Dhruv Shahi

Four years on both sides of the same problem. Long enough in the room where the rules get enforced to know which ones survive contact with a real system, and close enough to the build to make the enforcing itself the software.

1. Senior GRC Engineer at Workstreet

   Jun 2025 to present·India

   A compliance and trust engineering firm in the US. I build the systems that do the compliance work, rather than doing it by hand and calling that a process.

   • AI governance
   • Evidence automation
   • Multi agent review
   • Prompt engineering
   • Control mapping
   • Evidence lifecycle

   21 to 7

   days to map one framework onto another

   4 days to 5 minutes

   to author a set of custom tests

   70%

   of security questionnaire answers drafted for review

   196

   controls in the framework I assess against

   320

   assessment objectives worked at full depth

   • Built a generator that maps assessment objectives onto client specific tests, so the expert reviews the output instead of typing it.
   • Designed review boards where separate agents check, cross check and challenge every verdict before it reaches a human gate.
   • Analysed 161 candidate tests across 73 assessment objectives to find which ones genuinely stood alone.
   • Caught a weekly vulnerability count moving from 371 to 953 before the external assessor raised it.

2. Cyber Security Consultant at Ernst and Young

   Jul 2022 to Jul 2025·Bengaluru

   Three years of assessments and remediation across enterprise estates. Promoted out of the associate grade after 14 months.

   • Third party risk management
   • Vendor risk
   • Gap assessments
   • Cloud security
   • Application security

   30+

   enterprise applications assessed before deployment

   50+

   critical cloud misconfigurations closed

   20+

   third party risk assessments

   95%

   of security defects closed on time

   14

   months to promotion from associate

   • Reviewed authentication, encryption and authorisation on applications before they shipped, with source code review alongside the testing teams.
   • Found and closed exposed storage, permissive access policies, unencrypted databases and missing multi factor authentication across two clouds.
   • Secured container workloads and put security checks inside the infrastructure pipelines rather than after them.
   • Delivered the PCI DSS v3.2.1 to v4.0 transition assessment and its remediation roadmap.

Six rooms I work in. The governance is certified, assessed or graded by the engine above. The rest came from shipping my own products, where there is nobody to hand the writing, the design, the ad account or the automation to, so you learn them or the thing does not launch.

Everything above this line is finished and open. Everything below it is not, and says so. It is here because the useful conversations tend to start before a thing is built rather than after.

• FinOS

  in progress

  A personal finance operating system: it values a portfolio against real fund and stock prices daily, and a scheduled analyst writes cited insight over the result.

  I want in→

• Control Room

  in progress

  A SaaS product's obligations move underneath it. Control Room works out which security and regulatory requirements apply as they change, shows the risk that opens up when they do, and names the controls that answer it. One screen, instead of five spreadsheets and a call.

  I want in→

• Cadence

  in progress

  A content engine that runs on a schedule and learns. It reads the niche, watches what the competition is doing, generates the work, scores it, and keeps whatever actually performed. Built to launch one product, then found to work for any of them.

  I want in→

• Munimo

  in progress

  A munim in the pocket of someone who owns a few trucks. Say the trip out loud, in Hindi or in English, and it keeps the books: what the load paid, what it cost to run, and who has still not settled. The chasing happens over WhatsApp, because that is where the money conversation already is.

  I want in→

• Sigil

  in design

  A gaming identity as one animated holographic card: your library, your loadout, and the squad you play with, on a thing you can show.

  I want in→

• Asli

  in progress

  Asli means genuine. India has the players and no dependable way for one of them to prove it: trials are run by whoever says they are running them, and nothing a player does is recorded anywhere they own. So the organiser is verified before the listing goes up, the registration is built for minors, and the attendance certificate can still be checked years later. Talent should not need a contact to be seen.

  I want in→

If one of these is a thing you have already started, or a thing you think is wrong, that is the more interesting mail to send.