Senior Cyber GRC · Risk & Compliance · ISMS Manager

Joined Group Cyber Security Risk Management as Deputy CISO for a major brand division, overseeing second-level cyber risk, vulnerability management, and third-party risk management at group scale.

• Conducted end-to-end risk assessments covering IT, OT (footwear manufacturing and winter sports equipment), and strategic projects, from threat appraisal to treatment plans and continuous monitoring.
• Contributed to cybersecurity budget management, handled critical supplier management, cyber crises, and incidents in Deputy CISO capacity.
• Industrialized TPRM program by executing third-party risk assessments via BitSight, refining supplier evaluation framework, and integrating process into procurement workflows.
• Operated vulnerability management on group internet-facing assets (Acunetix, DefectDojo, Snyk), prioritizing remediation by business impact.
• Strengthened Security-by-Design process by revising project risk management workflow and re-examining applicable controls.
• Produced executive KPIs and risk reporting; mentored team members.
• Technical environment: BitSight, Acunetix, DefectDojo, Snyk, ServiceNow, M365, Jira, Confluence.

Delivered 9 GRC engagements across industrial, public sector, and SaaS industries—ISO 27001/NIS2 audits, ISMS deployments, interim CISO mandates, crisis exercises, and security tool implementations. As Middle Manager, contributed to internal coordination, junior consultant mentoring, and presales support.

• Maintained ISO 27001 certification across three European countries and led initial certifications in two additional countries and a second entity within a multinational construction group (11 months).
• Functionally managed 6 security leads across countries and coordinated 3 external service providers under group governance.
• Identified and deployed NIS2 alignment measures across group perimeter.
• Revised and harmonized group-wide processes: incident management, security event handling, IT/ISS change management, vulnerability management, risk management, BCP/DRP.
• Designed security integration process for new entities and applied it to two M&A onboardings.
• Built supplier security questionnaire and integrated TPRM into procurement workflows.
• Served as interim CISO for French subsidiary (20 months), aligning local practices with global policy: gap analysis, risk register review, control enforcement, and IT/OT process uplift managing a team of 7 (3 internal, 4 external).
• Led OT cybersecurity uplift: network segmentation, asset inventory, obsolete equipment management, regional cyber relays, incident response plan.
• Drove SOX compliance work and improved group BitSight ranking.
• Deployed IAM/PAM, MFA, email security (SPF/DKIM/DMARC), logging & monitoring, and awareness campaigns.
• Conducted initial ISO 27001 certification for French business unit, then replicated model in Spain; drafted ~60 policies and procedures, executed risk assessment and treatment plan.
• Conducted multiple ISO 27001 v2022 transition/readiness audits and NIST CSF diagnostics; proposed ISMS scopes, remediation roadmaps, and executive presentations.
• Audited Active Directory security using ANSSI tool and Pingcastle.
• Designed and executed cyber crisis exercise for public sector agency on critical information system, tested BCP, incident management, and resilience; built NIS2 action plan.
• Audited cloud identity tenant, deployed mobile threat defense on device fleet, and transferred operational procedures (6 months).
• Technical environment: ISO 27001, ISO 27002, ISO 27005, ISO 22301, NIS2, DORA, GDPR, SOX, NIST CSF, CIS Controls v8, EBIOS, BitSight, Qualys, Tenable, Acunetix, DefectDojo, Snyk, Archer, AuditBoard, ServiceNow, Okta, Duo, Intune, MS Defender, Zimperium, Jira, Confluence, LeanIX, Pingcastle, ANSSI ADS tool.

Assessed cybersecurity posture of financial sector across 7 East African countries by engaging central banks, regulators, commercial banks, and microfinance institutions.

• Built 5-year strategic roadmap for regional cross-border payment system using World Bank Sectoral Cybersecurity Maturity Model (SCMM), PCI-DSS, SWIFT CSP, DORA principles, and CIS Controls.
• Facilitated steering committees and presented findings to participating central banks covering 7 countries.
• Technical environment: PCI-DSS, SWIFT CSP, DORA, CIS Controls, Sectoral Cybersecurity Maturity Model.

Designed technical and security response for hypervisor platform serving major infrastructure project tunnel and implemented end-to-end ISMS for the organization.

• Designed architecture, developed Python POC, and conducted risk analysis for hypervisor platform, including VPN/routing simulations.
• Implemented end-to-end ISMS: scope definition, EBIOS risk analysis, ~50 policies and procedures, awareness campaign, preparation for internal and certification audits.
• Assisted CISO: technology watch, security roadmap, foundational Active Directory penetration testing using Pingcastle, targeted phishing simulations, and infrastructure hardening.
• Technical environment: Python, EBIOS, ISO 27001, Pingcastle, VPN, Active Directory.