Eric Stumpp

Enhanced Security Services Consulting for Financial and Industrial sectors • SOC as a Service - CyberSec Architect • CISO as a Service – vCISO - ISMS implementation and audit • BCM/BIA – RM/RA – Business and IT resilience – NIS2/DORA • SmartCity, IOT AI/ML Aeronautical Industry - France: • Concept of a SOC as a Service for Aircraft companies • Analysis of business impact analysis and requirements • Proposition of Resilience Solutions • Risk Management and Security DORA compliance reviewer for financial institution in the EU: • Analyze the current situation of the company and propose the types of audits to be carried out • Identify the auditor profiles and the strategy to meet the needs of DORA (internal/external) • Create an ICT risk mapping and audit plan taking into account the 5 pillars of DORA • Audit through a gap analysis the adequacy plans defined by the company • Audit the implementation of DORA based on the aspects included in the regulatory technical standards (RTS) and technical standards of execution (ITS) • Develop a compliance monitoring platform • Anticipate external audit controls and the recommendations of the Supervisory Authorities (AES) Luxury and Hospitality Group - Switzerland Technical CISO Cybersecurity Strategy & Governance Develop and maintain a risk-based cybersecurity strategy. Align security objectives with business goals. Technical Architecture Oversight Design and evaluate security architecture across systems, applications, and networks. Lead decisions on encryption, firewalls, endpoint protection, identity & access management (IAM), etc. Cloud & Infrastructure Security Secure cloud infrastructure (Azure). Apply zero-trust models, microsegmentation, and infrastructure as code (IaC) security. Drive security awareness training and a culture of security throughout the org. Conduct regular risk assessments and security audits. Report on KPIs/KRIs and risk posture to the board or stakeholders in technical and non-technical terms.

• Review the Group's reference architectures (ISO27001/27005 – NIST CSF) and security requirements in projects collaboration in DevSecOps Teams; Advise project managers and application managers for GRC compliance. • Conduct of Infrastructure/Web Applications and Cyber risks assessment and review (SAST/SCA/FSAT/DAST/Pentest/OWASP) investigations and impact analysis in projects; Participate in the determination and innovative of business security requirements

Manage client relationships from the security governance perspective throughout the whole lifecycle of Business Process Outsourcing (BPO) clients of Avaloq Contribute to the definition of the client specific security baseline and act as the single point of contact for client audits’ execution Consult and advise internal and external clients about security topics and support the opportunity management process by providing subject matter expertise and support Manage the Security SLA governance

Solution Architect and coordinator for complex managed security service program. Design, implement and manage large Security Operation Center and RED Teams. Perform information risk, security, and related compliance assessments, including testing of related controls according to Data Security and Privacy Framework and Industry Regulation. Coordinate information risk and security discussions with technical and non-technical groups (business/legal/devops). Create client Cyber Awareness policies/training procedures to meet corporate and regulatory requirements and standards.

Lead the Strategic Relocation Program of the New Data Center - Site and supplier selection – Impact and Budget Analysis (10 M USD) - Analysis, sanctioning and design of the new room (200 m2) – Power/Rack/Cooling - Design, architecture and implementation of the network diversity, backbone and security - Setup of the virtual cloud and storage over 3 Data centers in Switzerland - Built-out of the network L2 strech for the application migration - Planning and operation model to maintain the business continuity during the application migration and data integrity - Management of the system/network/storage/cloud capacity in global provisioning view - Management and coaching of Engineers/Consultants Teams on site and off- shore as well as broader Asset.

Responsible for the Security of the Systems/Network project with UEFA. Undertook a range of new projects to improve the Security and Business continuity architecture. Review PenTest and Audit to establish a strong risk assessment. Design/Architect of security HLD of new hosting platform for EURO 2016. Define SIEM implementation to identify vulnerabilities and threats.

Leading the IT infrastructure team Corporate Security Officer - manage and coach a team of system, network, security and helpdesk engineers - lead projects from the design to the implementation within the system, network and security domains - define and perform IT risk and audit assessments - advise technical architecture in development of new OLYMPIC products. - Led and coached the IT strategy/governance - Led projects from the design to the implementation within the system, network, private cloud and security architecture. - Improved the IT business processes applying ISO 27x and ITIL/Cobit Standards, vulnerability management, network security, server hardening, security incident management, identity management and secure software development. - Architect of the new data center and built-up the Saas center (Olympic Core Banking System), the BCP/SRM strategy and contingency plan providing software and activity loss prevention (300 developers)

Skills: ISO Standards

Security project management in air navigation environment; Design and architect of network and security infrastructure; Information security policies and auditing procedure;

Network and Security infrastructure in Europe

System and Network management for Key Account (Bank, Telco) in Europe

New technologies implementations in dealing rooms - network, financial feeds, security

High availability computing solutions for ATM, Telco, banking and financial markets