Federico Antonelli

• Manage and continuously improve the risk analysis activity in projects, as well as the monitoring of security remediation actions • Manage and support project managers (IT and/or other professions) on the security aspects of projects. Monitor and ensure the level of security in all stages of projects in connection with project governance • Contribute to the management of the group's Governance, Risk and Compliance team in connection with the Prevent & Comply approach defined in the security strategy • Enforce and monitor the correct application of the group's security norms and standards and actively contribute to their definition • Actively contribute to the definition and implementation of the group's information security policies, to be applied to all houses and brands • Ensure that security is taken into account in contracts with third parties and that security is properly taken into account by the latter via a regular audit • Manage the performance of standard external security audit services in conjunction with other team

• Working closely with development teams to ensure that security by design principles are included as base requirements in new development projects • Conduct annual security risk assessment in order to define the impacts related to confidentiality, integrity and availability of corporate assets • Implementation of Data Loss Prevention tool (Forcepoint) and resolution of data protection and labour law issues • Analysis of security requirements related to cloud solutions • Execute fake phishing campaigns in order to increase users’ awareness • Coordinate the ISO 27001 corporate roadmap certification • Website / Brand monitoring (CERT, SOC) • Conduct investigations and analysis related to data breach and identification of appropriate control improvements

PSD2 • Provide assurance on design and implementation of the PSD2 solution • Ensure the Regulatory Technical Requirements are being met • Present report and risk analysis to relevant committees RISK ASSESSMENT • Work on risk initiatives to ensure security effectiveness with applicable laws and regulations, as well as internal policies and procedures • Monitor, identify, report and mitigate cyber security threats and risks • Provide feedback regarding cyber security in the development/update of Information Security policies, procedures, standards, and guidelines

• Maintain up-to-date knowledge of the security industry including awareness of new or revised security solutions, improved security processes and the development of new attacks and threat vectors • Support in consulting and guidance around proper execution of IS controls to ensure compliance and security of information assets (ISO 27001) • Ensure ongoing compliance with GDPR

• Drafting of legal advice in civil and criminal matters • Research programmes and impact analysis on GDPR/NIS Directive • Judicial and extrajudicial assistance to private subjects, companies, public bodies