eric CALLEC

My job consists to evaluate the level of security applications regarding regulatory. . Moreover, I improve security process generally used worldwide..

RSSI support at BP2S o Implement the security policy in BP2S projects, data encryption, architecture, identification, business continuity... • TRO / RSSI assistance for Societe Generale Retail Banking o Implement the IT risk management process o Risk impact assessment, risk identification, implement it risk mitigation o Ensure the qualitative identification of the principal operational risks of the entity for Societe Generale Retail Banking (RCSA) o Perform incident reviews and follow-up evolution of operation losses o Improve risk indicator (KRI) to obtain a more adequate control system o Follow-up and response to Audit Branch recommendations o Support and challenge the operational risk scenarios identified and assessed by the SG Entities on both quantitative and qualitative aspects. • Data Protection Officer (DPO) support at Loomis and Lagardère activ o New RGPD regulation compliance o complete the processing register which contained personal data o analysis of infrastructure security and risk applications • Assistance with internal control at BPCE NATEXIS ASSURANCE o Implementation of an internal control plan using COBIT

• Be a privileged contact point with the Regional Operational Risks Managers . • Ensure the roll out of the methodology within the Operational risk community • Ensure harmonization of practices and implementation of Group guidelines, promote best practices exchange. • Coordinate campaign of internal control worldwide via the tool ENABLON.

• Support and challenge the operational risk scenarios identified and assessed by SG. • Definition, deployment and management of IT security and operational risk processes • Ensure the qualitative and quantitative assessment of the major operational risk (RCSA) • Support managers in identifying and controlling operational risks. • Provide solutions and implement controls on specific categories of risk, fraud, information security, and business continuity activity. • Increase awareness of employees and the promotion of a risk culture within the organization.

• Conduct internal audit reviews over all Technology related areas in Applicatin and infrastructure, Information security organisation, standards, and risk management. • Present audit conclusions to the management of the area audited • Follow up audit issues and recommendations and monitor management’s action plans progress • Contribute to the draft audit report elaboration, including the formalisation of added value recommendations