Matthieu ANDRÉ

Évaluation indépendante du niveau de sécurité des sous-traitants et du respect des exigences contractuelles au sein de la Direction de la Sécurité et de la Protection des Données (CSO AXA France) - Planification, organisation et réalisation des contrôles de sécurité des sous-traitants (ISO/IEC 27001, NIST, RGPD, Cybervadis, ANSSI, DORA, NIS). - Coordination avec les directions Achats, Juridique, Gestion des risques cyber et métiers pour assurer la conformité et la maîtrise des risques. - Rédaction de rapports d’audit, suivi des remédiations et reporting à la Gouvernance Sécurité. - Encadrement et pilotage de prestataires externes spécialisés en audit sécurité. - Contribution à l’amélioration continue des méthodes et outils de contrôle, intégration des retours d’expérience et innovations. - Gestion des négociations opérationnelles (planning, budget, disponibilité) et pilotage transverse en contexte international.

- Project risk Management; - Monitoring of project risks – ISO/IEC 27005 & EBIOS RM; - Define and set in place the project risk dashboard; - Define and set in place the project risk reporting; - Monitoring of security measures resulting of project risk analyses; - Advice on the choice and implementation of security measures;

Audit for transformation and industrialization of IT Department: - Processes audit; - IT processes industrialization (compliance ISO/CEI 27001, SOC2 Type 1&2 and ITIL); - ISO/IEC 27001 and SOC2 Type 1&2 certification - Contract and budget management; Management of the IT team – 20 people: - Define and set in place the IT roadmap; - Define service catalog; - SLA / SLR: implementation and follow up.

Preparation for ISO/IEC 27001 certification: - Compliance off the group with IT security rules; - Writing of ISMS documentations (English: policies and procedures); - Definition, implementation, and monitoring of risk analysis, roadmap and security action plan; - Contribution of new technology: Virtual patching, Bastion, EDR, XDR, Pentests, phishing campaign, …; - Security project management; - User training; - Reporting and creation of security dashboard; SWIFT and TISAX certification management; Crisis taskforce: security incidents, Ukrainien; Customer requests management.

IT Security management; ISO/IEC 27001 standard; risk management; IT Security KPI.

ISO/IEC 27001 - Management of certification renewal, audits and Pentests: - Writing of ISMS documentations (English); - Risk management - ISO/IEC 27005; - Definition, implementation and monitoring of audits and pentests; - Definition, implementation of the action plan for certification and remediation of open points; - Employee training and awareness (English); - Reporting to COMEX, presentation of indicators and action plan (English) Security – Monitoring of security projects: - Definition of security needs and objectives - Security by design: Active Directory, SOC SIEM, MFA, PCA / PCIT, AV, Segregation of duties…; - Introduction and implementation of new technologies: Varonis, Efficient IP, Virtual Patching…; GDPR - Monitoring of compliance projects: - In partnership with the legal and IT team creation of processes and definition of the action plan; - Employee training and awareness.

Follow and define the IT security standards and norms: - Define and set in place the IT Security strategies based on ISO/IEC 27001, ANSSI and GDPR; - Writing the ISMS documentations (IT charter, Policies, …) and Security roadmap creation; - Training and awareness; - Risk management and IT security dashboard creation; - Internal and external audits Management; - Creation and facilitating of IT Security meeting; - IT Security incident management; Architecture, pre-project, technological watch: - Evolution recommendation in the IT systems, architecture design; - Studies of the structuring projects (firewall, Anti-virus, proxies, data storage, …).

ISO/IEC 27001 – ISO/IEC 27001 certification renewal management: - Writing the ISMS documentations; - Follow up the evidence; - Follow and define the security action plan; - Awareness and training stakeholder to be prepared for the renewal audit; Security – follow up security projects: - SOC SIEM, MFA, PCA/PCIT, AV; PMO – industrialization of the IT System Department - Infrastructure: - Creation of the project roadmap; - Staff training in project management (planning, team report, risk management, …); - Industrialization of decision-making processes BUILD / RUN; - Budget management (team BUILD); - Team management;

Management of evolutions of 2 platforms (Data Mining / Data Management): - Projects portfolio (750K€) - PMMD method; - Budget follow-up, planning, team time tracking, reporting, mobilizing expert teams; - Implementation of news systems and infrastructure; Project management: - Functional coordination of international teams (ASIA, EU); - Organize and facilitate the project governance: steering committees, workshop; IT security: - Application of international IT Security standards – Axa ISMS, ISO/CEI 27001; - Security components: ESG, VIP, WAF, Firewall, IAM and DLP;

Transformation and industrialization of IT System Department R&D: - Outsourcing of the RUN contract to Budapest (Cognizant); - IT administration processes industrialization (compliance ISO/CEI 27001 and ISMS); - Contract and budget management; Management of the IT support team IT System Department R&D - budget 800K€: - Define and set in place the IT roadmap; - Ensure the IT Quality compliance regarding the CNIL, FDA, EMA, ANSM, Partners; - SLA / SLR: implementation and follow up.

Redesign of IT system security procedures: - Conception of the IT Security architecture; - Writing the documentations and processes implementation - reporting; Solution deployment in KPMG/MAJUNGA/EIFFAGE towers (La Défense) – 3 teams (8 persons): - Communication and training about the secure network architecture; - IT deployment (SQL Servers, LNS, …);

Consultant – Engineering Consulting - Transversal Project Manager, Response to calls for tenders: overhaul of the computer network of the company Parkéon (urban mobility solutions, 1,000 employees) integrating the latest security rules. Mission pour SFR / Schneider Electric / Société Générale

Creation of the new SFR building at Vélizy – budget 500K€, 8 teams (33 persons): - IT Security architecture conception and first deployment of Wi-Fi solution; - Savings made on the initial budget: 75 K€; Wi-Fi deployment on SFR Rive Défense building – budget 90K€, 5 teams (8 persons): - Communication and training about the new Wi-Fi network architecture; - Reduced document printing, roaming availability. New IT architecture apply to all SFR building (France) – budget 150K€, 5 teams (8 persons): - Negotiation and agreements on hardware, architecture and services offered to users to network / telecom providers; - Cost control (30% decrease) in operation and project management (15%).

Network project manager - Network, telecommunication, supervision and intranet infrastructure projects: management of teams and external stakeholders, meeting facilitating, users training. - Creation of Secure Network Architecture to migrate Lebanon UN and Afghanistan NATO telecom. Upgrade hardware and software. IT Project manager - Management of the development of web and system applications, design of a test platform for the information system and the Intranet site of the Command of the Forces.