Elena Botana de Castro

• AI Risk Assessment: Comprehensive risk assessments for AI/ML models, identifying vulnerabilities across data pipelines, model logic and deployment environments. • Threat Modeling & Mitigation: Tailored threat models for adversarial attacks, model inversion and data poisoning, with robust countermeasures. • AI Governance & Compliance: AI-specific governance frameworks aligned with ISO/IEC 27005 and NIST SP 800-37; compliance with GDPR, DORA and MiCA. • Monitoring & Incident Response: Continuous risk monitoring using threat intelligence and rapid-response protocols for AI components.

• Blockchain Security Leadership: Leading cybersecurity strategy for crypto startups focused on exchanges, non-custodial wallets and DeFi platforms. • Smart Contract Development & Audits: Developing and deploying smart contracts (Solidity, Rust) and conducting in-depth audits to mitigate risks such as re-entrancy, logic flaws and gas-optimization issues. • Security Protocols & Risk Assessment: Robust security protocols for blockchain transactions; assessment of attack vectors and network analysis to detect fraud and unauthorized access. • Incident Response & Compliance: Leading incident response with containment and remediation; security leadership around tokenization and regulatory frameworks.

• Security Strategy & Posture: Owned and continuously improved the overall security posture of software-driven, payment-handling platforms (crypto exchanges, wallets, digital payments), defining and evolving the information security strategy in alignment with business objectives and the evolving threat landscape. • Secure-by-Design & SDLC: Partnered closely with Engineering to integrate security into the software development lifecycle and platform operations, promoting secure-by-design principles and establishing pragmatic, risk-based standards and guardrails that let teams ship secure solutions effectively. • Audit Readiness — PCI-DSS & SOC 2: Prepared organizations for regulatory and audit requirements (PCI-DSS, SOC 2, ISO 27001, DORA, NIS2, MiCA), translating compliance expectations into practical, scalable controls. • Risk Transparency & KPIs: Made the security risk landscape transparent through clearly defined, measurable KPIs; risk identification, quantification and treatment planning using structured registers and threat-driven models, with end-to-end vulnerability management and risk-based prioritization. • Detection & Response: Strengthened detection and response by promoting logging, monitoring and alerting across applications and infrastructure; oversight of SOC operations and major-incident command during high-severity events. • Security Tooling & Architecture: Evaluated and implemented security technologies aligned with architecture and engineering workflows, contributing to build-versus-buy decisions for scalable, maintainable solutions; confident discussing architecture, APIs and IAM with engineering teams. • Trusted Advisor & Team Leadership: Acted as a trusted advisor to stakeholders and represented security in interactions with customers, partners and auditors; led and developed small security teams, fostering a culture of shared responsibility.

• Risk & Vulnerability Assessment: Structured security risk and vulnerability assessments of applications, servers, databases and middleware (e.g. Apache Tomcat, PostgreSQL), with prioritized, risk-based remediation. • Security Audit Management: Internal and external audits — ISO 27001, GDPR, ENS, NIST and SOC2. • Architecture Designs: Azure Architect solutions focused on scalability and security; Azure Security Center; secure Kubernetes deployments; IAM and data protection. • Pentesting & Ethical Hacking: Internal/external penetration tests of web, infrastructure, WiFi and mobile apps; industrial cybersecurity testing on PLCs and HMIs. • SOC & CSIRT: Administering SIEM tools (Q-Radar, Splunk, RSA), building use cases and correlation rules, leading Security Analysts. • Secure Development & Bug Bounty: Embedding security into the SDLC; OWASP AppSec Dublin 2020 review committee; bug bounty programs on HackerOne.