Ervin Isufi

As an experienced Information Security Officer, I lead the development, implementation, and enforcement of comprehensive cybersecurity frameworks that safeguard the organization’s computing infrastructure and operational continuity. • Designed and implemented robust information security policies aligned with ISO/IEC 27001:2022. • Protected enterprise systems against cyber threats by enhancing network and endpoint security. • Conducted internal risk assessments and vulnerability scans across critical systems. • Monitored real-time compliance and implemented automated alerts for policy breaches. • Maintained up-to-date knowledge of emerging threats, regulatory shifts, and evolving IT security standards. • Collaborated with cross-functional teams (IT, legal, HR) to align security initiatives with business goals. • Investigated and documented security incidents, applying root cause analysis and corrective action planning. • Conducted cybersecurity awareness training sessions for internal departments. Key Projects & Contributions • Security Governance Framework Implementation: • Developed and deployed OSHEE’s organization-wide security governance framework, resulting in a 25% reduction in compliance gaps during internal and statal authorities audits. • Vulnerability Management Automation: • Introduced automated vulnerability scanning and patch management workflows using new SIEM and opensource tools, improving detection and remediation speed by 40%. • Phishing Simulation Campaigns: • Rolled out simulated phishing campaigns with targeted training interventions, improving employee awareness and reducing risky behavior by over 35%. • ISMS Policy Consolidation Project: • Consolidated 12 fragmented security procedures into a centralized ISMS document, enhancing clarity and audit readiness across all departments.

Collaborated with audit teams and clients to assess, improve, and certify information security management systems (ISMS) in alignment with ISO/IEC 27001:2022. Applied deep expertise in information security risk, compliance, and governance to support organizations in achieving certification and maintaining regulatory alignment. • Conducted end-to-end ISO 27001 audits, from audit planning and risk assessment to reporting and follow-up. • Evaluated ISMS effectiveness across multiple sectors including energy, telecom, IT services, and healthcare. • Authored detailed audit reports outlining nonconformities, risks, and opportunities for improvement. • Delivered consultancy to close compliance gaps and align policies, procedures, and controls with ISO standards. • Facilitated workshops and training sessions on audit readiness and ISO 27001 awareness for technical and nontechnical audiences. • Supported organizations through pre-certification, surveillance, and recertification audit cycles. Key Projects & Contributions • ISO 27001 Audit Portfolio (10+ Clients): • Led certification audits for diverse organizations with up to 1,000 employees, ensuring full lifecycle support from readiness assessment to successful certification. • Gap Analysis & Corrective Action Planning: • Delivered structured gap analyses and Corrective and Preventive Action (CAPA) plans that accelerated client audit readiness by up to 50%. • ISMS Maturity Model Optimization: • Developed and implemented ISMS maturity evaluation frameworks that guided clients through multi-year security roadmaps. • Regulatory Alignment Advisory: • Provided advisory services to align clients’ ISMS not only with ISO 27001 but also with NIS Directive, GDPR, and local regulatory requirements.

Delivered comprehensive IT and cybersecurity solutions for public and private sector clients, with a focus on strategic planning, risk management, infrastructure security, and training. Engaged in full project lifecycle management, hands on technical implementation, and security awareness initiatives. • Designed and executed tailored cybersecurity strategies for over 15 client organizations. • Assessed and improved clients’ security postures across cloud, on-premises, and hybrid environments. • Managed IT infrastructure upgrades, including server deployments, firewall implementations, and cloud migrations. • Provided SOC-related services and daily operations support for overseas businesses. • Delivered expert guidance on IT policies, ISMS documentation, and regulatory compliance. • Led end-user and administrator training on Microsoft environments, Active Directory, and security tools. Key Projects & Contributions • Phishing Reduction Strategy – Healthcare Sector: • Developed a full security strategy for a 500+ employee hospital, achieving a 40% reduction in phishing incidents within 12 months through policy redesign, technical controls, and awareness efforts. • Cybersecurity Awareness Program – ESM shpk: • Conducted workshops and simulations across 4 sites, training over 1,100 employees on secure behavior, incident reporting, and data protection best practices. • Infrastructure & Cloud Security Projects: • Delivered infrastructure upgrades, Hyper-V and VMware setup, firewall deployment (PFSense, SonicWall), and Microsoft 365-based hybrid-cloud solutions for both public sector and enterprise clients. • Technical Documentation & Executive Communication: • Authored white papers, SOPs, security audit reports, and executive-level presentations, simplifying complex cybersecurity topics for decision-making.

Led the IT operations and infrastructure for a prominent educational and cultural institution. Oversaw a broad range of responsibilities including network security, user support, systems administration, and IT budgeting, while ensuring high service availability and technology adoption across the organization. • Conducted regular security checks and audits to ensure data integrity and system availability. • Identified and implemented software and infrastructure upgrades aligned with organizational goals. • Developed and enforced IT policies, operational procedures, and system usage best practices. • Managed on-premises and cloud infrastructure, including Microsoft 365, smart boards, and Wi-Fi networks. • Supervised the helpdesk team, providing L1–L2 support for daily operations and incident resolution. • Coordinated with external vendors and partners on IT service contracts, hardware procurement, and licensing. • Maintained detailed reporting on IT performance metrics and budget utilization. • Designed and delivered IT training sessions for administrative and teaching staff. Key Projects & Contributions • Infrastructure Upgrade Program: • Modernized the center’s IT backbone by replacing legacy network components, enhancing wireless coverage, and optimizing server resources for better scalability and reliability. • Office 365 Migration & Integration: • Planned and executed a successful migration to Microsoft 365, improving collaboration and email security for over 100 users. • Budget & Resource Management: • Managed the annual IT budget and optimized procurement processes, leading to a 20% cost savings while improving service levels. • Staff Training & Digital Adoption: • Developed in-house training programs to support digital literacy among staff, resulting in faster onboarding and reduced support requests.

Led IT operations and security initiatives in a high-availability hospital environment with over 500 staff and hundreds of critical systems. Managed IT helpdesk and acted as the primary information security officer, overseeing infrastructure upgrades, policy enforcement, and medical systems integration. • Supervised the IT helpdesk team, ensuring timely resolution of service requests and incidents. • Designed and deployed a resilient server and network infrastructure using Microsoft Windows Server, Cisco routers/switches, and Fortinet/Cisco firewalls. • Administered Microsoft Exchange, Active Directory, DNS, DHCP, and domain services. • Implemented cybersecurity policies and routine checks to ensure regulatory and operational compliance. • Integrated and secured interconnection of medical systems such as PACS, Agfa Impax, and LIS/RIS with clinical departments. • Oversaw installation and maintenance of CCTV, physical access control, and endpoint security measures. • Served on the hospital’s quality board, supporting ISO-related certifications and compliance. • Supported DR operations including backups, high-availability services, and business continuity planning. Key Projects & Contributions • Hospital-Wide Infrastructure Modernization: • Led complete upgrade of IT systems across the hospital, reducing downtime by 60% and enhancing clinical workflow performance. • Medical System Integration: • Successfully integrated imaging and lab systems with centralized IT, enabling faster diagnosis and secure data sharing across departments. • Security Policy Implementation: • Developed security protocols and controls tailored to a healthcare environment, aligning with ISO 27001 and health data protection standards. • CCTV & Physical Security System Rollout: • Designed and deployed a campus-wide surveillance and access control system, improving on-site safety and compliance with internal standards. • Telephony System Enhancement (Avaya): • Administered and expanded the hospital’s telephony system for 300+ users, improving communication reliability in critical care areas.

Managed the full scope of IT operations for critical departments including the Military Press and Publications Centre and the Army Cultural Centre. Ensured secure, reliable IT infrastructure supporting communications, internal systems, and public information channels. • Maintained and monitored the Ministry’s wide area network (WAN) infrastructure. • Provided technical support for military administrative systems, user workstations, and communications hardware. • Implemented Group Policy Objects (GPOs) to enforce compliance and regulate user access across the domain. • Led the design, content updates, and ongoing maintenance of official institutional websites. • Coordinated secure IT operations in line with national defense protocols. Key Projects & Contributions • Policy-Based Access Controls: • Enforced GPO-driven restrictions and configurations to standardize workstation behavior across military departments. • Website Modernization & Uptime Management: • Maintained the Ministry’s official online presence and ensured uninterrupted access and rapid updates for press releases and public documents. • Secure Network Support: • Supported WAN configurations and troubleshooting in a controlled environment, ensuring data confidentiality and system uptime.