Gowri Shankar

IT Application Security Manager · Enterprise Security Architect

Gowri Shankar Balasubramaniam

I secure payment platforms under PCI DSS Level 1 by building security into the architecture, not adding it afterwards. 16 years across software, infrastructure and security.

Connect on LinkedIn Read the blog Get in touch
Gowri Shankar Balasubramaniam — Cybersecurity & Application Security

About me

I started as a software developer in Chennai in 2010 and moved through software architecture and infrastructure into security. Today I work as the IT Application Security Manager at Novalnet in Munich, where I look after the security of a large payment platform.

Having written and run the systems myself, I know what developers and operations teams are up against. That helps when I sit down with them to agree on security requirements that they can actually build and maintain.

Day to day that means threat modelling, architecture reviews, secure coding standards, vulnerability follow-up and keeping our controls in line with PCI DSS and SOC 2. I have been solely responsible for PCI DSS Level 1 compliance across the payment ecosystem and for SOC 2 Type II certification since 2018.

I am open to leadership roles in security architecture and cybersecurity, up to Head of Security or CISO level.

Latest from the blog

All articles

Vulnerability Analysis

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 - Critical Unauthenticated RCE in PHP

PHP2Shell is a pair of critical vulnerabilities in the PHP runtime, rated CVSS v4.0 9.2, that let unauthenticated attackers execute code on web servers. Apache mod_php can be exploited before any application code runs. This advisory covers affected versions, how each attack chain works, patching, interim php.ini mitigations, detection and compliance impact.

11 min read Updated

Experience

Novalnet AG, Munich · June 2010 to today

  1. Aug 2021 to present

    IT Application Security Manager

    • Lead application security for the payment platform: secure SDLC, security architecture reviews, threat modelling and vulnerability management.
    • Rank security risks by what matters to the business, then follow them through with development and infrastructure teams until they are fixed.
    • Solely responsible for PCI DSS v4.0.1 Level 1 compliance across the whole payment ecosystem and SOC 2 Type II certification since 2018.
    • Run secure coding standards and code reviews with the developers as a regular process, based on OWASP.
    • Apply Zero Trust principles and infrastructure-as-code hardening across the platform.
    • Built automated systems that run our threat modelling process. We have seen fewer security issues since.
    • Designed the payment infrastructure and the mail server architecture, giving us a high-availability platform across multiple data centers.

  2. Jul 2017 to Jul 2021

    IT Security Architect

    • Designed secure application architectures and the enterprise network for a large-scale payment platform.
    • Took over PCI DSS Level 1 compliance for the whole ecosystem in 2018.
    • Designed and built an automated IVR payment solution and integrated it end to end into our payment ecosystem.
    • Designed and built the backend and technical architecture of a client-facing SoftPOS product, from first design to integration.
    • Ran architecture reviews and threat modelling, and looked after infrastructure security and Linux administration.

  3. Jan 2017 to Jun 2017

    Application Manager

    • Designed and managed servers across the payment platform and ran the application platform following OWASP guidance.

  4. Feb 2014 to Dec 2016

    Software Architect

    • Designed web application architecture and payment gateway integrations, developed new payment products, supported customers and coordinated projects.

  5. Jun 2010 to Jan 2014

    Software Developer, Novalnet e-Solutions, Chennai

    • Built web applications and payment processing features.
    • Set up and led the security, testing and quality assurance functions for an organization of more than 150 people, including recruitment, technical training and processes.

Skills

Security architecture

  • Enterprise security architecture
  • Zero Trust
  • Threat modelling
  • Risk assessment
  • Secure network design
  • Infrastructure security

Secure SDLC and DevSecOps

  • Secure coding
  • Code review
  • Architecture reviews
  • Security automation
  • OWASP Top 10
  • ASVS
  • API Security
  • SAMM

Compliance and governance

  • PCI DSS Level 1
  • SOC 2 Type II
  • GDPR
  • Vulnerability management
  • Security governance

Platform and availability

  • High availability
  • Load balancing
  • Multi-data-center design
  • Reverse proxy
  • Disaster recovery
  • Business continuity
  • Linux

Payments

  • Payment gateways
  • Online payment processing
  • Payment security

Tools and technologies

  • OWASP
  • Wazuh
  • Sophos XDR
  • ClamAV
  • OpenSearch
  • Checkmk
  • Uptime Kuma
  • Prometheus
  • Grafana
  • Filebeat
  • Linux
  • Ubuntu
  • openSUSE
  • Docker
  • Kubernetes
  • Nginx
  • OpenLiteSpeed
  • ProxySQL
  • Sophos Firewall
  • Cisco Firewall
  • MySQL
  • MariaDB
  • PostgreSQL
  • MongoDB
  • SQLite
  • Node.js
  • React
  • Next.js
  • Golang
  • PHP
  • Python
  • Typesense
  • Ollama
  • Open WebUI
  • Onyx AI
  • Mattermost
  • Microsoft Visio
  • Microsoft 365
  • Power Automate
  • Active Directory
  • Git
  • Zimbra
  • Stalwart Mail Server
  • Samba

Certifications and recognition

  • CWASPCertified Web Application Security Professional
  • CPISI 2.0Certified Payment Card Industry Security Implementer
  • CSOCPCertified Security Operations Center Practitioner

Awards

  • First Prize, ELCOT & NASSCOM Software Development Competition, an India-wide competition run by the Government of Tamil Nadu

Writing

  • Iframe Integrity: Empowering PSPs to Secure Payment Iframes Against Skimming Attacks with Zero Hassle

Education

  • B.E., Engineering and Technology, PSNA College of Engineering and Technology (2007 to 2010)
  • Diploma in Information Technology, Nachimuthu Polytechnic College (2004 to 2007)

Contact

If you have a security question you would like to talk about, write to me. I read every message.

Email
info@gowrishankar.me
LinkedIn
linkedin.com/in/gowri-shankar-ags/
Location
Munich, Germany