Jorge Enrique Prada Contreras

Strategic and Stakeholder Engagement Responsibilities Policy Advocacy: Promote awareness and compliance with security, privacy, and regulatory policies among stakeholders, fostering a culture of security and accountability across organizational levels. Strategic Guidance: Provide actionable insights and counsel to leadership on aligning information security, privacy, and compliance strategies with business objectives, ensuring seamless integration with organizational priorities. Technical Expertise Responsibilities Risk Identification & Mitigation: Identify, assess, and address security risks by providing actionable recommendations and collaborating with cross-functional teams to enhance the organization's security posture. Technical Proficiency: Leverage in-depth knowledge of networks, operating systems, and business-specific systems to design and implement tailored security measures that meet organizational needs.

* Ensure compliance with corporate information security programs and local country laws and regulations * Ensure alignment of business processes with industry information security policies or international best practices. * Coordinate, facilitate and execute external and external information security audits and oversee the implementation of applicable remediation measures. * Maintain metrics for all relevant activities and report to stakeholders.

• Responsible for projects and consulting services in information security for Technology Services companies and International Banking Sector. - Lead the implementation of the Information Security Management System ISO 27001:2013. - Develop the Information Security strategic plan. - Perform Security Risk assessments, on business processes, technology platform and information processing facilities. Impact: - Reduced operational risk associated with business processes, technology services and information processing facilities by 90%. - I led the implementation of the risk mitigation plan (ISO 31000), 100% improvement in IT service delivery processes (ISO 20000), - I implemented 100% of the mitigation controls, raising the maturity level from LOW to MEDIUM and reducing operational risk from LOW to MEDIUM.

Responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected by identifying, developing, implementing, and maintaining processes to reduce and mitigate information technology (IT) risks across the organization. This position had coverage in 18 countries, 700 employees, and an average annual budget around of USD 500,000. - Lead the implementation of the corporate framework, consisting of: Corporate Projects, Strategic Security Management, Information Classification, Access Control, Risk Management, Compliance Management and Security Monitoring. - Corporate Projects: Reduced by 80% the operational risk associated with the unavailability of essential personnel, business processes, technology processes, including a new high availability data center, which provides service to 100% of the critical business processes, representing 45% of the total corporate processes through the implementation of the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP). - Strategic security management: Reduced operational risk by 80% in critical business processes and corporate risks such as: reputational, financial and operational risks of CAF, through the implementation of the Information Security Management System (ISMS) ISO 27001, the execution of a risk mitigation plan. - Information classification: I managed to decrease the risks from HIGH to MEDIUM level for the institution, by the implementation of the Information Classification Process, which allowed identifying confidential information, internal and public use, corresponding to 100% of the critical business processes, identifying 100% of the associated information assets and implementing protection measures and training in information classification. - Access control: Reduced the risk of unauthorized access by 90%, implementing access control process for critical business in 18 countries in Latin America.

Responsibilities: Responsible for information security services PDVSA / INTESA, strategic association with more than 50k users worldwide. Achievements:  Led the implementation of the security architecture for electronic commerce, extranet and Intranet, both in Venezuela, USA and Europe, to benefit 10+ thousand users of corporate services and platforms.  Reduced potential HIGH risks by more than 90% due to the execution (50+) Security Assessments to the corporate technology platform and data centers allowing the timely identification of mitigation controls at national (corporate) and international (London and the Hague) offices.  Achieved 90% reductions in Integrity risks and operational availability, associated with the new corporate data center, going from Tier I to Tier 2. Redundant data center, for 1,500 users with a budget of 1M US $.  Executed organizational security diagnosis (audit) and risk mitigation plan (ISO 17799) obtaining a MEDIUM operational risk level.