Hamza Zaki Ahmad
I design IT risk and control frameworks for financial institutions. Outside work, I build software.
Experience
PwC Qatar
Senior Associate, Risk Advisory
Aug 2026 – Present
Doha, Qatar
- Designed a consolidated IT Risk and Control Self-Assessment (RCSA) baseline covering 18 IT domains and 200+ risk–control pairs, built on a control operating model that separates centralised, local, shared and system-specific ownership.
- Implementing an IT Key Risk Indicator framework of 34 KRIs across nine risk domains, with a quarterly committee reporting pack that applies RAG, trend and escalation logic automatically.
- Aligned risk and control design to Qatar Central Bank technology risk and cybersecurity requirements, drawing on ISO/IEC 27001, NIST SP 800-53, COBIT 2019 and CIS Controls.
- Calibrated inherent and residual risk ratings to the group risk matrix, with control adequacy and effectiveness credit, automated data-quality checks and a risk-based second-line assurance scope for key controls outside ICOFR testing.
- Challenged KRI design as second line, finding definitional, threshold and data-source gaps, such as percentage formulas measured against count-based thresholds.
PwC India
Senior Associate, Security & Technology Risk
Sep 2025 – Jul 2026
Delhi, India
- Turned information security risk assessments of banking applications and infrastructure into risk registers and treatment plans, using a structured ISMS methodology calibrated to risk appetite and regulation.
- Assessed security risk across a large-scale banking data migration, covering data integrity controls, access governance and security requirements before production.
- Ran control gap analyses across security domains, with prioritised remediation plans, named owners and timelines.
- Aligned information security policies and procedures with central bank regulation, ISO 27001 and internal governance frameworks.
- Prepared current-state assessments, control evidence and security risk reports for regulatory reviews and audit readiness.
- Reviewed third-party and vendor risk, advising on monitoring and control enhancements to limit supply-chain exposure.
EY India
Consultant
Aug 2021 – Aug 2025
Mumbai, India
- Conducted enterprise-wide information security risk assessments for banking and financial services clients across network, application, identity and data, producing risk registers aligned to ISO 27001 and client risk appetite.
- Mapped controls to the NIST Cybersecurity Framework and internal policy standards, identifying compliance gaps and rating remediation by risk.
- Assessed a banking client's cardholder data environment, supporting PCI DSS scope definition and evaluating key controls.
- Supported ISO 27001 risk reviews and certification readiness, evaluating control effectiveness across information assets.
- Reviewed identity and access management (provisioning, de-provisioning, privilege reviews) for unauthorised and orphaned access risk.
- Updated information security policies and standards to meet regulatory requirements, including IRDAI guidelines.
- Assessed encryption, key management and access control models for cloud and on-premises applications handling sensitive financial data.
- Reviewed incident management and vendor risk processes, recommending better escalation, root-cause analysis and quarterly third-party assessments.
Frameworks applied
- Qatar Central Bank technology risk and cybersecurity
- ISO/IEC 27001
- NIST Cybersecurity Framework
- NIST SP 800-53
- COBIT 2019
- CIS Controls
- PCI DSS
- ICOFR
- IRDAI guidelines
Projects
Log correlation engine
Python engine that ingests and normalises application, authentication and system logs, then flags brute-force attempts, login-failure spikes, suspicious privilege escalation and misconfigurations as SOC-style alerts.
Python, JSON and CSV parsing, Linux CLI
File integrity monitor
Watches sensitive directories in real time, detects unauthorised changes with SHA-256 hashing, raises alerts and keeps an audit trail of access and modification events.
Python, watchdog, SHA-256
Web application testing lab
A controlled lab for testing OWASP Top 10 weaknesses (SQL injection, cross-site scripting, broken authentication), with findings rated by severity and turned into preventive controls.
Kali Linux, OWASP Top 10
Verity
ESG disclosure scoring for listed companies across the six GCC markets. It reads annual reports and scores how thoroughly each company discloses on environmental, social and governance topics, across 65 companies and six fiscal years (2020–2025).
Python, FastAPI, spaCy, PyMuPDF, Tesseract OCR, React, Postgres
Waypoint
A personal planning app: daily habits, an hourly schedule, workouts, goals, a calendar, weekly reflection and nutrition tracking, with private accounts and sync across devices.
Apex
Ranks your goals by scoring each one with the Hormozi value equation: dream outcome and likelihood of success against time and effort.
React, Zustand, PWA
Skills
Risk and governance: IT RCSA design, KRI frameworks, risk registers, three lines of defence, ISO 31000, information security policy.
Security: security risk assessment, identity and access management, cloud security (Azure), logging and monitoring, encryption and secrets management, vulnerability assessment, third-party risk.
Building: Python, TypeScript, React, FastAPI, Postgres, Firebase, LLM integrations.
Credentials
Certifications
Microsoft Certified: Azure Fundamentals (AZ-900).
Awards
I Am Exceptional Award, EY India, 2023 — collaboration across multiple teams to implement a business solution.
I Am Exceptional Award, EY India, 2021 — resolving a complex IT business problem for a client.
Education
Bachelor of Engineering, Computer Science and Engineering, Karavali Institute of Technology (Visvesvaraya Technological University), Mangalore, India, 2021.