Gowri Shankar

Enterprise Security Architect

Gowri Shankar Balasubramaniam

I build and protect payment platforms. 16 years in software and security.

Connect on LinkedIn Read the blog Get in touch
Gowri Shankar Balasubramaniam — Cybersecurity & Application Security

About me

I started as a software developer in Chennai in 2010 and moved through software architecture and infrastructure into security. Today I work as the IT Application Security Manager at Novalnet in Munich, where I look after the security of a large payment platform.

Having written and run the systems myself, I know what developers and operations teams are up against. That helps when I sit down with them to agree on security requirements that they can actually build and maintain.

Day to day that means threat modelling, architecture reviews, secure coding standards, vulnerability follow-up and keeping our controls in line with PCI DSS and SOC 2. I have been solely responsible for PCI DSS Level 1 compliance across the payment ecosystem and for SOC 2 Type II certification since 2018.

I am open to leadership roles in security architecture and cybersecurity, up to Head of Security or CISO level.

Latest from the blog

All articles

Experience

Novalnet AG, Munich · June 2010 to today

  1. Aug 2021 to present

    IT Application Security Manager

    • Lead application security for the payment platform: secure SDLC, security architecture reviews, threat modelling and vulnerability management.
    • Rank security risks by what matters to the business, then follow them through with development and infrastructure teams until they are fixed.
    • Solely responsible for PCI DSS v4.0.1 Level 1 compliance across the whole payment ecosystem and SOC 2 Type II certification since 2018.
    • Run secure coding standards and code reviews with the developers as a regular process, based on OWASP.
    • Apply Zero Trust principles and infrastructure-as-code hardening across the platform.
    • Built automated systems that run our threat modelling process. We have seen fewer security issues since.
    • Designed the payment infrastructure and the mail server architecture, giving us a high-availability platform across multiple data centers.

  2. Jul 2017 to Jul 2021

    IT Security Architect

    • Designed secure application architectures and the enterprise network for a large-scale payment platform.
    • Took over PCI DSS Level 1 compliance for the whole ecosystem in 2018.
    • Designed and built an automated IVR payment solution and integrated it end to end into our payment ecosystem.
    • Designed and built the backend and technical architecture of a client-facing SoftPOS product, from first design to integration.
    • Ran architecture reviews and threat modelling, and looked after infrastructure security and Linux administration.

  3. Jan 2017 to Jun 2017

    Application Manager

    • Designed and managed servers across the payment platform and ran the application platform following OWASP guidance.

  4. Feb 2014 to Dec 2016

    Software Architect

    • Designed web application architecture and payment gateway integrations, developed new payment products, supported customers and coordinated projects.

  5. Jun 2010 to Jan 2014

    Software Developer, Novalnet e-Solutions, Chennai

    • Built web applications and payment processing features.
    • Set up and led the security, testing and quality assurance functions for an organization of more than 150 people, including recruitment, technical training and processes.

Skills

Security architecture

  • Enterprise security architecture
  • Zero Trust
  • Threat modelling
  • Risk assessment
  • Secure network design
  • Infrastructure security

Secure SDLC and DevSecOps

  • Secure coding
  • Code review
  • Architecture reviews
  • Security automation
  • OWASP Top 10
  • ASVS
  • API Security
  • SAMM

Compliance and governance

  • PCI DSS Level 1
  • SOC 2 Type II
  • GDPR
  • Vulnerability management
  • Security governance

Platform and availability

  • High availability
  • Load balancing
  • Multi-data-center design
  • Reverse proxy
  • Disaster recovery
  • Business continuity
  • Linux

Payments

  • Payment gateways
  • Online payment processing
  • Payment security

Tools and technologies

  • OWASP
  • Wazuh
  • Sophos XDR
  • ClamAV
  • OpenSearch
  • Checkmk
  • Uptime Kuma
  • Prometheus
  • Grafana
  • Filebeat
  • Linux
  • Ubuntu
  • openSUSE
  • Docker
  • Kubernetes
  • Nginx
  • OpenLiteSpeed
  • ProxySQL
  • Sophos Firewall
  • Cisco Firewall
  • MySQL
  • MariaDB
  • PostgreSQL
  • MongoDB
  • SQLite
  • Node.js
  • React
  • Next.js
  • Golang
  • PHP
  • Python
  • Typesense
  • Ollama
  • Open WebUI
  • Onyx AI
  • Mattermost
  • Microsoft Visio
  • Microsoft 365
  • Power Automate
  • Active Directory
  • Git
  • Zimbra
  • Stalwart Mail Server
  • Samba

Certifications and recognition

  • CWASPCertified Web Application Security Professional
  • CPISI 2.0Certified Payment Card Industry Security Implementer
  • CSOCPCertified Security Operations Center Practitioner

Awards

  • First Prize, ELCOT & NASSCOM Software Development Competition, an India-wide competition run by the Government of Tamil Nadu

Writing

  • Iframe Integrity: Empowering PSPs to Secure Payment Iframes Against Skimming Attacks with Zero Hassle

Education

  • B.E., Engineering and Technology, PSNA College of Engineering and Technology (2007 to 2010)
  • Diploma in Information Technology, Nachimuthu Polytechnic College (2004 to 2007)

Contact

If you have a security question you would like to talk about, write to me. I read every message.

Email
info@gowrishankar.me
LinkedIn
linkedin.com/in/gowri-shankar-ags/
Location
Munich, Germany