Catalin Tiganila

www.cybrops.lu

• EU Regulatory Compliance (DORA, EU AI Act, NIS2, PSD2, GDPR) assessments, policies & procedures development, GRC tools deployment, etc. • Swift CSP Assessments • Digital Operations Resilience Testing (program definition, performance requirements definition, results review, remediation plans review, resilience testing, penetration testing and vulnerability assessments) • Cybersecurity training and awareness (training and awareness programs definition, training delivery, phishing campaigns) • Artificial Intelligence Governance, Risk and Compliance (AI Audit and Assurance / AI Control Framework, AI Organizational Responsibilities, AI Technology & Risks) • IS & ICT Risk Management (risk management governance and organization, ICT risk management frameworks - ISO 27005, NIST 800-30&39, threat modelling, risk identification, threat detection, risk evaluation, risk treatment plan – protection and prevention, response and recovery) • IS & ICT Incident Management (policies, procedures, plans, classification, testing and reporting) • Third Party Risk Management (framework, strategy, ICT services register, KPIs, KRIs, SLAs, assessments, due diligence, exit strategies and plans, etc.) • IS & ICT Governance (strategies, frameworks: ISO 27001/2, NIST Cybersecurity framework, COBIT, PCI-DSS, Swift CSP/CSCF) • CISO Services (vCISO, CISO support, risk assessments, security monitoring and reporting, etc.) • Cloud Security (CSA CSM, ISO 27017, ISO 27018) • ICT Assurance (IT Internal Audit co-sourcing, 3rd Line of Defence support, ITAF, ISAE 3402 - SOC 1, SOC2)

▪ Manage the Membership duties ▪ Lead AI Audit Program Working Group

Setting up a new business line – Cyber Security services, focusing on: ▪ IT and Outsourcing Regulatory Compliance (DORA, CSSF 20/750, 22/806, EBA, ENISA guidelines) ▪ IT Internal and External Audit (including ISAE 3402 / SOC1, SOC1) ▪ Cloud Security (CSA CCM, ISO 27017, ISO 27018) ▪ SWIFT Security Assessment CSP-CSCF ▪ IT Risk Assessment ▪ Artificial Intelligence (AI) Governance, Risk and Compliance (GRC) Expanding Data Protection (GDPR) services

Lead, coordinate and monitor the service delivery teams to provide the following services: ▪ Assess regulatory compliance and implement requirements of CSSF circulars (20/750, 22/806) on IT Governance and Outsourcing arrangements ▪ Perform IT and IS Risk Assessments and Business Impact Analysis ▪ Develop IT and IS Strategies ▪ Review and update Information Security policies, procedures and related documentation ▪ Review, update and test BCPs

Manage the IT Risk Management team and lead projects for the following services: ▪ Perform IT Risk Assessments based on client or Deloitte methodologies ▪ Provide advice for Cloud computing oversight processes improvement ▪ Assist organizations in obtaining CSSF Cloud Computing Authorization ▪ Develop IT and Security Policies and procedures ▪ Assist financial institutions in assessing and implementing action plans to fix deficiencies identified following regulatory inspections ▪ Assist internally the security team to prepare for ISO 27001 re-certification audit ▪ Define Data Privacy requirements and test the configuration of ILM functionalities for an SAP S/4 HANA implementation ▪ Participate in ISAE 3402 audits and coordinate IT Audits (external) ▪ Perform IT Internal Audits

In charge with the Bank’s Information Security Governance and Risk Management. Align IS Strategy with business strategy and Group IS Strategy, Compliance with local and international standards, rules and laws, business case development, ensure Top Management support, perform risk assessments and business impact analysis, provide enterprise risk management support for other departments (e.g. Fraud Prevention, Operational Risk Management, etc).

Responsible for managing and delivering audit and consulting services in Balkan region and also in Middle East region for specific Revenue Assurance projects. Manage projects and teams, develop business and new services, train and develop the team, research standards, methodologies and new approaches, identify suitable services for each client.

In charge with leading audit and advisory teams in providing a large range of consulting services. Project and people management, ensure quality of services and deliverables, manage team performance, identify potential services and clients, provide training and coaching, knowledge and research management.

Responsible for coordinating the Software Development and Implementation Team. Software Implementation, Development and Maintenance - covering the entire lifecycle of software development from business requirements definition to testing, installation, user training and software maintenance, as well as research management and business development.