1 year 6 months)
    Planning, coordinating and overseeing the execution of security projects: Advanced Threat Protection, Web Application firewalls, Certificate Management, Network Security Policy Management, Risk Assessment, Information Security Management System (ISMS), Business Continuity, Business Impact Analysis (BIA), Endpoint Security, Vulnerability Management, Sand Boxing, Web Isolation, Cloud Proxy for Roaming Users, Data Classification
  • ISYX Technologies
    Senior Information Security Consultant
    ISYX Technologies
    Apr 2013 - Apr 2014 (1 year 1 month)
    • Conducting security assessments to identify vulnerabilities and risks in an organization's systems and processes.
    • Developing and implementing security policies and procedures to protect against threats and ensure compliance with relevant regulations.
    • Providing guidance and recommendations to organizations on best practices for data protection and secure information handling.
    • Monitoring security systems and responding to security breaches or incidents as needed.
    • Staying up-to-date with the latest security technologies and threats, and applying this knowledge to improve the security posture of the organization.
    • Providing training and education to employees and other stakeholders on security best practices
  • DUBAI BANK
    Information Security Professional
    DUBAI BANK
    Feb 2012 - Apr 2013 (1 year 3 months)
    Risk Assessment, Maintain Information Security Management System (ISMS), Security Incident Management, Security Audits, Security Violation Review, Gap Assessments, Security Incident and Event Monitoring(SIEM)
  • Quadrant Risk Management FZE ME An Isyx Company
    Information Security Consultant
    Quadrant Risk Management FZE ME An Isyx Company
    Dec 2009 - Apr 2013 (3 years 5 months)
    • Provided cybersecurity consulting services to clients in various industries, including healthcare, finance, and government
    • Assisted clients in developing and implementing security policies and procedures
    • Conducted security assessments and audits to identify vulnerabilities and recommend remediation strategies
    • Led incident response efforts in the event of a security breach
  • E
    Product Manager
    Emirads Digital LLC
    Aug 2007 - Nov 2009 (2 years 4 months)
    As a Product Manager for Digital Signage and Wayfinding Solutions, I led the end-to-end delivery of enterprise digital signage systems, integrating audio-visual technology, IT infrastructure, and interactive software platforms. I oversaw solution design, vendor selection, deployment, and post-launch support, ensuring alignment with business objectives and a superior user experience. Managing cross-functional teams of AV engineers, IT specialists, software developers, and operations staff, I ensured seamless integration of hardware, software, and network connectivity. By implementing strong project governance, timelines, and quality assurance processes, I successfully delivered projects on time and within budget, improving visitor navigation
  • AlZayani Investments
    Network and System Administrator
    AlZayani Investments
    Jul 2001 - Aug 2007 (6 years 2 months)
    During my early career (2000–2007), I worked as a Desktop, Network, and Server Administrator, providing comprehensive IT support for enterprise environments and high-profile executives. I managed Windows 2000/XP/2003 servers, Active Directory, Exchange 2000/2003, LAN/WAN networks, VPN access, and desktop imaging, while overseeing hardware, software, printers, and peripherals. I also supported early mobile devices and emerging smartphone technologies, helping teams adopt new tools for email, collaboration, and remote access. By implementing patch management, backup/recovery, and IT operations best practices, I ensured operational continuity and improved IT efficiency. I collaborated closely with end-users, executives, and IT teams to deploy
  • Indian Institute of Science
    Research Assistant
    Indian Institute of Science
    Jul 2000 - Jul 2001 (1 year 1 month)
Education verified_user 0% verified
    Projects (professional or personal) verified_user 0% verified
    • S
      State-Wide Cybersecurity Compliance Program
      Led a multi-year initiative to oversee and uplift the cybersecurity compliance posture of 180+ government agencies, ensuring alignment with national cybersecurity frameworks and international standards (NIST, ISO 27001, UAE IA/NESA). Coordinated workshops, penetration testing, risk assessments, and executive reporting dashboards.
    • S
      Security Operations & Technology Transformation
      Built and scaled a state-level Security Operations Center (SOC), integrating advanced technologies such as SIEM, EDR, PAM, BAS, ASM, email/web gateways, virtualization, and honeypots. Implemented threat detection and response frameworks aligned with MITRE ATT&CK, developed custom detection use cases, and optimized SIEM rules for higher fidelity alerts. Established a threat hunting practice, playbooks, and automated response workflows to improve SOC efficiency.

      Designed a vulnerability remediation governance model that prioritized fixes based on asset criticality and exposure, ensuring faster closure of high-risk gaps. Delivered executive-level dashboards to track SOC performance, incident trends, and risk posture.

      Impa
    • U
      Unified Compliance & Control Framework
      Led a compliance harmonization project to unify multiple regulatory and industry frameworks — including ISO/IEC 27001, NIST CSF, COBIT, ISO 22301, ISO 20000, ISO 31000, PCI-DSS, SOX, GDPR, and UAE IA/NESA — into a single integrated control framework.

      Developed a controls mapping matrix that identified overlaps and common control requirements, reducing duplication and streamlining audit efforts. Designed simplified compliance methods that allowed stakeholders to demonstrate adherence to multiple standards through one set of evidence and reporting.

      Collaborated with auditors, regulators, and internal teams to ensure the unified framework was recognized for regulatory reporting, ITGC assurance, operational risk, BCM/DR, a
    Awards verified_user 0% verified
    • I
      Excellence in CISO Leadership Award
      Issued by CXODX th Future Workspace Summit and Awards
    • I
      Top CISO - Government
      Issued by rd Edition Security Conclave Awards