Anis HANICHE

Completed a full TISAX gap analysis and AL3 readiness assessment based on VDA ISA v6.0.3. Outcomes delivered: ➢ Completed the full VDA ISA v6.0.3 assessment with detailed scoring and control-level comments/evidence ➢ Assessed information security maturity (organizational & technical) against AL3 expectations ➢ Identified and prioritized compliance/maturity gaps, including quick wins and high-impact remediation items ➢ Produced a detailed, phased remediation roadmap with validation waves and gate reviews at each level ➢ Defined a detailed action plan with prioritization, sequencing, and follow-up structure ➢ Provided a high-level global effort estimate (man-days) and proposed resourcing model (FTE/ETP) aligned with the roadmap ➢ Delivered an Executive Summary for top management plus a detailed gap analysis report and roadmap/action plan package

➢ Delivering a secure, cloud-native Minimum Viable Product (MVP) aligned with long-term scalability goals. ➢ Defining and executing the overall technical vision and architectural strategy. ➢ Embedding security and compliance into every layer of the technology stack (Security & Privacy by Design). ➢ Leading the full product architecture design from scratch. ➢ Coordinating distributed development teams and managing external technical partners. ➢ Establishing cybersecurity policies and secure development practices from day one. ➢ Aligning the product and technical roadmap with evolving business and go-to-market objectives. ➢ Ensuring readiness for international compliance standards (ISO27001, etc.). ➢ Providing strategic and operational guidance to support the company’s transition from concept to market readiness.

Outcome: ISO/IEC 27001 certified (2022 edition). Led end-to-end implementation of an ISO/IEC 27001:2022-compliant ISMS for a SaaS company, from scoping to internal audit & management review, enabling successful certification. Key impact ➢ Delivered an audit-ready ISMS and supported the organization through certification preparation; client achieved ISO/IEC 27001 certification (post-engagement). ➢ Defined ISMS scope & governance: created scope, ISMS policy, Statement of Applicability (SoA), roles/RACI across CEO/CTO and teams. ➢ Performed EBIOS RM risk assessment: identified critical assets, threats, business impacts; built risk treatment plan and tracked residual risks. ➢ Authored and implemented 70+ ISMS documents (policies, procedures, registers, charters) aligned with ISO 27001:2022 controls and evidence requirements. ➢ Established supplier & compliance governance: vendor criticality assessment, NDA/SLA tracking, legal/contractual registers, GDPR mapping. ➢ Designed incident & vulnerability management: IR process, vulnerability scanning workflow, incident/vulnerability registers and reporting. ➢ Built BCP/DRP (PCA/PRA): defined RTO/RPO, backup strategy, crisis communications and test approach. ➢ Delivered security awareness program: campaigns, training tracking, KPIs and dashboards. ➢ Conducted internal audit & facilitated management review: findings, corrective actions, continuous improvement roadmap.

Outcome: Achieved PCI DSS v4.0.1 compliance milestone (audit/certification readiness → successful external assessment outcome) and launched DORA-aligned security governance. Owned regulatory compliance delivery and security governance across technical and business teams, bridging controls, evidence, risk, and executive alignment. Key contributions ➢ Operationalized PCI DSS v4.0.1 requirements across cross-functional teams (security, engineering, ops, product), translating controls into actionable processes and ownership. ➢ Built/updated security governance framework (PSSI, policies, procedures), ensuring consistent control design and audit-ready evidence. ➢ Embedded GDPR by design into business processes (data protection requirements, governance, traceability), improving compliance hygiene and risk management. ➢ Aligned security program with DORA expectations (operational resilience mindset, controls, reporting), strengthening regulatory readiness. ➢ Defined and tracked cybersecurity KPIs (risk posture, compliance performance, operational resilience) to drive steering and accountability. ➢ Conducted Targeted Risk Assessments (TRA) and delivered mitigation plans to reduce exposure on high-risk initiatives and services. ➢ Automated audit & asset visibility: developed custom audit scripts and automated asset inventory tooling to reduce manual overhead and increase infrastructure coverage. ➢ Led CVE triage & prioritization, producing monthly vulnerability and IT risk reporting to accelerate remediation and support compliance obligations. ➢ Drove continuous monitoring & threat intelligence, anticipating emerging risks and improving proactive security operations. ➢ Partnered directly with CISO/CTO via weekly steering to synchronize security roadmap with business priorities; contributed to team scaling (recruitment, org design, role definition).

- TER project "Implementation of a Firewall/IDS on a Raspberry pi" which consists in : ➢ Configuring and deploring a DHCP server ➢ Setting up and deploring a DNS server ➢ Setting up a NETFILTER firewall ➢ Setting up a NIDS ➢ OS hardening