Ricardo Coronel Lemus

- Conducted comprehensive reviews of IT security architecture for both existing systems and new projects to ensure adherence to industry best practices and alignment with organizational security standards - Microsoft Azure migration to cloud. - Manage the implementation of the DORA (Digital Operational Resilience Act) - Lead PCI DSS certification process. - Support and lead the security part of the process to obtain the EMI license in Spain. - Develop, implement, and maintain the Information Security Framework for Internal Services (policies, standards, guidelines, architecture models, etc.) - Derive and translate the Corporate Security Policies into local/specific ones and with the corresponding standards, baselines, guidelines & architectural model. - Develop and embed security processes into global framework and methodologies. - Develop a strong communication (position papers, policies, procedures, standards, etc.) and awareness around the Information Security Policies. - Ensure that the security risk posture for internal services is aligned with the business appetite & -strategy. - Provide security consulting/expertise and support in programs / projects to other Business Units - Perform security assessment on Programs/projects ((confidentiality, integrity, availability, traceability) with compliance to applicable regulations) - Identify possible mitigation measures. - Translate security risk into business terms which are understandable by the business to reach residual risk acceptance. - Validate the design & accreditation of the security with Programs & projects (architecture, design, processes, regulatory compliance) - Collect & report of metrics supporting the business value of the security program’s activities. - Conduct, coordinate or support IT Risk Assessment analysis and Audit Plans - Drive the day-to-day security process, serious security Incidents. Vulnerabilities management.

Mission at DEXIA – La Défense Security and Business Continuity Consultant – CISO Team -Participation in strategic bank transformation projects in the capacity of Information Security and Business Continuity; interaction with operational departments, audit services, compliance, and permanent control. NIST SP 800-53, ISO27001, CIS Critical Security Controls. -Evaluation of Information Security (SSI) and Business Continuity Planning (BCP) risks (RCSA ICT mapping), coordination, and monitoring of ISS/BCP risk mitigation actions. Analysis and management of security incidents and attendance at related committees. -Responsible for the business continuity process (BIAs, RTO/RPO), BCP testing. -Management of authorizations and logical access in support of other security team members. -Monitoring of projects and oversight of cross-project relationships. Mission at PMU – Paris 15 Deputy CISO (Chief Information Security Officer) -Ensure the maintenance of compliance indicators with IT standards and vulnerability management indicators - Challenge requests for exemption from compliance with operational vs security risks - Provide the entire documentary corpus, database extractions and controls to the Auditors (Statutory Auditors) based on ISO 27001 - Analyze the results of the vulnerability scanners and give recommendations to reduce the volumes of new and existing vulnerabilities - Follow the various remediation plans associated with the various audits - Prepare and present the security committee (COSEC) - Deployment and administration of the Crowdstrike EDR (Endpoint detection and response) Solution - Qualys configuration update - VM, PC, Reporting module - EDR Crowstrike deployment - Management of the SOC (Security Operation Center) contract - Ensure good log collection coverage of the SOC target perimeters - Follow the evolutions of the SOC

-Establish and maintain the security enterprise vision, strategy and program to ensure assets and technologies are adequately protected -Lead and coordinate the development and maintenance of information systems security policies, procedures, standards, and guidelines, ensuring compliance with laws and regulations -Ensures threat and vulnerability resources and technology are proactively monitoring 24X7 potential threats and vulnerabilities and protection controls are implemented timely and appropriately to safeguard and maintain business operations. -Identifies and assesses risks in implementing business innovations, Provides assessment of those risks to business stakeholders. -Directs staff in identifying, developing, implementing and maintaining processes across the enterprise to reduce information and technology risk. -Monitors compliance with the organization’s information security policies and procedures among employees, contractors, alliances, and other third parties. -Design and execute penetration tests and security audits -Monitor, report and control incidents -Monitor threats and take prevention measures -Define the IT security controls with the permanent control Manager -Stay well-informed of best practices in the IT security field including from a data protection perspective, coordinate and/or evaluates new and emerging security practices and technologies, and recommends and promotes adoption as appropriate.

Some past missions: - Consultant CDCG Group in mission at Credit Agricole Cards & Payments, attached to the head of risk and permanent control. During this mission, I worked for the risks and permanent control team for the Group Crédit Agricole Cards & Payments as a Risk Management Officer Responsibility for the consolidated assessment of the IT risks of my entity : mapping process and management of IT risk (in conjunction with the Manager of operational risks (MRO), the Chief Information Security Officer (CISO), the DSI, all deparments) Definition and implementation of the plan of controls 2.2 for the IT risks of my entity, as well as any additional controls deemed necessary - Consultant at CDCG Group in mission at United Nations Framework Convention on Climate Change (UNFCCC) as a Security Consultant During this mission I worked for the IT Secuirty Team for the United Nations Framework Convention on Climate Change (UNFCCC) during the COP21 at Paris

During this mission I was in charge of managing the security and networking solution of different clients. I was the level 3 of escalation in case of incident. - Improvement fo the Security Policy. - Firewall administration, Juniper, Checkpoint, Cisco PIX/ASA, NETASQ - SSL VPN administration Sonicwall aventail. - IPS/IDS administration Checkpoint IPS. - Web-filter administration Ironport S650. - Load Balancer Linkproof. - Switch and Router administration, Cisco CATOS, IOS.

During this mission I worked for the operation team, in order to maintain the security service to our clients. - Firewall administration Checkpoint, Cisco, Juniper. - Switch and Router administration, Cisco CATOS, IOS, Foundry - Risk assessment, Vulnerability and Penetration test for several customers - Documenting security standards, writing reports, policies and guidelines

During this experience I taught programming in C+, Clipper, HTML programming logic, Office Word, Excel, PowerPoint, Access, Internet, and Corel Draw.