Antoine Grenouilloux

As a Senior Consultant, I was the tech lead of the Data Security & Privacy team for classification, DLP topics and cryptography topics. Notable engagements I performed during this period include: - Leading a compliance gap assessment to new crypto regulation (PSAN) with a team of 4. - Defining the data protection chapter of an automotive industry client's internal audit framework. - Conducting a data protection program for a Swiss luxury watchmaker, coordinating a team of 2-3 colleagues from Deloitte, to deliver their a data protection stategy and governance model, data management policies and procedures, as well as a solution deployment planning and execution. - Replaying a cookies audit performed by the CNIL for a leading global payment firm. As for internal activities, I answered numerous RFPs and defended them before the prospects. I also handled the recruitment of tech profiles for both consultant and management levels, and tutored several interns of the team.

As a team member of the Information Protection & Privacy team, I performed a variety of engagements, notably : - Being Mr. Data Loss Prevention during a 3 years, half-FTE engagement for the Data Leakage program of a French bank. I defined the governance model for DLP activities, collected business and security needs to translate functional requirements into technical specifications, and configured the solution to improve rules performance and reduce false positives. I also planned and executed a version migration, including IT change planning, migration procedure documentation, night-time execution with IT operations, agent deployment and post-deployment troubleshooting with the solution vendor. The use-cases for DLP notably included personal data protection, PCI-DSS compliance and NAS/SharePoint data purge projects. With this client, I also worked on SharePoint, classification, websites inventory, Crown Jewels data risk, compliance demonstration and crisis simulation. - Migrating the financial reporting system of a global automotive parts supplier, in a Sarbanes-Oxley and SOC 2 - Type II environment. - Assessing the SecNumCloud gap assessment for a world-class US Cloud service provider. - Helping with emergency security measures during the aftermath of a pharma client, after a large data breach, under the scrutiny of the CNIL and the ANSSI. - Auditing several industrial and retail clients and third parties for GDPR, and perfoming DPIAs. Internally, I also: - Won an innovation contest that led to a project revolving around OSINT techniques. - Prepared Deloitte's (successful) PASSI certification. - Participated in answering several RFPs. - Monitored the IA and the encryption technologies landscape (research and market): IA vulnerability and bias exposition, homomorphic encryption, European Cloud security regulations.

During this year as a Junior at Deloitte France - Cyber Risk, I notably worked on : -A 1 year Privacy compliance program with a world-class agri-food industrial. It included performing an OSINT inventory of exposed assets, and remediating the previously-inefficient processes and data structures to improve IT inventory quality while reducing the workload of 27 countries, which was greatly appreciated by C-suite stakeholders. - Performing several 1-3 months long GDPR audits and assistance, for a construction developer and a media clients.

I joined Deloitte Cyber for my final engineering internship. During this internship, I produced a prospective study on the use of blockchain technolgy in identity and access management; with business cases, a technologies benchmark, and a comparison of the benefits (and drawbacks) of a blockchain. I was also onboarded on two client engagements. - A DLP implementation project for an asset manager. - A data security technologies (cryptography, anonymization, purge) training for the marketing teams of a media group.