May 2019
High School Degree
Completed my High School in ST. Thomas' Church School, Howrah in the year 2019 as a Computer Science Student.
Hello! I'm Aayush Tiwari, an ISO/IEC 27001:2022 Lead Auditor and Third-Party Risk Management professional with experience at KPMG Global Services and EY Global Delivery Services. I specialize in conducting vendor security assessments, financial due diligence, and compliance reviews for enterprise and Fortune 500 clients.
Over the past few years, I have completed 100+ vendor risk assessments, reviewed security certifications (SOC 2, ISO 27001, PCI-DSS), and helped organizations strengthen their security posture across frameworks such as ISO 27001, PCI-DSS, GDPR, and NIST RMF. I enjoy translating complex security and compliance requirements into practical, business-focused recommendations.
I am particularly interested in GRC, TPRM, and cybersecurity — building scalable vendor risk programs, improving security questionnaires and processes, and collaborating with cross-functional teams to reduce risk. Outside of work, I focus on continuous learning in cloud security, security automation, and modern risk management practices.
If you're looking to build or improve your third-party risk program, need help with vendor assessments, or want to discuss GRC and cybersecurity careers, feel free to reach out. I'm always open to meaningful conversations and collaborations.
I combine hands-on third-party risk and information security experience with a structured Big 4 consulting background. At EY and KPMG, I have delivered vendor risk assessments, quality reviews, and compliance engagements for global clients, often under tight deadlines and high expectations.
My strengths include identifying high-risk vendors, reviewing security certifications (SOC 2, ISO 27001, PCI-DSS), and translating technical and regulatory requirements into clear, actionable remediation plans. I focus on both the control environment and the business impact.
I enjoy collaborating with cross-functional teams, mentoring peers, and continuously improving assessment methodologies and documentation quality. I take ownership of my work, communicate clearly with stakeholders, and always aim to deliver concise, decision-ready risk insights rather than just long reports.
If you need someone who understands both security frameworks and real-world vendor risk challenges, and who can communicate effectively with technical and business stakeholders, I can add value to your team and your security program.
My personal vision is to have a life of meaning for myself and others. It is important to me to live my life in a way that shows kindness, care, and concern for family and friends and even strangers. Earn respect for myself based on a recognition of my accomplishments and abilities maintains a sense of appreciation of the beauty of nature, and a sense of humour.I want to remain true to myself while experiencing all life has to offer. I am comfortable in my quietness and content being in my own company. Though I recognize my introversion is not a flaw to be changed, it does represent an interpersonal challenge. I will work on being more present and attentive when engaging with others. This will allow me to foster trust, connection, and intimacy which are essential for meaningful long-term relationships.
I want to have a career/life that includes constant learning and improvement for myself, but that also creates an atmosphere of pleasurable learning and improvement for others. I want to work with and around people, and it is important to me that they like me; but it is even more important to me that they feel that I have helped them in some way – not necessarily that I do a specific good deed, but more that some kindness or thoughtfulness or wisdom of mine has touched them.
I help organizations understand and manage risk from their third parties, align with security and compliance frameworks, and communicate risk clearly to stakeholders. My work focuses on vendor security assessments, ISO 27001 audits, and building practical, scalable GRC practices.
End-to-end review of vendor security posture through structured questionnaires, evidence checks, and risk scoring to support informed onboarding and renewals.
Support with ISO 27001-aligned controls, gap identification, and remediation insights, along with alignment to SOC 2, PCI-DSS, GDPR and NIST RMF requirements.
Design, review, and optimize security questionnaires and responses to reduce friction, increase clarity, and better reflect the true risk posture.
Creation of concise, visual risk summaries, dashboards and KRIs that help stakeholders quickly understand exposure and prioritize actions.
A full-stack developer aims to attentively listen, keenly observe, deeply understand, empathize, synthesize information, and extract insights to illuminate the invisible through technology. To me, development embodies the essence of enriching user experiences and elevating the quality of life. Authentic mastery in development transcends transient trends and superficial endeavours. Rather, a developer should strive to craft purposeful, influential solutions that surpasses mere compartmentalization and transient fashion.
A Web Application to find the recipe from your given Ingredient with additional functionalities
A Static Fully Responsive Blog Website. The website was made using HTML, CSS and Javascript.
A Dynamic Professional Business Website focused on career growth and business enhancement with contact database form.
A API Based Web Application to Find the Job matching your given working field and location.
A Weather Based Web Application for real-time weather information for your given location with additional functionalities.
A end-to-end database multi-page. Users can create, read, update and delete employee data respectively.
A Weather Based Web Application for real-time weather information for any given location with additional functionalities.
Developed a JobTracker Web App with optimized back-end, Restful APIs, MongoDB Atlas for storage, and secure user authentication.
Developed a high-performance file-sharing web app with real-time link copying and email sharing features. Proficiently integrated multer for file uploads and nodemailer for seamless cross-browser email communication.
Created and engineered an online e-commerce platform tailored for the exclusive sale of distinctive sneaker footwear.
Contrary to popular belief, my journey is more than just a timeline. It's a story of growth, passion, and continuous learning. Please review the milestones that have shaped my path below.
May 2019
Completed my High School in ST. Thomas' Church School, Howrah in the year 2019 as a Computer Science Student.
July 2019
Techno International Newtown
Bachelor's Degree enrolled in Electronics and Communication Engineering
Sept 2020
Started Coding in C/C++ language. Learned problem-solving skills and got introduced to Data Structures & Algorithms
Aug 2021
Started learning Web Developments and Converted Photoshop layouts to web pages using HTML, CSS, and JavaScript.
January 2024
Joined EY Global Delivery Services as Analyst 1 in Third-Party Risk Management, conducting vendor security and risk assessments for global clients.
April 2025
Progressed to Analyst 2 at EY GDS and got the ISO 27001 Lead Auditor Certification.
August 2025
Joined KPMG Global Services as an Associate Consultant, focusing on vendor assessments, quality reviews, and ISO 27001-aligned engagements.
If you want to contact me, the necessary data is given below, containing my Number, Email, and the address of my workplace.
+917595820411,
+918420758576
tiwariaayush682@gmail.com,
tiwariaayush682@outlook.com
28, Mallick Para Kona, Howrah
Code - 711 114