Chief information security officer
KishanPatel
I help banks and businesses stay secure as a virtual CISO, security auditor, penetration tester, trainer.
Founder and CEO of LetsDefend Infosec. More than eight years in information security, most recently as Chief Information Security Officer of a cooperative bank.
Kishan Patel
- Role
- Founder and CEO
- Based in
- Modasa, Gujarat
- Certified
- CCISO, CISA, DISA
- Virtual CISO
- IS audit
- VAPT
- RBI compliance
- CERT-IN
- Risk assessment
- Security architecture
- Threat detection
- Governance
- Security training
Security leadership, learned inside regulated banks.
I'm a cybersecurity leader with more than eight years in information security. I started in bank IT, running the networks, servers and payment services a cooperative bank depends on, and went on to become a Chief Information Security Officer.
In December 2024 I founded LetsDefend Infosec. I now work with financial institutions and corporate clients as a virtual CISO, lead IS and VAPT audits, and design cybersecurity training for IT teams, auditors and management.
I know the RBI and CERT-IN compliance frameworks from the inside, which helps me keep organisations audit-ready while building a culture that takes risk seriously.
- Now
- Founder and CEO, LetsDefend Infosec
- Before
- CISO, The Mehsana Urban Co-operative Bank
- Recognition
- Official RBI trainer
- Education
- ME, IT Systems and Network Security
- Conferences
- Regular at Nullcon, COCON and others
- Languages
- English, Gujarati, Hindi
- Off the clock
- Cricket, swimming, incident write-ups
Experience
Three roles, all in or around banking. Hover or tap a role to open it.
- Lead virtual CISO engagements covering security strategy, risk mitigation, compliance and security investments.
- Led VAPT and IS audits for financial institutions and corporate clients, using Nessus, Burp Suite, Nmap and more.
- Designed internal security frameworks aligned with RBI, CERT-IN, ISO 27001 and NIST.
- Built and delivered hands-on training for IT teams, audit professionals and management.
- Supervise the full audit lifecycle: planning, observation management, documentation, reporting and compliance verification.
- Manage a growing team of cybersecurity professionals.
- Owned compliance with RBI and CERT-IN guidelines, advisories and alerts, and the RBI Cyber Security Framework.
- Planned, designed and ran the risk assessment and vendor risk assessment processes.
- Supervised IT audit and performed internal VAPT and IS audits, including SAR audit and AUA/KUA audit controls.
- Monitored logs with FortiAnalyzer and Trend Micro Vision One XDR.
- Took part in IDRBT cyber drills and ran email phishing drills and staff awareness training.
- Presented to the Board of Directors and the Audit Committee.
- Administered the bank's network infrastructure, servers and firewall configuration.
- Handled cyber security implementation and RBI compliance reporting.
- Managed online banking services: RTGS, NEFT, IMPS, UPI, ATM, POS and e-commerce.
- Managed core banking, CTR reporting, C-KYC and NPCI services such as NACH and CTS.
- Trained employees and customers on cyber threats and safe practice.
Recognition
- Official RBI trainer
What I do
Seven services, delivered through LetsDefend Infosec. Hover or tap one to see what it covers.
Experienced security leadership on call. Expert, cost-effective guidance without the overhead of a full-time CISO.
- Strategic security planning
- Risk mitigation
- Compliance oversight
- Guidance on security investments
IS audits run end to end, from planning through to verifying that observations have been closed.
- Audit planning
- Observation management
- Documentation and reporting
- Compliance verification
Find and validate the vulnerabilities in your applications, networks and systems before someone else does.
- Vulnerability assessment
- Penetration testing
- Industry-standard tooling such as Nessus, Burp Suite and Nmap
- Mitigation guidance for each finding
Stay audit-ready against RBI and CERT-IN expectations while building a risk-aware culture.
- RBI and CERT-IN compliance frameworks
- Internal security frameworks aligned with ISO 27001 and NIST
- Tracking advisories and alerts
I help you align with these frameworks. I do not issue certifications.
Ask me about thisStrategic advice on where your cyber risk sits and what to do about it first.
- Regulatory compliance
- Incident readiness
- Security posture enhancement
Hands-on sessions designed for the people in the room, building a culture of security awareness.
- Sessions for IT teams
- Sessions for audit professionals
- Sessions for management
Structured posture management, and help choosing and implementing the security products that are worth the spend.
- Structured posture management
- Full-cycle security project implementation
- Product evaluation and cost-effectiveness analysis
- Vendor negotiation
Leadership
Virtual CISO
Experienced security leadership on call. Expert, cost-effective guidance without the overhead of a full-time CISO.
- Strategic security planning
- Risk mitigation
- Compliance oversight
- Guidance on security investments
Skills
The areas below reflect hands-on work, much of it inside regulated financial institutions.
Governance, risk and compliance
- RBI Cyber Security Framework
- CERT-IN guidelines and advisories
- ISO 27001 and NIST alignment
- Risk assessment
- Vendor risk assessment
- IS audit lifecycle
Offensive security
- Vulnerability assessment
- Penetration testing
- Web application testing
- Network assessment
- Phishing drills
Defensive security
- SIEM and log monitoring
- XDR
- Email security gateways
- IDS and IPS
- Security architecture
Infrastructure security
- Firewalls and web application firewalls
- CIS Benchmark OS hardening
- Patch management
- Linux administration
- AWS cloud administration
Research. Test. Break. Defend.
The tools behind the work. Hover or tap a stage to see what I reach for.
sources --watch
Staying current on how attacks are actually happening.
- CERT-IN advisories and alerts
- Incident write-ups and technical blogs
- Security conferences across India, including Nullcon and COCON
- Bug bounty practice
How I work
Five steps, in this order, on every engagement.
- 01
Understand
Understand the business, infrastructure, applications and security objectives.
- 02
Discover
Map the attack surface and identify potential weaknesses.
- 03
Validate
Safely validate vulnerabilities and determine real-world impact.
- 04
Remediate
Provide actionable recommendations and practical remediation guidance.
- 05
Strengthen
Help improve security posture and reduce future exposure.
Every exposed surface is a potential entry point.
Hover or tap a surface to see what typically goes wrong there.
Illustrative Security Model
Web application
What typically goes wrong
Injection flaws, broken access control and weak session handling can let an outsider act as a legitimate user.
How I look at it
Covered by web application penetration testing.
Credentials
Certifications
- CCISOCertified Chief Information Security OfficerEC-CouncilApril 2025, valid to April 2027
- CISACertified Information Systems AuditorISACA, USAFebruary 2023
- DISADiploma in Information Security AuditorIIBF, MumbaiOctober 2022
Education
- MEMaster of Engineering, IT Systems and Network SecurityGujarat Technological University. Second rank in the university.September 2016
- BEBachelor of Engineering, Computer EngineeringGovernment Engineering College, ModasaMay 2015
Let's talk security.
Need a virtual CISO, an audit, a penetration test or a training session? Tell me what you're working on.
- info@letsdefend.in
- Location
- Modasa, Gujarat, India
- linkedin.com/in/erkishanpatel