Karanbir Singh Kochar

I build security risk programs that organizations can actually rely on, at the scale a global payments network demands.At Visa I grew the cybersecurity GRC function from four people into a 30-person global organization spanning three regions, covering FFIEC, PCI, SWIFT, NYDFS, SOX, GLBA, RBI India and EU frameworks. Before that I spent 11 years directing Visa's technology internal audit program across an audit universe of 18 technology domains; the function passed two external quality assessments against IIA standards with the highest ratings.I represent Visa on the Executive Committee of the PCI Security Standards Council, the body that sets policy for the standards the payments industry is measured against, and serve on six of its technical working groups.Most of my attention now is on AI. I lead development of Visa's security standards for generative and agentic AI, and I'm building the executive and global team enablement for the Visa Vulnerability Agentic Harness, which Visa recently open sourced.What I've built:- Visa's first proactive Cybersecurity Control Testing program, aligned with ISO 27001, PCI and SOC 2- Enterprise GRC automation on AuditBoard: 40% faster compliance cycle time- An AI-powered audit response assistant: 30% faster regulatory inquiry turnaround- Visa's Cybersecurity Certification Program: 20,000+ people reached globally- Visa's global information security policy framework and enterprise Cybersecurity Awareness Program- A team with sub-5% attrition, built on mentorship and real investment in peopleGreat GRC isn't about checking boxes. It's the trust infrastructure that lets a business move quickly with confidence: the right operating model, the right tools, and risk explained in language boards and regulators respond to.Having led both the audit function and the organization that partners with auditors and regulators, I care about making assurance genuinely useful to a CIO or CISO. I enjoy the work most where scale, global regulation and AI governance intersect.Certifications: CISSP | CISA | PMP | PCI-ISA | CCSK | CSM | NIST AI RMFAlways open to connecting with peers and leaders in the cybersecurity and risk community.