IT Application Security Manager · Security Architecture & Payment Security

Gowri Shankar Balasubramaniam

Security by design, not by afterthought. I secure PCI DSS Level 1 payment platforms by building security into the architecture from the start. 16+ years across software engineering, infrastructure and security.

Gowri Shankar Balasubramaniam - Cybersecurity & Application Security

About me

I am a security architect and IT Application Security Manager with more than 16 years of experience across software engineering, infrastructure, and cybersecurity, focused on mission-critical payment systems.

I began my career as a software developer in Chennai in 2010 and progressed through software architecture and infrastructure into information security. Today, I serve as IT Application Security Manager at Novalnet AG in Munich, where I am responsible for the security of a large-scale payment platform.

Because I have built and operated these systems myself, I understand the real constraints that development and operations teams face. This allows me to work with them on security requirements that are practical to implement and sustainable to maintain, rather than controls that exist only on paper.

My work spans the full security lifecycle: embedding security into the SDLC, threat modelling, security architecture reviews, secure coding standards, vulnerability management, and risk-based control design. Since 2018, I have held accountability for PCI DSS Level 1 compliance across the payment ecosystem and for SOC 2 Type II certification.

Alongside application security, I design secure, highly available infrastructure, covering network segmentation, load balancing and reverse proxy architecture, Linux platform hardening, disaster recovery, and business continuity, for environments where downtime directly affects customers and revenue.

Core areas of expertise:
Enterprise Security Architecture · Application Security & Secure SDLC · Payment Security & PCI DSS · SOC 2 Compliance · Threat Modelling & Risk Assessment · Secure Network & Infrastructure Design · High Availability & Disaster Recovery · Cloud Security · DevSecOps & Security Automation · Security Governance

I value mentoring engineers and building strong working relationships between development, operations, and compliance teams, because I believe lasting security comes from shared ownership.

I am open to senior leadership opportunities in security architecture and cybersecurity, including Enterprise Security Architect, Head of Security, and CISO roles.

Latest from the blog

All articles

FinTech & Payments

Novalnet Releases Payment Plugin Version 13.6.3 for Shopware 6: Enhanced Invoicing and Expanded Payment Capabilities

Novalnet has released payment plugin version 13.6.3 for Shopware 6.7.0.0–6.7.5.1, introducing enhanced ZUGFeRD invoice generation with transaction details, updated iDEAL | Wero branding, and the removal of Payconiq. The latest release continues to support more than 25 international and regional payment methods, alongside comprehensive transaction management, automated payment processing, and refund capabilities for Shopware merchants.

6 min read

FinTech & Payments

Bulgaria Euro Adoption 2026: What you should to know

Bulgaria adopted the euro on 1 January 2026 at a fixed rate of 1.95583 leva per euro, and the euro has been its only legal tender since 1 February 2026. This guide explains the key dates, how to exchange leftover leva, and what the changeover means for businesses, payments and PSPs.

11 min read

Vulnerability Analysis

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 - Critical Unauthenticated RCE in PHP

PHP2Shell is a pair of critical vulnerabilities in the PHP runtime, rated CVSS v4.0 9.2, that let unauthenticated attackers execute code on web servers. Apache mod_php can be exploited before any application code runs. This advisory covers affected versions, how each attack chain works, patching, interim php.ini mitigations, detection and compliance impact.

11 min read Updated

Experience

Novalnet AG, Munich · June 2010 to today

  1. Aug 2021 to present

    IT Application Security Manager

    • Lead application security for the payment platform: secure SDLC, security architecture reviews, threat modelling and vulnerability management.
    • Prioritise security risks by business impact and drive remediation with development and infrastructure teams through to closure.
    • Solely responsible for PCI DSS v4.0.1 Level 1 compliance across the whole payment ecosystem and SOC 2 Type II certification since 2018.
    • Established OWASP-aligned secure coding standards and a continuous code review process with development teams.
    • Apply Zero Trust principles and infrastructure-as-code hardening across the platform.
    • Built automated systems that run our threat modelling process. We have seen fewer security issues since.
    • Architected the high-availability payment infrastructure and messaging platform across multiple data centres.
  2. Jul 2017 to Jul 2021

    IT Security Architect

    • Designed secure application architectures and the enterprise network for a large-scale payment platform.
    • Took over PCI DSS Level 1 compliance for the whole ecosystem in 2018.
    • Designed and built an automated IVR payment solution and integrated it end to end into our payment ecosystem.
    • Designed and built the backend and technical architecture of a client-facing SoftPOS product, from first design to integration.
    • Ran architecture reviews and threat modelling, and looked after infrastructure security and Linux administration.
  3. Jan 2017 to Jun 2017

    Application Manager

    • Managed server and application platform operations across the payment ecosystem in line with OWASP guidance.
  4. Feb 2014 to Dec 2016

    Software Architect

    • Designed web application architecture and payment gateway integrations, developed new payment products, supported customers and coordinated projects.
  5. Jun 2010 to Jan 2014

    Software Developer, Novalnet e-Solutions, Chennai

    • Built web applications and payment processing features.
    • Set up and led the security, testing and quality assurance functions for an organization of more than 150 people, including recruitment, technical training and processes.

Skills

Security architecture

  • Enterprise security architecture
  • Zero Trust
  • Threat modelling
  • Risk assessment
  • Secure network design
  • Infrastructure security

Secure SDLC and DevSecOps

  • Secure coding
  • Code review
  • Architecture reviews
  • Security automation
  • OWASP Top 10
  • ASVS
  • API Security
  • SAMM

Compliance and governance

  • PCI DSS Level 1
  • SOC 2 Type II
  • GDPR
  • Vulnerability management
  • Security governance

Platform and availability

  • High availability
  • Load balancing
  • Multi-data-center design
  • Reverse proxy
  • Disaster recovery
  • Business continuity
  • Linux

Payments

  • Payment gateways
  • Online payment processing
  • Payment security

Tools and technologies

  • OWASP
  • Wazuh
  • Sophos XDR
  • ClamAV
  • OpenSearch
  • Checkmk
  • Uptime Kuma
  • Prometheus
  • Grafana
  • Filebeat
  • Linux
  • Ubuntu
  • openSUSE
  • Docker
  • Kubernetes
  • Nginx
  • OpenLiteSpeed
  • ProxySQL
  • Sophos Firewall
  • Cisco Firewall
  • MySQL
  • MariaDB
  • PostgreSQL
  • MongoDB
  • SQLite
  • Node.js
  • React
  • Next.js
  • Golang
  • PHP
  • Python
  • Typesense
  • Ollama
  • Open WebUI
  • Onyx AI
  • Mattermost
  • Microsoft Visio
  • Microsoft 365
  • Power Automate
  • Active Directory
  • Git
  • Zimbra
  • Stalwart Mail Server
  • Samba

Certifications and recognition

  • CWASPCertified Web Application Security Professional
  • CPISI 2.0Certified Payment Card Industry Security Implementer
  • CSOCPCertified Security Operations Center Practitioner

Awards

  • First Prize, ELCOT & NASSCOM Software Development Competition, an India-wide competition run by the Government of Tamil Nadu

Writing

  • Iframe Integrity: Empowering PSPs to Secure Payment Iframes Against Skimming Attacks with Zero Hassle

Education

  • B.E., Engineering and Technology, PSNA College of Engineering and Technology (2007 to 2010)
  • Diploma in Information Technology, Nachimuthu Polytechnic College (2004 to 2007)

Contact

If you have a security question you would like to talk about, write to me. I read every message.

Email
info@gowrishankar.me
LinkedIn
linkedin.com/in/gowri-shankar-ags/
Location
Munich, Germany