Hamid ZIRAOUI

– LBP is a French public bank providing retail and corporate banking services - 20 000+ employees - €8.5bn revenue – Team management (3 teams - 50 people) – Manage day-to-day activities of 3 teams: – Offensive security: pentests, threat hunting, Bug bounty – Defensive security: incident detection, vulnerability management (VOC project), AV/EDR management – Cybersecurity products: ensure deployment, operational support and maintenance of security products – Oversee and monitor delivery of key projects (VOC, SOAR, API security, CICD security...) – Monitor and plan security products maintenance and evolution – Service management – Communicate, clarify and promote our cybersecurity activities – Ensure KPI maintenance, consistency and delivery (Cyberscore dashboard) – Prepare, develop and maintain projects roadmaps (with CISO teams) – Budget definition and management

– ODDO BHF is a French/German private banking group (AM and CIB) – 2 700 employees, 10 countries (France, Germany, Switzerland, UAE, USA ...), €266m revenue – CISO advisory – Provide guidance and advisory to the Group CISO (and local ones from Tunisia, Switzerland, Germany...) – Assist CISO in IS roadmap/program definition regarding regulatory requirements (BCE audits, regulation) – Act as CISO deputy for validation of Project security reviews / non-compliance alerts ... – Handle special missions for CISO (branches merge, SWIFT security enforcement, ISO 27 security baseline, DLP enforcement...) – Enterprise Architecture – Contribute to complex projects compliance review (stable coin, Awareness, data classification...) – Validate deliverables produced by architecture team (technical architecture, GDPR, risks reviews...) – Coach the security architecture team manager and local CISOs – Recruit the security architects for architecture team

– Keolis is a global transportation company - 68 000 employees, 14 countries (Qatar, Australia...), €6.3b revenue – Team management (5 experts) – Manage day-to-day activities (resources planning, mentoring...) – Deliver cybersecurity reports to top management – Participate to the 24/7 on-call schedule – CyberDefense and crisis management – Handle crisis and orchestrate teams at group level (CTO security team, local CISOs and third parties) – Manage alerts from CTO teams, CyberSOC, SNCF, threat intel providers – Communicate clear incident reports to senior managers – Corporate cybersecurity and compliance – Lead and follow-up on-demand pentests, audits and treatment plans – Direct vulnerability management provider on exposed perimeter (350 websites) – Oversee cyber technology watch – Enterprise Architecture – Improve architecture maturity and compliance on: – Technical side (Security by design, cloud security, intrusion audits) – Contractual aspects (Insurance Plans, service contracts) – Regulatory questions (privacy questionnaire, and security features GDPR, HDS, CNIL) – Support and provide assistance and technical expertise to Business units

– Criteo is a global advertising company - 3 000 employees, 6 countries (Singapore, USA...), $2.2b revenue – Team management (4 consultants) – Organize day-to-day activities (incidents dispatch, resources planning, recruitment) – Deliver cybersecurity reports/KPI to top management (critical incidents, phishing,..) – Managed budget (€1,1 M) and all suppliers' contracts – Participate to the 24/7 on-call schedule – Lead cyberDefense and crisis – Handle incidents and people coordination (internal teams and third parties) – Bring expertise during investigation (logs analysis, lateralization, mitigation plans) – Gather incident related information and communicate to senior team members – Manage corporate cybersecurity and compliance – Oversee blueteam campaigns (Bluehound, Mimikatz, Purpleknight, Pingcastle) – Support CTO teams to reduce risks (AD best practice, strong auth, passwords management, ACL rationalization...) – Support projects implementation (CASB, DLP asset, centralized logging, WAF, vuln management) – Design and manage an awareness framework to improve people (CyberDay planning, web series, phishing campaigns) – Secure Entreprise Architecture – Support and provide guidance to Business Project Managers (security needs definition, requirements expression...) – Design architectures, do solution assessments and risk analysis – Participate in tenders, RFI, RFP, defenses and writing of associated documents – Track mitigation actions related to audits

– BNP Paribas Group is a global banking group - 193 000 employees, 62 countries (France, India, China...), €46b revenue – Team management (12 experts worldwide) – Manage CSIRT services (Amer, APAC, MEA and FR/UK regions) – Lead day-to-day activities (relationships with legal, steerco metrics, team sync, alerts management) – CyberSecurity crisis management – Serve as SPOC and handle incidents coordination at CIB level (CTO/CISO teams, CSIRTs and third parties) – Gather incidents related data and communicate to top management – Key-projects management (CyberSecurity program) – Threat intel platform: internal TIP (external providers: FS-ISAC...) – Log correlation: globalization of detection "use cases" – Incident process review: standardization of a global reaction plan, incident handling and crisis management

– Central Bank of France is the institution that manages France debt and notes issuance - 9 800 employees, €161b reserves – Team management and day-to-day activities (15 experts) – Manage activities (Project follow-up, security operations...) of the 3 teams (crypto, AV and authentication, Innovative projects) – Prepare and manage department budget (€5m) – Manage security assets life-cycle management – Manage audit findings/recommendations implementation to comply – Provide executives (CTO, CISO) security guidance (trends, strategic objectives, offerings and 1-5y roadmap) – Key-projects management (Advanced security program) – Anti-APT: protection against emerging advanced threats (Cisco AMP) – SIEM v2: migrate logs correlation and incident detection (SPLUNK) – Multi-channel Data Loss Prevention (Symantec DLP)

– BNP Paribas Group is a global banking group - 193 000 employees, 62 countries (France, India, China...), €46b revenue – Secure Entreprise Architecture – Comply banking applications with IS group policy and CIA requirements – Support business with security needs definition and requirements expression – Participate to RFI/RFPs writing and perform security evaluation of vendors' solutions – Key-projects participation – ATM architecture redesign / SEPA mail / Mobile payment (Retail banking) – Applicative security improvement (WAF) / Application zoning (Group infrastructure)

– BPCE Group is a global banking group - 3 500 employees, 25 countries (France, USA, Germany...), €47b revenue – Incident handling and process redesign – Handle security incidents within the windows servers' perimeter – Reshape security processes based on ISO 27001 principles (patch management, PAM) – Replace previous risk management method (MARION) with a more effective one (MEHARI) – Participate to the 24/7 on-call schedule