I'm a GRC Engineer at Cisco (previously GRC Analyst at KPMG) with 3+ years in technology risk and compliance, now focused on AI governance, AI compliance and AI security. I sit between auditors and engineers, and I build controls that are tested by code, continuously, and produce evidence an auditor can re-perform, not screenshots someone grabs once a quarter.
Roles I'm a fit for: GRC Engineer · GRC Analyst · AI GRC · AI Governance · AI Compliance · AI Risk · Security Compliance · Cloud Compliance · IT Risk & Controls · Third-Party Risk (TPRM)
🔐 agent-access-review: user access reviews for AI agents
Companies recertify every employee's access each quarter, but AI agents now hold GitHub tokens, database passwords, shell access and mailboxes, and almost nobody reviews them. This tool reads MCP configs (Claude Desktop, Cursor, VS Code) and agent manifests, tests each agent against 12 controls, and produces the packet an auditor expects.
- Flags unowned agents, stale approvals, over-broad scopes, plaintext secrets and dormant access, exactly like an ITGC access review.
- Detects AI exfiltration paths: agents that read sensitive data, ingest attacker-controlled content and can send data out (OWASP LLM01/LLM02).
- Maps to NIST 800-53, SOC 2, NIST AI RMF, OWASP LLM Top 10; outputs a sign-off packet, hashed evidence and OSCAL.
pip install "git+https://github.com/Mihirajmera/agent-access-review@v0.2.0" && agent-access-review demo→ Read a sample review packet (no install needed)
🗡️ llm-redteam-evidence: LLM red-team results → audit evidence + release gate
Red-team tools like garak and promptfoo tell you a model can be jailbroken. A risk committee needs to know whether that's acceptable. This tool maps every attack to a control with a documented risk tolerance and turns tool output into evidence.
- Risk tolerance per control (e.g. 0% for system-prompt leakage, 5% for jailbreaks) with a 95% confidence bound, because "0 failures in 20 attacks" still means the true rate could be 16%.
- Model release gate: blocks a new model version that's easier to attack than the approved one. Change management for AI.
- Maps to OWASP LLM Top 10, MITRE ATLAS, NIST AI 600-1, NIST AI RMF, NIST 800-53; outputs hashed evidence and OSCAL.
pip install "git+https://github.com/Mihirajmera/llm-redteam-evidence@v0.2.0" && redteam-evidence demo→ Read a sample assessment · See the v1 → v2 release gate
| less manual evidence collection via Python continuous-controls automation | AWS / Azure cloud controls assessed and mapped to NIST CSF, CIS & ISO 27001 | control gaps & exceptions driven to closure through risk registers | fewer overdue SOX/ITGC control actions across annual audit cycles |
| Project | What it does | Stack |
|---|---|---|
| ⭐ aws-compliance-as-code | Read-only AWS checks, each mapped once to NIST 800-53, SOC 2, ISO 27001 & CIS, with SHA-256-hashed evidence and OSCAL output. Tested against mocked AWS in CI. | Python · boto3 · OSCAL |
| itgc-evidence-automation | Collects access, change and config evidence, tests it against SOX ITGC objectives, and generates an audit bundle plus a Corrective Action Plan register. | Python · AWS IAM · AWS Config |
| control-gap-analyzer | Risk-scores control gaps against the NIST CSF 2.0 catalog into a prioritized remediation backlog. | Python · pytest |
| grc-risk-dashboard | Interactive risk register with KRI/KPI views, remediation aging and exec reporting. | SQL · Streamlit |
| guardduty-siem-automation | GuardDuty detection wired to automated quarantine, with a React findings dashboard (live demo, sample data). | Terraform · Lambda · React |
| iam-zero-trust-security · secure-vpc-architecture | Zero Trust IAM and network baselines as code, with automated compliance monitoring. | Terraform · AWS |
🛰️ PosturaNet: my autonomous AWS security remediation platform. It ingests Security Hub and GuardDuty findings, scores risk against NIST CSF 2.0 and MITRE ATT&CK, generates a Terraform fix, and applies it through CI/CD only after a human approves.
flowchart LR
R[Requirement<br/>NIST · ISO · SOC 2] --> M[Map once<br/>control crosswalk]
M --> T[Test as code<br/>Python · APIs]
T --> E[Evidence<br/>hashed · timestamped · OSCAL]
E --> D[Report<br/>KRIs · dashboards]
D --> X[Remediate<br/>tickets · Terraform]
X --> T
GRC Engineer · Cisco · Jun 2025 – Present
- AI governance: AI risk & impact assessments under the NIST AI RMF in ServiceNow GRC, covering security, privacy, accountability, transparency and reliability, with AI risks tracked in the same register as security risk.
- Cloud controls: assessed 40+ AWS/Azure controls (AWS Config, CloudTrail, Security Hub, IAM) against NIST CSF, CIS & ISO 27001 and drove remediation.
- Automation & policy-as-code: Python evidence collection for continuous controls monitoring (~30% less manual effort); compliance checks embedded in Terraform + GitHub Actions.
- SOC 2, TPRM & reporting: SOC 2 evidence and exceptions, vendor assessments in OneTrust, and risk registers in Jira and Power BI closing 25+ control gaps.
GRC Analyst · KPMG · Jan 2022 – Jul 2024
- Technology risk assessments in ServiceNow GRC across 15+ business applications.
- Tested design & operating effectiveness of ~50 controls per cycle in RSA Archer.
- Control mapping to NIST CSF, NIST 800-53, COBIT & PCI DSS; ISO 27001 policy reviews.
- SOX/ITGC audit readiness; reduced overdue control actions by 20%.
- Identity & vulnerability control reviews with SailPoint and Qualys; SQL-driven KRI/KPI reporting (~15% less manual effort).
| Domain | Tools & Frameworks |
|---|---|
| Frameworks | NIST CSF · NIST 800-53 · NIST AI RMF · NIST AI 600-1 · ISO 27001 · SOC 2 · PCI DSS · SOX/ITGC · CIS · COBIT · OWASP LLM Top 10 · MITRE ATLAS |
| GRC Platforms | ServiceNow GRC · RSA Archer · OneTrust · SailPoint · Qualys · Jira · Confluence |
| Cloud Security | AWS Config · CloudTrail · Security Hub · GuardDuty · IAM · Azure |
| Automation | Python · Terraform · GitHub Actions · Policy-as-Code · OSCAL |
| AI Security | AI risk & impact assessments · MCP / AI agent access review · LLM red-team evidence (garak & promptfoo output) |
| Risk Analytics | SQL · Power BI · Streamlit · KRI/KPI reporting |
MS, Cybersecurity, University of Maryland, Baltimore County (UMBC) · Aug 2024 – May 2026
Bachelor's, Computer Engineering (Honors in Cybersecurity), University of Mumbai · Aug 2020 – May 2024
-C8202F?style=flat-square&logo=comptia&logoColor=white){kind=icon}
Hiring for GRC engineering, security compliance, cloud governance or AI governance? I'd like to hear about it. Happy to talk compliance-as-code, OSCAL, AI agent security, or making SOC 2 less painful.
