Ali DALHOUSS

Application security • Built and implemented the enterprise application security program, delivering 86 NIST-aligned security objectives in one year and setting clear security requirements for software development. • Integrated automated scanning tools (SAST & SCA) into development pipelines, cutting false positive alerts by 30% and reducing vulnerability remediation times from 118 down to 55 days. • Created a community of 36 Security Champions across development teams, managed security tests that cut high and critical vulnerabilities from 113 to 35, and provided monthly security reports to IT Exco. AI Security: • Led the secure adoption of artificial intelligence across the company as the primary AI security expert. • Created a clear risk assessment framework and checklist to review and approve enterprise AI use cases. • Set strict security standards and a review process to protect company data when using large language models, successfully assessing tools like Microsoft Copilot Studio and advanced Claude models before adoption. M&A Security integration: • Led the application security integration during the acquisition of a French asset manager, reviewing their systems and creating a plan to meet group security standards. • Merged security testing processes and renegotiated vendor contracts to lower overall costs. • Built an automated risk model to evaluate 130 acquired applications, replacing a two-day manual review with an instant calculation that allowed leadership to grant network access quickly and safely.

Third Party Risk Management: • Evaluated risks for external vendors and partners using the Group’s Third Party Risk framework. • Reviewed SOC 2 Type II reports to identify control gaps, checked technical security measures, and worked with IT, Legal, and Compliance to add security requirements into contracts. • Provided clear vendor risk evaluation reports with overall maturity scores to help the business make safe purchasing decisions. Integration of Security into Projects: • Contributed to the integration of security into IT projects from the early planning stages (security by design). • Conducted specific IT risk analyses for each project to identify and mitigate potential vulnerabilities early. • Reviewed and approved technical architectures during IT validation committees to ensure all systems met company security standards before going live. Cloud Security Lead: • Led the secure migration of more than 200 applications to the private cloud. • Created practical cloud security guidelines covering secret management, network segmentation, and logging, alongside a clear checklist for cloud readiness. • Automated the security review process using Power Automate, completing over 480 network flow approvals quickly and without bottlenecks.

Group Cybersecurity Program: Deployed and steered the cybersecurity program, aimed at enhancing security across 39 domains and aligning practices with the Group’s strategic requirements. • Monitored and managed the program within the RISK department. • Implemented requirements for specific domains and produced associated deliverables. • Defined Key Performance Indicators (KPIs). Cybersecurity Program Mutualization with RISK Global Markets (UK): Synergized efforts on 5 domains of the cybersecurity program. • Assessed domains eligible for mutualization. • Developed and tracked the mutualization plan on a bi-weekly basis. • Drafted and published procedures related to these domains. Cybersecurity Awareness: Launched the RISK Cyberculture program to elevate cybersecurity awareness among department employees. • Significantly improved the level of cyberculture maturity from 1.4 (Risk Informed) to 3.0 (Repeatable) on the NIST framework scale. • Developed and implemented annual awareness plans for the RISK department. • Planned and organized the first in-person cyberculture event for RISK during European Cybersecurity Month. • Prepared, configured and launched Phishing campaigns within RISK. • Evaluated the success of annual awareness campaigns based on predefined KPIs

• IAM (Identity & Access Management): Deployed the Group IAM solution for the Compliance department (600 users) and on-boarded department-specific IT asset access rights management processes into the IAM solution. • SFS (Secure File Sharing): Deployed a secure file sharing solution for confidential and secret data exchanges with regulators and Compliance department partners. • CertEurope (Oodrive): Deployed a strong authentication and certificate-based signature solution (RGS**) for Tracfin declarations. • Operations (Run): Provided cross-functional support to the CISO, including security incident response, exception management, data extraction, and IT security awareness.