José Manuel Gómez

Independent cybersecurity architect supporting fintech, financial services and regulated digital organizations with security architecture, cloud security, IAM, DevSecOps, GRC and cybersecurity program management initiatives. •Designed and reviewed security architectures for AWS, Azure, hybrid cloud and regulated technology environments. •Assessed security risks, architecture gaps and control maturity across cloud, identity, application, network and infrastructure environments. •Defined security roadmaps, target-state architectures and practical control improvements for technology and security teams. •Defined IAM and identity governance models covering RBAC, PAM, access control and segregation of duties. •Supported DevSecOps adoption across secure SDLC, CI/CD, SAST, DAST and application security practices. •Improved security operations, monitoring and incident response capabilities through architecture and process reviews. •Advised executive leadership and technology teams on cybersecurity priorities, risk reduction and security transformation.

Worked as cybersecurity architect, CISO advisor and security project lead for regulated client environments, reporting to CISO and CIO stakeholders. •Guided a senior cybersecurity team of 4 professionals delivering security architecture and governance initiatives. •Defined cybersecurity strategies, roadmaps, target-state architecture priorities and control improvements aligned with business and regulatory requirements. •Provided architecture guidance for cloud, hybrid infrastructure, identity, application security and security transformation initiatives. •Coordinated cybersecurity activities across infrastructure, cloud, security, governance and technology stakeholders. •Supported risk management, security control definition and cybersecurity program execution.

Directed infrastructure, cloud, networking and cybersecurity functions during the company's transformation into a regulated brokerage in the Brazilian financial market, reporting to the CEO and CFO. •Built the infrastructure and cybersecurity organization from scratch in a regulated fintech environment. •Managed a multidisciplinary team of 9 professionals across infrastructure, cloud, networking and cybersecurity. •Defined cybersecurity strategy, security governance, risk management and internal control capabilities. •Designed secure cloud, hybrid infrastructure and enterprise security architectures supporting financial services operations. •Introduced DevSecOps and secure software development practices across technology teams. •Established security operations, monitoring, incident response, architecture standards, security policies and operational security controls. •Supported regulatory alignment with Brazilian Central Bank requirements, PCI-DSS and LGPD.

• Responsible for the management of the corporate security operation, managing the teams of: Cybersecurity, Access control and IT Governance and PMO. • Responsible for strategy definition and budget of the security area, IT Governance and PMO. • Preparation and review of Policies, Norms and Procedures related to the Technology environment with a focus on Information Security; • Creation of information security campaigns, contemplating internal communications and integration conferences, instilling the dissemination of an information security culture and the decrease in the number of corporate incidents. • Creation and implementation of DevSecops and Application Security process (SAST, DAST, Secure SDLC, CI / CD), as well as the identity management process (IAM - Identity and access management), Segregation of duties (Sod) and Role Based Access Control (RBAC). • Collaboration with other executives to prioritize security initiatives and the budget, with corporate risks as the basis of security management. • Responsible for the creation of a SOC and the plan for responses to security incidents (CSIRT). • Responsible for the strategy to mitigate the risk of corporate information leakage. • Promoting a culture of IT security within applications and the company as a whole. • Reviewing and continuously improving internal standards related to IT security. • Preparing reports on the security status of projects across different areas or vendors. • Conducting risk/threat assessments in IT projects. • Prioritizing security assessments. Main results obtained: Planning and execution of the adaptation to Resolution 85 of the Brazil Central Bank for Payment Institutions, PCI-DSS, SOX and LGPD (Brazil GDPR) CISO role reporting to CTO and CEO.

Responsibilities: • Responsible for the management of the corporate security operation, managing the teams of: Cybersecurity, Access control and Governance. • Responsible for strategy definition and budget of the security area. • Preparation and review of Policies, Norms and Procedures related to the Technology environment with a focus on Information Security; • Creation of information security campaigns, contemplating internal communications and integration conferences, instilling the dissemination of an information security culture and the decrease in the number of corporate incidents. • Creation and implementation of DevSecops and Application Security process (SAST, DAST, Secure SDLC, CI / CD), as well as the identity management process (IAM - Identity and access management), Segregation of duties (Sod) and Role Based Access Control (RBAC). • Collaboration with other executives to prioritize security initiatives and the budget, with corporate risks as the basis of security management. • Responsible for the creation of a SOC and the plan for responses to security incidents (CSIRT). • Responsible for the strategy to mitigate the risk of corporate information leakage. • Promoting a culture of IT security within applications and the company as a whole. • Advising architects and designers on recommended security patterns and practices. • Designing solutions and recommending alternatives. • Preparing reports on the security status of projects across different areas or vendors. • Consulting on the security of external networks. • Evaluating and prioritizing risks/threats in IT projects. Main results obtained: Planning and execution of the adaptation to Circular 3909 of the Brazil Central Bank for Payment Institutions. CISO role reporting to CEO.

• Responsible for the corporate security operation, managing the teams of: Cybersecurity, access control, governance and Networks. • Responsible for the strategy and budget of the security area. • Preparation and review of Policies, Norms and Procedures related to the Technology environment with a focus on Information Security; • Responsible for the creation of indicators for the protection of information, including security architecture, network access and risk analysis, to guarantee the compliance of the entire environment. • Creation of information security campaigns, contemplating internal communications and integration conferences, instilling the dissemination of an information security culture and the decrease in the number of corporate incidents. • Creation and implementation of DevSecops and Application Security process (SAST, DAST, Secure SDLC, CI / CD), as well as the identity management process (IAM - Identity and access management), Segregation of duties (Sod) and Role Based Access Control (RBAC). • Collaboration with other executives to prioritize security initiatives and the budget, with corporate risks as the basis of security management. • Responsible for the creation of a SOC and the plan for responses to security incidents (CSIRT). • Responsible for the strategy to mitigate the risk of corporate information leakage. • Coordination with Security Architects. • Promoting a culture of IT security. • Advising architects and designers on recommended security patterns and practices. • Designing solutions and recommending alternatives. • Preparing reports on the security status of projects. • Evaluating and prioritizing risks/threats in IT projects. Main results obtained: Creation of the security, access control and network area (equipment, policies, processes and solutions). 20+ people Team

• Preparation and implementation of the corporate security plan. • Process analysis and selection of security solutions. • Negotiation with manufacturers and suppliers. • Preparation and updating of security rules and policies. • Evaluation and implementation of security solutions to address different corporate risks: DLP, Proxy, AntiSpam, Database FW, Antivirus, governance indicators, AD control, SIEM, dynamic and static analysis of applications, inventory, APT, etc. • Creation and implementation of the vulnerability management process. • Creation of IT security architectures. • Promoting a culture of IT security within applications and the company as a whole. • Advising architects and designers on recommended security patterns and practices. • Designing solutions and recommending alternatives that meet or exceed security requirements. • Preparing reports on the security status of projects across different areas or vendors. • Providing consultancy on the security of external networks. • Conducting risk/threat assessments in IT projects. • Prioritizing security assessments. Main results obtained: Creation of the security, access control and network area (equipment, policies, processes and solutions) CISO Role for 18 months.

• Preparation of offers related to IS solutions for clients of any size. • Development of strategic indicators and metrics for information security and management of security solutions • Development of security policies, standards and procedures. • Platform / Application / Source Code / Compliance Security Audit (pentests and vulnerability analysis - OWASP/WASC) • Security engineering (firewalls, intrusion detection systems (IDS / IPS), Siem, etc.) • Analysis of IT risks and threats (Also in Cloud Computing Architectures) • Creation of security concepts (Design and Architecture) • Management, response and resolution of security incidents • Correlation and centralized management of events (SIEM) • ITIL process design (Incident, security and alteration management). • Development of directive policies based on ISO 27001 and ISO 27002 • Designing solutions and recommending alternatives that meet or exceed security requirements. • Preparing reports on the security status of projects across different areas or vendors. • Providing consultancy on the security of external networks. • Conducting risk/threat assessments in IT projects. • Prioritizing security assessments. Main results obtained: Creation of the vulnerability management process for the government of Catalonia. Creation of a solution to manage events and security information (SIEM) for a financial environment, using Open Source and Bigdata technology (projecting a level of predictive intelligence with machine learning)

• Management of Linux / Windows based servers and the entire network. • Hardware and software installation, security and configuration incident management. • Responsible for pentests and vulnerability analysis of Platform / application • Implementation of routine audits of systems and programs • Creation and implementation of high availability strategies in services • Consulting on the security of external networks. • Designing solutions and recommending alternatives that meet or exceed security requirements.

• Pentests using Ethical Hacking methodology • Creation of information security policies, standards and procedures • Platform / application / source code / compliance security audit (pentests and vulnerability analysis - OWASP/WASC) • Security concepts (Design and Architecture) • IT Forensic Analysis • Network, database and security troubleshooting

Managing the day to day IT requirements of the company such as user management, trouble shooting, help and advise. Maintaining desktop applications , local area networks, IT security and telecommunications. Working Areas: • Server administration/management based on Linux/Windows and network management. • Creation of advanced monitoring platform 24x7. • HW & SW installation, incident management, configuration management and enforced • Engineering of running the external DNS/WEB/EMAIL services of the company • In charge of Server/network infrastructure management and Security Incidents • Developing & maintaining the company IT systems, software and databases. • Recommending and implementing improvements and efficiencies.