PCI Qualified Security Assessor (QSA)
PCI Security Standards Council
Verify on Credly (opens in a new tab)
Cybersecurity GRC consultant · Bengaluru
Madhup Bajpai. PCI DSS QSA and SWIFT CSP assessor.
I've spent more than eight years assessing banks, payment processors and merchants against PCI DSS, SWIFT CSP, NIST CSF and ISO 27001, across eight countries.
- Clients assessed
- 49
- Countries
- 8
- Years in GRC
- 8+
- PCI DSS engagements
- 30
About
Between the auditor and the engineer.
I'm a cybersecurity GRC consultant with more than eight years of leading several high-stakes engagements at once, across PCI DSS, SWIFT CSP, NIST CSF, ISO 27001, CBUAE and the NPCI risk and compliance framework.
Today I lead PCI DSS delivery at Sandbox Security as a Qualified Security Assessor, producing Reports on Compliance, Attestations of Compliance and SAQs. Before that I built assessment practices at Atos, Deloitte, NetSentries and Crossbow Labs.
- Based in
- Bengaluru, India
- Works across
- India · GCC · Americas · APAC · Africa
- Education
- B.Tech, Computer Science & EngineeringAlliance College of Engineering & Design · 2012–2016
- Focus sectors
- Banking, payments, fintech, merchants
Experience
Five firms, one discipline.
Feb 2026 to now
Senior Manager
Sandbox Security
- Leads PCI DSS implementation and compliance assessments, producing ROCs, AOCs and SAQs.
- Runs several engagements at once as engagement lead and delivery head.
Dec 2024 to Feb 2026
Consultant, GCM-4
Atos
- Led PCI DSS implementation and compliance assessments, and produced ROCs and SAQs.
- Performed PCI DSS readiness and security assessments against NIST CSF and NPCI frameworks.
- Worked with client technical and business teams to find remediation gaps and practical fixes.
May 2022 to Dec 2024
Solution Advisor
Deloitte USI
- Directed NIST CSF maturity evaluations, identifying policy, procedural and control gaps.
- Authored enterprise security policies aligned with NIST and reviewed complex architectures.
- Benchmarked clients with proprietary tooling to guide security investment decisions.
Jul 2021 to May 2022
Consultant
NetSentries Technologies
- Owned the full SWIFT CSP compliance lifecycle, from scoping and client interviews to gap analysis and control validation.
- Defined the assessment approach and standardised review and validation processes.
Oct 2019 to Jun 2021
Associate Consultant
Crossbow Labs
- Ran PCI DSS gap assessments to define scope and baseline compliance across a diverse merchant portfolio.
- Guided merchants through SAQ A, SAQ C-VT and SAQ D.
Earlier: 247.AI · Runnr (Carthero Technologies) · Finalytics Consultancy
Credentials
Qualified, and verifiable.
Certified Information Systems Auditor
ISACA
Verify on Credly (opens in a new tab)AWS Certified Security Specialty
Amazon Web Services
Verify on Credly (opens in a new tab)ISO/IEC 27001:2022 Lead Implementer
Information security management
CertifiedISO/IEC 27001:2013 Lead Auditor
Information security management
Certified
Clients
49 clients across eight countries.
Counts by country and framework. Client names stay confidential.
By framework
Expertise
What I assess, and how I can help.
PCI DSS
QSA-led scoping, v4.0.1 readiness, remediation and validation for merchants, processors and service providers.
- Scope and segmentation review
- Gap assessment and remediation roadmap
- ROC, AOC and SAQ support
- Targeted risk analyses and 6.4.3 / 11.6.1 readiness
SWIFT CSCF
Independent assessments against the current CSCF, from architecture type to KYC-SA attestation support.
- Architecture type confirmation
- Control-by-control assessment
- Data flow and back-office mapping
- Attestation support
NIST CSF & ISO 27001
Maturity assessments, policy frameworks and roadmaps that turn security posture into something a board can govern.
- NIST CSF 2.0 maturity and gap assessment
- ISO/IEC 27001 implementation and audit
- Policy and framework development
- Third-party risk and governance
Expertise, in practice
I turned my scoping workshops into free tools.
These are the questions I ask at the start of every PCI DSS and SWIFT CSCF engagement, written up as two short guided tools. They show how I reason about scope: a likely SAQ type or ROC route, or a SWIFT architecture type and the controls that follow, with the reasons behind each answer.
Runs entirely in your browser. Your answers are never stored or sent anywhere unless you choose to share them with me.
Insights
All insights
Short reads on the standards that matter.
Data Breach Watch: 27 October to 5 November 2026
The $6.3bn Binance theft, a supplier-led heist at Crédit Mutuel Arkéa, card data at Revolve, RBI cyber scrutiny, a DFSA fine for Moody's and five lessons.
Read articleData Breach Watch: 12–26 October 2026
SBI's dark-web leak, ransomware claims against DIFC and Gulf firms, Capcom, ASOS and LiteLLM, new GDPR enforcement, and five lessons for audit and incident response.
Read articleData Breach Watch: September 2026
Revolut, DriveWealth, Bitget and BigCommerce incidents, a UAE ransom demand, new GDPR fines, DPDP and PDPL status, and five lessons for audit and incident response.
Read article
Contact
Let's talk.
Planning a PCI DSS or SWIFT CSCF assessment, or want a second opinion on scope? Send me a note and I'll reply personally.