Nicolas PEYRAN

Cloud Certification Support: Spearheaded the ISO 27001 certification process for the Private Cloud (DCP) — Tech Stack: OpenStack, VMware, Wallix, Keycloak. • Compliance Leadership: Conducted comprehensive Gap Analysis, defined the strategic roadmap, and coordinated the global project timeline leading up to the certification audit. • Security Arbitration & Expertise: • Current State Audit: Evaluated overall security maturity across infrastructures and operational processes. • Architectural Compliance: Performed systematic correlation between Technical Design Documents (TDD/DAT), the Statement of Applicability (SoA), and ISO 27002 requirements to provide expert security validation. • ISMS Documentation Engineering: Formalized the complete procedural framework and drafted the Statement of Applicability (SoA): • Identity & Access Management: Managed IAM & PAM policies (Keycloak, Wallix). • Operational Security: Oversaw Maintenance in Security Conditions (MSC), configuration management, change management (technical and organizational), encryption, and backup protocols. • Lifecycle & Risk Management: Defined Secure Development Lifecycle (SDLC) procedures via GitLab, secure media disposal, and third-party/vendor risk management. • Resilience & Continuity: Developed Business Impact Analysis (BIA) and Business Continuity/Disaster Recovery Plans (BCP/DRP); managed critical asset inventory. • Audit Support: Acted as the Lead Technical Referent and guarantor of ISMS robustness during the pre-certification internal audit.

Led level 2 control activities within the permanent control framework, assessing the effectiveness of Level 1 controls based on AXA’s proprietary Security Assessment Framework (SAF) and regulatory requirements from the ACPR Oversaw follow-up and implementation of remediation actions issued to third-party service providers following internal security assessments Delivered targeted presentations to the CSO (Chief Security Officer) and COMEX, supporting strategic decision-making on cybersecurity compliance

Led internal coordination of the statutory audit conducted by Deloitte and KPMG, ensuring timely response to requests and effective communication with internal stakeholders and top management. Initiated and managed a post-audit remediation project, prioritizing corrective actions following audit recommendations Defined target processes and RACI matrices for access management (provisioning, modification, deprovisioning, and periodic access review)

Evaluate process maturity level:  Conducted interviews and observed process execution to evaluate maturity. Evaluate process maturity against predefined criteria. Analyze evaluation results to identify strengths and weaknesses of each process. Developed action plans with process managers to enhance maturity Support MOE in defining the DICT level of applications. Identify application security levels in relation to the IEC 62443 standard. Reporting to the CODIR, AMOA teams

Identified of requirements from DORA regulatory text. Analyzed of RTS/ITS (January & July 2024) documents. Developed a DORA maturity assessment framework (scoring scale, consolidated view by article and chapter, required evidence, etc.). DORA regulation monitoring Managed Training sessions and awareness of DORA regulations. RETEX: Collect and structure observations, recommendations and feedback to improve processes. IA ACT Section: Monitored and analyzed IA ACT/DATA ACT regulations. Monitored and analyzed of ANSSI’s "Security Recommendations for Generative AI Systems. Monitored and analyzed of CNIL best practices on AI system development.

Audit ISO 27001 - Led Internal audit ISO 27001 – Imprimerie Nationale Groupe May 2023 – July 2023 Conducted an inventory of action plan management for IN Group's internal audit and certifications (2021). Conducted an ISO 27001 internal audit on both current and future certification scopes. Conducted an ISO 27001 internal audit on both current and future certification scopes. And an additional internal audit ISO 27001 for DISCNGINE in June 2024 Cyber Maturity Assessment of Group Entities - Société Générale CIB - September 2022 – May 2023 Assessed the cyber maturity of Société Générale Group entities in compliance with NIST standards. Conducted maturity assessments of SG Group entities based on NIST and SG internal standards (Darwin, D&R label). Finalized evaluation method and control list Supported annual barometer production and contributed to projects enhancing tools around this strategic activity (collaboration with cloud and data teams). Supported Cyber Control Tower activities, providing key findings for reporting to senior management.

2022 – GCS GUYASIS - Organizational audit for health services in Guyana Carrying out organizational audits of the IS based on ISO 27001 and ANSSI recommendations Development of an ISS security plan based on the result of the audit 2021-2022 – Groupe Monnoyeur - Audit to monitor the progress of the ISS roadmap and the level of cyber maturity Evaluation of the progress of the actions composing the ISS roadmap of the Monnoyeur group Evaluation of the level of cyber maturity and the level of exposure for the 5 activities and 17 countries that make up the Group Monnoyeur. 2021 – L'Oréal/Accenture - Evaluation of the level of maturity of cybersecurity practices in IT projects Identification and evaluation of the existing Maturity assessment of: the Security by design process on automation projects and Tier 0 access and identity management processes on Tier 0 projects 2021 - Société Générale Maroc (SGMA) - Implementation of a certificate management policy 2021 – F2J JAPY - Project manager on an IT security audit mission Evaluation of the IT function and governance Assessment of physical security devices/controls Analysis of the design / configuration of the network architecture (switches, local network, etc.), perimeter security (Firewall, Remote access, Partner access, etc.) and system (Workstation, Server, Endpoint protection, vulnerability management). Analysis of the procedures/controls put in place for identity and access management (IAM, PAM, etc.). Management of penetration testing projects (external and internal) and postmortem compromise analysis Preparation of the audit report and the table of recommendations.

Process review Information Technology General Controls (ITGC) : - Logical access controls over infrastructure, applications, and data. - System development life cycle controls. - Program change management controls. - Data center physical security controls. - System and data backup and recovery controls. - Computer operation controls Information Technology Dependencies Information Technology Application Controls (ITAC)

Responsable d'une équipe de 15 étudiants issus de diverses nationalités ( Pakistanaise, Hollandaise, Indienne, Vietnamienne et Chinoise. Mes missions étaient de : - Gérer et organiser les séances d'enseignements en anglais du Lundi au Vendredi durant 5 semaines à des enfants âgés de 8 à 14 ans issus de milieux défavorisés. - Co-responsable dans l'organisation d'un événement caritatif ( répartission des tâches par groupe, suivi hebdomadaire),

Installation d’une salle multimédia (ordinateurs, outils Office encyclopédies, jeux) au sein d’un orphelinat. Projet réalisé avec 7 personnes. Mes objectifs étaient de : - Démarcher pour trouver les équipements en France et au Maroc. - Collecter des fonds pour financer le projet