Hamza Zaki Ahmad

I design IT risk and control frameworks for financial institutions. Outside work, I build software.

Senior Associate in Risk Advisory at PwC Qatar, based in Doha. 5+ years across banking and financial services at EY and PwC, working with ISO 27001, NIST, COBIT and Qatar Central Bank requirements.

Press ~ to open the terminal.

Experience

Aug 2026 – Present

Doha, Qatar

PwC Qatar

Senior Associate, Risk Advisory

Designed a consolidated IT Risk and Control Self-Assessment (RCSA) baseline covering 18 IT domains and 200+ risk–control pairs, built on a control operating model that separates centralised, local, shared and system-specific ownership.
Implementing an IT Key Risk Indicator framework of 34 KRIs across nine risk domains, with a quarterly committee reporting pack that applies RAG, trend and escalation logic automatically.
Aligned risk and control design to Qatar Central Bank technology risk and cybersecurity requirements, drawing on ISO/IEC 27001, NIST SP 800-53, COBIT 2019 and CIS Controls.

Show 2 more

Calibrated inherent and residual risk ratings to the group risk matrix, with control adequacy and effectiveness credit, automated data-quality checks and a risk-based second-line assurance scope for key controls outside ICOFR testing.
Challenged KRI design as second line, finding definitional, threshold and data-source gaps, such as percentage formulas measured against count-based thresholds.

Sep 2025 – Jul 2026

Delhi, India

PwC India

Senior Associate, Security & Technology Risk

Turned information security risk assessments of banking applications and infrastructure into risk registers and treatment plans, using a structured ISMS methodology calibrated to risk appetite and regulation.
Assessed security risk across a large-scale banking data migration, covering data integrity controls, access governance and security requirements before production.
Ran control gap analyses across security domains, with prioritised remediation plans, named owners and timelines.

Show 3 more

Aligned information security policies and procedures with central bank regulation, ISO 27001 and internal governance frameworks.
Prepared current-state assessments, control evidence and security risk reports for regulatory reviews and audit readiness.
Reviewed third-party and vendor risk, advising on monitoring and control enhancements to limit supply-chain exposure.

Aug 2021 – Aug 2025

Mumbai, India

EY India

Consultant

Conducted enterprise-wide information security risk assessments for banking and financial services clients across network, application, identity and data, producing risk registers aligned to ISO 27001 and client risk appetite.
Mapped controls to the NIST Cybersecurity Framework and internal policy standards, identifying compliance gaps and rating remediation by risk.
Assessed a banking client's cardholder data environment, supporting PCI DSS scope definition and evaluating key controls.

Show 5 more

Supported ISO 27001 risk reviews and certification readiness, evaluating control effectiveness across information assets.
Reviewed identity and access management (provisioning, de-provisioning, privilege reviews) for unauthorised and orphaned access risk.
Updated information security policies and standards to meet regulatory requirements, including IRDAI guidelines.
Assessed encryption, key management and access control models for cloud and on-premises applications handling sensitive financial data.
Reviewed incident management and vendor risk processes, recommending better escalation, root-cause analysis and quarterly third-party assessments.

Frameworks

Frameworks I've applied, and where.

Select a mark to see the work behind it.

Framework	EY IndiaAug 2021 – Aug 2025	PwC IndiaSep 2025 – Jul 2026	PwC QatarAug 2026 – Present
Qatar Central Bank technology risk and cybersecurity	Not applied	Not applied	Qatar Central Bank technology risk and cybersecurity, PwC Qatar Aligned risk and control design to Qatar Central Bank technology risk and cybersecurity requirements, drawing on ISO/IEC 27001, NIST SP 800-53, COBIT 2019 and CIS Controls.
ISO/IEC 27001	ISO/IEC 27001, EY India Conducted enterprise-wide information security risk assessments for banking and financial services clients across network, application, identity and data, producing risk registers aligned to ISO 27001 and client risk appetite.	ISO/IEC 27001, PwC India Aligned information security policies and procedures with central bank regulation, ISO 27001 and internal governance frameworks.	ISO/IEC 27001, PwC Qatar Aligned risk and control design to Qatar Central Bank technology risk and cybersecurity requirements, drawing on ISO/IEC 27001, NIST SP 800-53, COBIT 2019 and CIS Controls.
NIST Cybersecurity Framework	NIST Cybersecurity Framework, EY India Mapped controls to the NIST Cybersecurity Framework and internal policy standards, identifying compliance gaps and rating remediation by risk.	Not applied	Not applied
NIST SP 800-53	Not applied	Not applied	NIST SP 800-53, PwC Qatar Aligned risk and control design to Qatar Central Bank technology risk and cybersecurity requirements, drawing on ISO/IEC 27001, NIST SP 800-53, COBIT 2019 and CIS Controls.
COBIT 2019	Not applied	Not applied	COBIT 2019, PwC Qatar Aligned risk and control design to Qatar Central Bank technology risk and cybersecurity requirements, drawing on ISO/IEC 27001, NIST SP 800-53, COBIT 2019 and CIS Controls.
CIS Controls	Not applied	Not applied	CIS Controls, PwC Qatar Aligned risk and control design to Qatar Central Bank technology risk and cybersecurity requirements, drawing on ISO/IEC 27001, NIST SP 800-53, COBIT 2019 and CIS Controls.
PCI DSS	PCI DSS, EY India Assessed a banking client's cardholder data environment, supporting PCI DSS scope definition and evaluating key controls.	Not applied	Not applied
ICOFR	Not applied	Not applied	ICOFR, PwC Qatar Calibrated inherent and residual risk ratings to the group risk matrix, with control adequacy and effectiveness credit, automated data-quality checks and a risk-based second-line assurance scope for key controls outside ICOFR testing.
IRDAI guidelines	IRDAI guidelines, EY India Updated information security policies and standards to meet regulatory requirements, including IRDAI guidelines.	Not applied	Not applied

Projects

Security tooling

Log correlation engine

Python engine that ingests and normalises application, authentication and system logs, then flags brute-force attempts, login-failure spikes, suspicious privilege escalation and misconfigurations as SOC-style alerts.

Python, JSON and CSV parsing, Linux CLI

File integrity monitor

Watches sensitive directories in real time, detects unauthorised changes with SHA-256 hashing, raises alerts and keeps an audit trail of access and modification events.

Python, watchdog, SHA-256

Web application testing lab

A controlled lab for testing OWASP Top 10 weaknesses (SQL injection, cross-site scripting, broken authentication), with findings rated by severity and turned into preventive controls.

Kali Linux, OWASP Top 10

Built outside work

Verity

ESG disclosure scoring for listed companies across the six GCC markets. It reads annual reports and scores how thoroughly each company discloses on environmental, social and governance topics, across 65 companies and six fiscal years (2020–2025).

Python, FastAPI, spaCy, PyMuPDF, Tesseract OCR, React, Postgres

Live site

Waypoint

A personal planning app: daily habits, an hourly schedule, workouts, goals, a calendar, weekly reflection and nutrition tracking, with private accounts and sync across devices.

Live site

Apex

Ranks your goals by scoring each one with the Hormozi value equation: dream outcome and likelihood of success against time and effort.

React, Zustand, PWA

Skills

Risk and governance: IT RCSA design, KRI frameworks, risk registers, three lines of defence, ISO 31000, information security policy.

Security: security risk assessment, identity and access management, cloud security (Azure), logging and monitoring, encryption and secrets management, vulnerability assessment, third-party risk.

Building: Python, TypeScript, React, FastAPI, Postgres, Firebase, LLM integrations.

Credentials

Certifications

Microsoft Certified: Azure Fundamentals (AZ-900).

Awards

I Am Exceptional Award, EY India, 2023 — collaboration across multiple teams to implement a business solution.

I Am Exceptional Award, EY India, 2021 — resolving a complex IT business problem for a client.

Education

Bachelor of Engineering, Computer Science and Engineering, Karavali Institute of Technology (Visvesvaraya Technological University), Mangalore, India, 2021.

Contact

Email is the quickest way to reach me. hamza.ibnzaki@proton.me

Connect on LinkedIn