Fahmi MEGDICHE

Responsible for global security governance (IT, SaaS & on-premises Products) at the Group level with subsidiaries in France, Sweden, Poland, Norway, Denmark, Tunisia, UK, Canada, USA, and Australia. – Enforce business enablement by partnering with sales and customer success teams to position security as a differentiator, winning customer trust and supporting growth – Secure customer data and ensure resilience in a global SaaS fintech pioneering AI-driven AP automation and expense management – Drive compliance with NIST, ISO 27001, SOC1, SOC2 and PCI DSS across international markets – Embed security by design into AI and cloud-native products, aligning trust with innovation – Act as a trusted advisor to executives and the board to ensure cybersecurity strategies enforce business growth and innovation – Lead and mentor an 8 FTEs multinational security team, fostering a culture of accountability, collaboration, and continuous improvement – Manage global security operations, from product and cloud security to incident response, ensuring effective alignment between teams and business priorities – Build organizational capability, developing security leadership pipelines and ensuring teams are equipped with the right tools, training, and frameworks to deliver at scale

In charge of cybersecurity (IT & SaaS Products) and privacy of all subsidiaries in France, Spain, Belgium, Morocco, and Dubai. Internal until August 2022 and freelance from then. Report to the General Manager with regular updates to the Executive Committee. – I defined and deployed a security strategic plan insuring holistic resilience: physical, economic, cybersecurity, and privacy. The scope included internal IT, and IOT for all BUs. – Leading transversal teams to safeguard digital assets. – Building annual cybersecurity and privacy awareness programs to drive culture change. – Defining policies adhering to NIST, ISO 27001, PCI DSS, OWASP, CIS, and GDPR. – Building and driving Security by Design, Privacy by Design, and business continuity and disaster recovery plans. – Responding to security incidents, investigation, assessing products security, reviewing contracts, risk assessments, and 3rd party vendors assessment. – Developed a bug bounty program for more efficient penetration testing. – Actively collaborating with engineering, commercial, legal, financial, and HR teams. Accomplishment: At the end of the strategy execution, the company was designated as Security Leader by an external security rating agency.

Responsible for global security governance (IT, SaaS & on-premises Products) at the Group level with subsidiaries in France, Portugal, Spain, Italy, Belgium, Russia, Canada, USA, and Brazil. Report to the CTO and regularly update the Executive Committee. – Conducted technical and organizational audits and risk assessments. – Development of a 5-year strategic plan and the architecture of a new group security program to meet the new group strategy converging to 100% SaaS products: 3 annual roadmaps, definition of budgets, definition of a new communication plan, definition of an awareness plan, definition of a recruitment plan, definition of KPIs, establishment of a team of 4 engineers. – Presentation to the ExCom of my discovery report, a rapid action plan, and the strategic plan. – Definition and management of several projects: Securing the active directory and O365, IAM, PAM, Trusted cloud, Secure Code Development, Vulnerability Management, Resilience Plan. – Follow-up of the resolution of non-conformities and renewal of the ISO 27001 certification, and preparation of the SOC II Type II. – Incident response to several internal and external incidents with investigation. – Actively collaborating with engineering, commercial, legal, financial, and HR teams.

I carried out various missions as a cybersecurity expert. – Alliance Renault Nissan Mitsubishi: I was responsible for building a security program from the ground up, including recruiting a team of 10 internal security professionals. My key responsibilities included securing an API-based solution for connecting all brands' vehicles, defining the overall security strategy, roadmap, and policies, with a focus on NIST CSF, CIS, ISO 27001, and BSIMM8. Additionally, I ensured GDPR compliance, coordinated internal and external audits, managed budgets, and supervised both the in-house team and external service providers. – Valeo: I have led teams in creating a security initiative for connected vehicles, defining R&D cybersecurity policies, and defining SSDLC processes. I have responded to cybersecurity RFI/RFQ and provided technical expert guidance. Also, I have designed security architectures and PoCs for IOT, studied the impact of GDPR on products, and managed international projects with teams from France, Germany, USA, India, and Japan. – Air Liquide Medical Systems: I was responsible for managing external audit services, overseeing security metrics, conducting risk analysis, ensuring the development team security of IOT connected medical devices, and reporting to multiple executives during Steering Committees. – LivaNova: I focused on secure architecture, risk analysis, securing the development chain, testing and validation, and secure code reviews of connected medical devices. – PSA: As a cybersecurity project manager, I managed customer relationships, budget, and international teams.

I successfully completed multiple assignments for high-profile clients such as Ingenico, IDEMIA (formerly Oberthur Technologies), and Cegelec Secure. My key responsibilities included leading teams of up to 17 professionals from France, Tunisia, China, Italy, and Spain, and executing international projects focused on developing IT and physical security solutions.