Damien HOTZ

• Team Leader MCO/MCS - CAC40 o Management of the MCO/MCS team SplunkCloud, o Prepare for SplunkCloud migration, o Create a compliance baseline for the SOC. o Technical environment: Splunk Cloud, Azure, CrowdStrike • System compliance mission - Confidential o Define security measures to comply with French border requirements, o Technical environment: Azure, Intune • Mission to build SOC and general security - +1Bn€ o SOC architecture, o Security system deployment, o Define rules and security for hybrid structure on-premise and cloud structure, o Hardening, o Technical environment: Splunk Cloud, SentinelOne, ATP, InTune, Azure, Redhat, Windows, Cortex, PaloAlto, Fortigate. • Mission for Splunk compliance - +9Bn€ o Splunk CIM compliance. o Technical environment: Splunk Cloud, Azure, CrowdStrike • Mission for insurance broker - +250Million€ o Security project review o Network and NAC redesign o Editing of technical documentation o Technical environment: Azure, Microsoft Cloud/On-Premise, EDR Harfang, Elastic SIEM, Fortigate, Rapid7 • Mission for International Logistics and Transport - +2Bn€ o Network review worldwide physical location o Define NAC system - ZeroTrust o Security appliance Hardening o SDWAN o Centralised firewall management o Technical environment: Elastic SIEM, Fortigate, Azure, Sophos EDR, CrowdStrike • Mission for France insurance broker +1Bn€ o Network review worldwide physical location o Audit Firewall o Risk analysis – EBIOS RM o Technical environment: Azure, Fortigate, Checkpoint • Mission for Confidential - +15Bn€ o Working for NIS approval o Check security documentation for exploitation o Verification of subcontract execution and compliance • Mission for ISP o Cyber Crisis exercice – 2024 and 2025 o Build and Design the attack and the system

o Definition of a complex SOC architecture, o Definition of features and costs, o Build Tactical SOC, o Content design and production for Airbus Cybersecurity’s CyberRange, o Content design and production of complex scenario, o Content design of national crisis, o Content design and production of customers support, o Build Online cloud sandbox, o Define IT and OT attack scenario, o Creation of a live, realistic environment for the RedTeam/BlueTeam crisis exercise, o Honeypot design, o Security test for supervisory testing, o VMwareVSAN deployment.

In the SOC INTRINSEC and of the CERT-INTRINSEC - > Participation in: - Surveillance of the scopes customers through the security solutions of the SOC - Maintaining in operational condition of tools - Analyses of the vulnerabilities - Analyses and treatments of security events - Reaction to failure (intrusions,...) - Investigations / Forensic - Watch over security (threats, vulnerabilities, IOC) - Training security operatives - Communication and support - > participation in the development of the offer (R*D, improvement) and in communication actions (articles, conferences)