Skip to content
Shivoy Malhotra
Resume(PDF, opens in a new tab)
Shivoy Malhotra, Cybersecurity & Cloud Transformation
Currently · AonToronto, ON

Shivoy Malhotra

Cybersecurity & Cloud Transformation

Client-facing technical advisor, focused on solutions engineering: discovery, demos, and technical evaluations.

Cybersecurity and cloud transformation professional with 7+ years of Big Four consulting experience. Client-facing technical advisor: discovery, design walkthroughs, and pre-sales technical work with engineers and executives.

Recently focused on AI security, building and testing LLM systems hands-on.

  • IAM
  • Zero-trust architecture
  • OCI · Azure · AWS · GCP
  • LLM security
  • Prompt-injection defense
Years, Big Four consulting
7+Years, Big Four consulting
OCI certifications
8×OCI certifications
Critical financial apps migrated to OCI
13Critical financial apps migrated to OCI
Prompt-injection attacks blocked (PhishSquad)
5/5Prompt-injection attacks blocked (PhishSquad)

Experience

Cybersecurity, IAM and cloud transformation across Big Four consulting, now program delivery at Aon.

  1. Current

    Toronto, Canada

    Technical Program Manager

    Aon

    Standing up the Pathwise rollout in North America and managing the migration from a legacy actuarial product.

    • Partnering with the regional director to stand up the Pathwise product rollout in North America: building delivery governance, resourcing, and reporting processes from scratch; the NA operating model is designed as the template for other regions.
    • Manage the Pathwise migration from a legacy actuarial product for large insurance clients end to end: SOWs, resourcing, timeline management, execution, and delivery, including licensing agreements and client invoicing.
    • Lead the internal portfolio for North America and India; report hours, billing, and trends to leadership through Power BI dashboards.

  2. Toronto, Canada

    Consultant

    Deloitte Consulting Canada LLP

    OCI and AWS cloud migration, security architecture and pre-sales for large enterprise clients.

    • Helped establish Deloitte Canada's OCI practice: led workshops, created training material, and built reusable implementation documentation for practitioners.
    • Led workshops for a $150K security discovery project: ran a 45-question assessment across IAM, application, network, and compute security, gathered requirements from client stakeholders, and presented the discovery designs. The project won the bid for the $2M cloud migration program.
    • Supported pre-sales on 3 Oracle cloud-migration RFPs/RFQs: wrote the technical scope sections (RBAC, policy design, effort estimates), ran Q&A-based discovery sessions in first client meetings, and walked clients through proposed implementation designs. Aligned solutions with Oracle product and account teams before presenting architectures to clients, contributing to 2 wins including the $2M program.
    • Designed the target security architecture for the $2M program alongside core engineers: IAM design, landing zone security components, policy hardening, and SOD definitions.
    • Led a 6-member team of DBAs and infra engineers migrating 13 critical financial applications (including Oracle EBS SaaS) from on-premises to OCI through SIT, UAT, and production cutover; cleared approval bottlenecks directly with client executives.
    • Led the licensing assessment for a $3M AWS migration program for a large postal services client (engagement already awarded): reviewed on-premises licenses and ~150 CMDB assets for AWS portability and cost impact; led design reviews; built a before-and-after cost model that informed migration sequencing.
    • Conducted people, process, and technology assessments for a banking client's low-adoption application: led stakeholder interviews, evaluated governance gaps, application design, and technical backend alongside the team, and presented recommendations to improve customer reach.
    • Led Deloitte's annual MBA Distinction Program: school visits, three sessions, networking events, and case competitions to hire MBA candidates.

  3. Toronto, Canada

    Summer Intern

    Deloitte Consulting Canada LLP

    Cloud strategy and maturity assessment for an insurance client.

    • Supported the team on a cloud strategy and maturity assessment for an insurance client: led 1 of 8 stakeholder workshops, gathered requirements, and helped design the cloud governance structure. Presented findings with the team to client leadership, contributing to a $300K Phase 1 engagement.

  4. Hyderabad, India

    Senior Consultant

    Deloitte Advisory

    OCI IAM design, SAML federation with Entra ID, control hardening and Oracle ERP SaaS access control.

    • Designed least-privilege OCI IAM policies: defined user groups and their required access (DBAs, network teams); based role design on segregation-of-duties analysis; wrote user stories for the build; led security-controls testing alongside functional and security testers.
    • Built SAML-based federated identity bridges between Microsoft Entra ID (Active Directory) and OCI via identity metadata exchange, handling user authentication, user flows, and user-to-group mapping.
    • Hardened OCI security controls: assessed existing measures for MFA on privileged accounts, break-glass accounts, and service account management, then redefined and tightened each control in OCI.
    • Ran integration security assessments across client projects: mapped all OCI integrations and data flows, classified data by sensitivity (public, private, highly confidential including PII/PCI), recommended controls per integration, and supported implementation.
    • Designed and implemented role-based access control for Oracle ERP SaaS (FSCM financial roles); ran the SOD assessment.

Education

  • MBA

    Schulich School of Business, York University, Toronto, ON

    Sep 2021 – Apr 2023

  • BEng, Electronics and Communication Engineering

    UIET, Panjab University, India

    Aug 2013 – May 2017

Certifications

  • Oracle Cloud Infrastructure (OCI) ×8
  • Microsoft Azure Fundamentals
  • Certified LLM Security Professional (CLLMSP)

Selected engagements

Pre-sales and technical advisory work, with the outcome each one produced.

  1. $2M

    Migration program won

    Security discovery that won a cloud migration program

    Led workshops for a $150K security discovery project: a 45-question assessment across IAM, application, network, and compute security, plus requirements gathering and design walkthroughs with client stakeholders. The project won the bid for the $2M cloud migration program, where I then designed the target security architecture.

    Discovery project
    $150KDiscovery project
    Assessment questions
    45Assessment questions
    • IAM
    • Landing zone
    • Policy hardening
    • SOD
    • OCI
  2. 13

    Critical apps migrated

    Financial applications to OCI

    Led a 6-member team of DBAs and infra engineers migrating 13 critical financial applications, including Oracle EBS SaaS, from on-premises to OCI through SIT, UAT, and production cutover. Cleared approval bottlenecks directly with client executives.

    Team members led
    6Team members led
    • OCI
    • Oracle EBS SaaS
    • SIT/UAT
    • Cutover
  3. $3M

    AWS migration program

    AWS licensing assessment

    Led the licensing assessment for a large postal services client: reviewed on-premises licenses and ~150 CMDB assets for AWS portability and cost impact, led design reviews, and built a before-and-after cost model that informed migration sequencing.

    CMDB assets reviewed
    ~150CMDB assets reviewed
    • AWS
    • Licensing
    • CMDB
    • Cost model
  4. 3

    Oracle RFPs/RFQs supported

    Oracle cloud-migration pre-sales

    Wrote the technical scope sections (RBAC, policy design, effort estimates), ran Q&A-based discovery in first client meetings, and walked clients through proposed implementation designs. Aligned solutions with Oracle product and account teams, contributing to 2 wins including the $2M program.

    Wins
    2Wins
    • RBAC
    • Policy design
    • Estimation
    • Client workshops
  5. $300K

    Phase 1 engagement

    Insurance cloud strategy & maturity assessment

    Led 1 of 8 stakeholder workshops, gathered requirements, and helped design the cloud governance structure. Presented findings with the team to client leadership, contributing to a $300K Phase 1 engagement.

    • Cloud strategy
    • Maturity assessment
    • Governance

Projects

AI security and agentic systems, built and tested hands-on.

  1. AI security

    PhishSquad

    Multi-agent phishing detection on n8n: fine-tuned Llama 3.2 3B classifier plus a Claude judge.

    A multi-agent phishing-detection system built on n8n. A fine-tuned Llama 3.2 3B binary classifier (QLoRA) screens each email, a Claude judge makes the final classification, and Supabase sender grounding adds context. Deployed locally via Ollama.

    • 39/40 correct alerts on a 40-email evaluation set (100% recall)
    • Blocked 5/5 prompt-injection attacks in the test set
    • Mitigations mapped to the OWASP LLM Top 10
    View sourcefor PhishSquad on GitHub (opens in a new tab)Watch demoof PhishSquad on YouTube (opens in a new tab)
    • Llama 3.2 3B
    • QLoRA
    • Ollama
    • Claude API
    • n8n
    • Supabase
  2. Agentic AI

    AI PM Assistant

    Drafts RAID logs, risk alerts and status updates from meeting notes.

    An agentic AI system on the Claude API and n8n that drafts RAID logs, risk alerts, and status updates from meeting notes.

    View sourcefor AI PM Assistant on GitHub (opens in a new tab)
    • Claude API
    • n8n
    • Agentic AI

Capabilities

Identity & Access

  • RBAC
  • SOD analysis
  • Least-privilege policy design
  • SAML
  • OAuth 2.0
  • Microsoft Entra ID / Active Directory
  • Identity federation
  • MFA

Security

  • Security assessments
  • Zero-trust architecture
  • OCI security controls
  • Application security
  • PII/PCI data classification

Cloud Platforms

  • Oracle Cloud Infrastructure (OCI)
  • Azure
  • AWS
  • GCP
  • Oracle EBS / Fusion / JD Edwards

AI Security

  • LLM security
  • Prompt-injection defense
  • QLoRA fine-tuning
  • Ollama
  • n8n
  • Claude API

Get in touch

Open to conversations about technical program management, cybersecurity, and cloud/AI delivery roles.

View resume(PDF, opens in a new tab)

ROLE: Technical Program Manager, Aon

FOCUS: IAM · cloud security · LLM security

EXPERIENCE: 7+ years, Big Four consulting

CERTS: OCI ×8, Azure Fundamentals, CLLMSP