Ahmed Chiboub

– Secured RAG pipelines, internal chatbots, and AI agents using ANSSI generative AI referential, OWASP LLM Top 10, and MITRE ATLAS as core frameworks – Hardened RAG architectures against document poisoning, knowledge base exfiltration, and retrieval manipulation (MITRE ATLAS: AML.T0020, OWASP LLM03/LLM06) – Implemented prompt validation, I/O filtering, and API gateways for LLM-based chatbots serving internal business users – Enforced action boundaries and least-privilege controls on AI agents to prevent unauthorized SI operations – Conducted EBIOS-RM risk analyses covering agentic attack surfaces, data sensitivity, and third-party integration risks – Applied environment segmentation and privileged access controls across training, staging, and production AI infrastructure – Designed and supervised the implementation of security solutions and controls in alignment with BNP standards and cybersecurity best practices. – Integrated security into the project lifecycle, ensuring compliance with security procedures. – Ensured adherence to information security policies and standards across projects. – Reviewed technical designs of new projects, identified vulnerabilities, and proposed remediation plans and security controls. – Assessed branch-provided evidence for NIST compliance, supporting regulatory and standards adherence. – Conducted risk assessments for new projects, identifying and mitigating IT risks. – Trained security teams in secure software development lifecycle (SSDLC), DevSecOps, IT risk assessment, and third-party risk management. – Participated in the RFP and RFI processes for replacing the core banking system, developing supplier evaluation matrices. – Evaluated suppliers' technical and security proposals and facilitated security workshops to ensure all security requirements were met

– Documented, maintained, and updated information security policies and procedures. – Managed the PASSI qualification project. – Designed and supervised the implementation of a restricted information system to protect sensitive data. – Developed and maintained the cybersecurity dashboard to monitor key security metrics. – Organized and led a cybersecurity awareness campaign to promote best practices across the organization. – Planned and supervised the execution of the auditing program, ensuring ongoing compliance and security. – Designed a cyber watch tool. – Established and supervised the implementation of a Security Operations Center (SOC) for BrightCERT. – Monitored the security of information systems and managed incident responses as BrightCERT manager. – Conducted PASSI audit missions both as lead and auditor

– Designed and supervised the implementation of security solutions and controls in alignment with Generali standards and cybersecurity best practices. – Reviewed technical designs of new projects, identified vulnerabilities, and proposed remediation plans and security controls. – Conducted risk assessment for news projects, – Validated the security requirement for electronic signature projects – Supervised the security of all automation project and ensured the hardening of the Orchestrator, – Supervised external penetration testing and provided technical support of applications owners. – Participated in the RFP and RFI processes for replacing the core banking system, developing supplier evaluation matrices.

– Audited clients' ISMS to ensure compliance with ISO 27001 standards. – Conducted gap analyses in accordance with ISO 27002. – Audited security solutions and appliance configurations for optimal performance and security. – Performed comprehensive information security risk analyses. – Conducted vulnerability discovery and assessment to identify and mitigate security risks. – Developed and supervised the execution of mitigation action plans. – Evaluated current infrastructure for both performance and security enhancements. – Audited and reviewed information security policies to ensure compliance with best practices. – Performed penetration testing to assess system vulnerabilities

– Regularly conducted penetration tests on ISAD's information systems to identify and address vulnerabilities. – Performed onsite penetration tests simulating insider threats to assess internal security risks. – Conducted web application security assessments for the Ministry of Defense (M.O.D) websites and internal applications after major changes (new services, platform migrations, version updates), delivering comprehensive risk assessment reports. – Developed advanced security tools, including Android and Windows rootkits, document Trojans, shellcodes, cellphone trackers, and a waterholing system. – Led social engineering campaigns (phishing, smishing, whaling) to test organizational security awareness and resilience.

– This information is protected by an NDA (Inter-army Cooperation) – Proof of work available upon request

– Integrated and configured security appliances and software, including firewalls, intrusion detection systems, and Kaspersky Security Center. – Planned and implemented system backups, ensuring reliable recovery processes. – Developed utility programs and shell scripts for tasks such as backups and integrity checks. – Configured routing protocols on Cisco routers and switches, managing access to services and networks. – Monitored network performance and server availability to ensure optimal operation. – Installed security updates and patches to maintain system security and compliance.