Jean-Paul Gonçalves Araujo

Cybersecurity and Information Systems Management professional with over 30 years of experience in complex, industrial environments. Specialist in ISO 27001, GDPR, NIST, CMMC and ITIL, COBIT standards, I support companies in securing their IT infrastructures and managing large-scale IT projects.

● Acting as GRC Consultant and external CISO for a cybersecurity firm: leading technical audits (pentests, forensics), external monitoring, and compliance audits (ISO 27001:2022, ISO 27002:2022, GDPR). ● Supporting startups, SMEs, and mid-sized companies across France in risk management and security governance. ● Development of DORA and NIS2 frameworks for audits

Produce training support, quizzes, certificates for a customer (a major compagny).

International group, English-speaking environment, 44 sites, €1 billion turnover, SAP environment - Ensure continuity of ISMS action plans following ISO 27001:2022 certification; vulnerabilities – pentesting - Support in obtaining the TISAX certification for ISMS, GRC, ISO 27001:2022, ISO 27002:2022, ISO 27005, GDPR check - Revision of the ISMS policy, ISMS framework, IT charter, awareness training, alignment with the EBIOS RM methodology, MDM, etc. - Impact assessment and coordination with international teams & plants: Europe, Americas, Asia

Startup in the healthcare environment. Assisted a startup in assessing GDPR compliance requirements for Switzerland and the USA regarding its IT infrastructure.

- 25 Millions of customers, Socloud * Result: 2-3 months gain on the 360° ISMS review based on ISO and U.S. Defense standards ; hardening of the security of the so-called strongbox environments - Agile, SecDevOps, PMP, KPIs, ISO 27001-2-5, ISO 27035, NIST CSF & 800.X, Military Planning Law, STIGS, CIS Benchmarks, CMMC, MFA, AWX, Docker, IBM AIX, IBM DB2 for z/OS, IBM i, Linux, MS Windows, OpenShift, Oracle Database Enterprise Server, Redhat, SFTP, SSL, EMC Storage, IBM Z/OS, Qualys, RSA, Sailpoint, SSO, Symantec EDR, TSS, Citrix, VMware ESXi Server, SoCLoud …

- Infrastructure partner of 39 entities, participation in an IT automation program > €1.3 billion * Result: estimated gain between 6 months and 1 year, launch of the Programme Security Governance Committee (CISO, operational, ESN / end customer) - Agile, PMP, KPIs, ISO 27001-2-5, ISO 27035, NIS, OIV, Military Programming Law, SecDevOps, risk analysis, security assurance plan, Z-OS, OpenSource, Linux, Unix, Windows, SoCLoud, AWX, Gitlab ...

- Context: Help to organize the OPERATION department on ITIL basis. * Result: 50% increase in team autonomy, prioritisation-categorisation of incidents, implementation of best practices - Operation perimeter, co-piloting of 8 people, ITIL, Agile, Lean - Prioritization-categorization of incidents, the establishment of best practices, KPIs.

- Context: Strong suspicions of internal hacking of e-mail boxes concerning the highest hierarchical level of the company, a highly confidential mission (3 worldwide sites) * Result: enquiry conducted in less than a month - Turnover of 1.5 billion chf - Implementation of a cybersecurity surveillance on e-mail boxes

- Context: Definition of the service catalogue, alerting procedures - incidents & changes & problem management of the Operational Security Centre (SOC) for all 350 sites worldwide - Result: Creation of detailed Alerting-Incidents & Asset Changes procedures based on ITIL v3 & V4, ISO 27002 - 27035, NIST CSF & 800-x controls & additional, CMMC components, with controls and KPIs - Automotive Equipment Manufacturer (€18 Billion T*) - Departments relationships, Incidents & changes; - Stop following the events of the Covid-19.

* Result 1: detailed costing of B2C projects >€6.4 million * Result 2: G2S IA/PRO's Department elected most Agile. - Macro-cost phase of a cross-departmental project over 6.4 million €: file review of 2017, lot 1 > 2.5M, AGILE and PMP modes - Assistance to the organization and lead of the G2S IA / PRO department, following the change of strategy of the group: 3 sites, 25 collaborators, historical and transversal projects, annual budget of the service > 3.8 Million €: Agility, solidarity, climbs in skills and autonomies

- Help of the Digital transition of services: support for the industrialization of Admissibility, Change Management, ITIL * Result 1: Delivery in 1 month of the Receivability repositories with the agreement of the 3 directorates, including the client (making up for a 3-month delay) * Result 2: Implementation of the Big-Data Level 2 & 3 database support service, 0 incidents over 11 months, support and IAM procedures developed and respected, documentation (Help-desk, N2, N3 and even users), training, increase in team autonomy, wiki - Takeover of controlling area of of back-office operation of the upstream accounting of the group (Teradata and MVS-Z / OS backups part) in 1.5 months: no operating incident suffered by the customer - 36 billion € of turnover, 1,400 applications, 14,000 servers, 18 nodes of Teradata, Main IT operating department of the group

- Analysis of risks and opportunities on a 900K€ - Financial gain: 29% - Maximum Risk delta: 5% - Agile, Scrum, Oracle, Java, ETL

- Anonymous web survey for the highest French political authorities; SaaS - Representative between 92.48% and 97.52% of the 298 978 children-students in 2016 ; - During 10 days on the first page on Google and Bing (Referencing since October 30th 2016).

Wins: - ITIL certification with a better score (85%) than the world average (75%) - 150 hours of PMP work and education, eligibility for the exam: 10 600 hours of project management in 8 last years

* Impact: 25% of Grenoble Academy IT park, 3507 students, 194 teachers,150 school classes, 30 pre-elementary and elementary schools, 10 towns, 46 800 people - 65% gain on the 2015 budget, stakeholder satisfaction measured: + 500%; - IS. governance & Outsourcing & Cybersecurity Technical Management - Redaction of the official tripartite agreement (COBIT model) - Establishment SLA/ITIL documents, tendering procedures (CCP Marché Public de Prestations TIC) - Implemented and checked the 12 I.S. services in accordance with French State obligations included in CR2i2e -" Compléments sur le 1er degré des S2i2e - Le Schéma Stratégique des Systèmes d'Information et des Télécommunications " National Education parts - Implemented and checked IT sanitary & cybersecurity for children (Wlan environment), IT backups, I.S. security (Web traceability, firewalls, reverse proxy...) - Virtualization, testing of Cloud systems (Office 365 - 5 months, OwnCloud, Google Apps) - Feasibility study of fiber-optic network & terrestrial free-to-air network on head office

- Project: Web/ Seo (desktop, iPhone, Android) - Background video in Websites: innovation 2 years before the USA market - Partners in the USA and India and Amazon technologies’ websites department - Optimization, Woorank, SEO in Google first page in 1 week (Adwards-analytics) - Display with video < 2 seconds - Responsive technologie, 3D, flash CMS, Wordpress, voice synthesis, Html 4-5, CSS 3, Javascript, Php - V-iterative Agile parts - Mission of migration business softwares, Salomon Ltd., € 429 million of turnover - Mission of Audit, implementation, supervisor of Sage's ERP & Accounting - Car parts sector: 835 000 articles, global vision, PMP, SLA / ITIL

* Impact: a significant improvement of combustion in the core engine for Ariane V and missiles - Project management related to the propulsion of Ariane V (measure of reaction of propellant for the central engine, in real simulation, by fiber optics) - Customers : Hutchinson, MBK France (Yamaha group), PSA, Renault, RVI, Sécheron Ltd., SNPE group (Ariane V) - Implementations of measurement instruments and industrial quality control software - Industrial engineering, departure after significant decrease in business

* Impact: 1.3 million connected people / month, 5.5 million subscribers - Saving 50% of the CPU load of the Datacenter, saving 40% response time of sites - Stabilization and tuning of the datacenter and the sites (distributed architecture, white label): - Situation of start: recurring stops for several hours, several times a week, during 6 months - French leader on his web market, 18 M€ business / year

- Organization and controls of infrastructures, feasibility study, choice of solutions, - Implemenation, training, security, help-desk

* Result: 15th place / 1500 competitors, several validations included Ernst & Young Ltd. - In pre-release beta version: 25% better than Divx, full compatibility MPEG-4, MPEG-7 - After: INSA's University learns to make real-time video conferences in compressed mode - I stopped the project for the risk of loss of ownership of the technology.

* Specialist in challenging missions (customers & timing) - One of 4 engineers in charge of the implementation and the maintenance of the Teradata’s Datacenter centre for Reuters Ltd. in Collonge-Bellerive (First European centre in 2000, several million dollars) - Migration of Merrill Lynch Bank's I.S. in Geneva: single successful migration in Europe (5 cities in competition) - Implementation of 17 Swiss agencies for Euromaster Ltd. in 2.5 days - Full installation of the Information System for Caisse d'Epargne Bank in Nyon - Creation of first Modules of E.D.M. for International Road Transport Union in 4 languages - Heading of missions up to 11 engineers, Impact: several million dollars & CHF