Security, Risk & Resilience

Aneel Sandhu

Strong enough for regulators, practical enough to live with.

Aneel Sandhu is a partner at Groundwork, where he leads the security, risk and resilience work. He has spent more than 10 years in information security across fintech, payments and financial regulation, including two CISO roles, and knows which questions a buyer or a regulator will press on and which controls are worth putting in place first.

Background

Aneel has spent more than 10 years in information security across fintech, payments and financial regulation, including two CISO roles. Having held the accountability rather than only advised on it changes what the advice is worth: he has been the person who had to answer the question, in front of a regulator and in front of a customer.

Much of his work has been at the point where security stops being an engineering topic and becomes a commercial and regulatory one — environment segregation across a large microservice estate, change practices that reduce self-inflicted incidents, and the operational-resilience assessments that regulated firms are held to.

That background is why the security work at Groundwork starts with what actually reduces risk and what a buyer will genuinely press on, rather than with a framework applied wholesale. Most companies at Seed to Series B need a small number of things done properly, and a clear-eyed view of which ones they can safely leave until later.

What he works on at Groundwork

Aneel leads security, risk and resilience, and the security half of enterprise readiness: the control baseline, the evidence behind it, and the answers a larger customer's security review will test.

Operator track record

Before Groundwork, our partners built, scaled and protected technology organisations from inside them. Everything below was done in those roles, not as Groundwork client work — Groundwork is new, and we would rather show you verified operating history than dress it up as something it is not.

Segregating a large microservice estate

Situation: A growing platform where environments were not cleanly separated and change was a common source of incidents.
Role: Security and technology risk leadership.
What changed: Full environment segregation implemented with Terraform and AWS Lambda, alongside change practices engineering would keep.
Measured outcome: Introduced full environment segregation across approximately 120 microservices, and reduced change-related incidents by approximately 20%.

Operational resilience under regulatory assessment

Situation: A regulated business being assessed against a UK regulator's operational-resilience framework.
Role: Workstream leadership within the assessment.
What changed: Resilience evidence, testing scope and the operational practice behind both.
Measured outcome: Led five of eight workstreams in a UK regulator's operational-resilience assessment framework, and scoped CBEST testing across retail banking, investment and lending businesses.

Cost taken out of infrastructure and tooling

Situation: Cloud infrastructure and security tooling that had grown alongside the platform without consolidated ownership.
Role: Security and technology leadership.
What changed: Consolidation and rationalisation of infrastructure and tooling, without reducing the control coverage behind it.
Measured outcome: Delivered approximately 15% annualised savings across cloud infrastructure and technology tooling.

Areas of expertise