Karandeep Singh

Karandeep (“KD”) Singh is a senior cybersecurity and technology risk professional with nearly 20 years of experience spanning banking, financial services and consulting. Mr. Singh brings a proven track record of shaping enterprise cybersecurity strategy, elevating risk maturity and aligning security programs with core business objectives. He is recognised for his ability to engage effectively with executive leadership, boards and regulators to drive risk-informed decision-making and build organisational resilience. His expertise includes technology risk, cyber and AI governance, risk quantification, regulatory compliance and security transformation across the financial services and nonfinancial services sectors.

Prior to joining FTI Consulting, Mr. Singh served as a Director in the Cybersecurity & Risk Technology practice at KPMG. In this role, he was the national lead for KPMG’s cyber risk quantification capability and led client engagements focused on cybersecurity governance, technology risk and regulatory alignment.

Mr. Singh has delivered multiyear cyber strategy, controls transformation and resilience programs for major institutions, including the Commonwealth Bank of Australia, the Bank of Queensland, Medibank and Westpac. His engagement work includes enterprise-wide cyber maturity assessments aligned to NIST CSF, ISO 27001 and the Essential Eight, as well as regulatory compliance reviews conducted under APRA CPS 234 and ASAE 3150 for superannuation and insurance clients.

Before KPMG, Mr. Singh held a series of progressively senior roles at National Australia Bank. As a Data Governance Leader, he led enterprise-wide data stewardship initiatives and the prioritisation of critical data elements, embedding data and information standards aligned to ISO 27001/2, CPS 234 and CPG 235. He also championed risk-based approaches to data quality, lineage, privacy and records management. As Associate Director of Operational Risk, Mr. Singh oversaw group-wide information security and data quality policy frameworks, ensuring compliance with APRA CPS 234, CPG 235, ISO 27001 and NIST. He managed operational risk policies covering event and issue management, risk in change and the broader operational risk framework, and supported operational risk scenario development and capital modeling related to cyber threats.