Sebastien Gioria

Enseignant sur le cours SEC106 | Analyses de sécurité : vulnérabilités et attaques

L'IA n'attend pas. Votre sécurité, si ? AI Cyber Guardian —Aider les entreprises à ne pas se faire dépasser par les systèmes qu'elles déploient. Le terrain : la sécurité des systèmes IA — agents, Gen AI, LLM, MCP — combinée à une expertise profonde en cybersécurité applicative, DevSecOps et threat modeling. 🎓 Formations pour devs, archis et équipes sécu — risques IA, prompt injection, supply chain, data leakage 🛡️ Threat modeling sur vos architectures IA (STRIDE, PASTA, DREAD) 🔧 Conception et développement d'outils de contrôle et d'audit IA 📋 Conformité OWASP LLM Top 10 · EU AI Act · ANSSI 📩 Vous construisez avec l'IA ? Parlons sécurité.

Founder and board member of the Cloud Security Alliance France Building the future of the AI & Cloud Security in France - Promote the Cloud Security in France - Develop the cultural adhesion

• Led the security initiatives for Lectra's 4.0 offers, focusing on design, secure development, and cloud security. • Spearheaded the DevSecOps program and managed cloud services security, ensuring robust operational integrity. • Directed the Bug Bounty program and conducted comprehensive audits of software, cloud, and hardware platforms. • Trained global R&D teams on security best practices, serving as the primary point of contact across regions.

Writing Articles for Les Editions Diamonds : OWASP Zap Proxy - HS 76 GnuLinuxMag NodeJS == Sécurité ? - HS 85 - GnuLinuxMag

Je suis Expert Judiciaire Informatique Pres la cour d'appel de Poitiers dans les catégories Informatique, Internet, Telecoms

AppSecFR is a security company specialized in Application Security. Most customers names are under NDA, but I can name some of : - Insurance : Generali, Macif, Aviva, Axa ,... - Bank : bnp Paribas, credit agricole, crédit mutuel,younited crédit .... - Development firms : GFI, infotel, Umanis, SII, 3DS(Dassault systèmes) ,aubay , .... - Web and startup : oui.sncf, nuxeo, cultural, .. - Others : IRCEM, CSA, orange, symfony eyc, OCP, - Traditional Services on Application Security : => Pentesting => Code Review => Threat Modeling - Application Security Consulting - Application Security Coaching - Application Security Training - Application Security SAAS platform (audit, code review, dashboard, ...) We have Application Security consultants/partners in France, Switzerland, Benelux, IT, UK, US, Canada I'm working closely with some application security vendors and can help you to integrate it on your applications security process.

Checkmarx environment setting up the remediation process setting up the appsec process remediation wiki tools around checkmarx international environment regulations: DFS500, LPM, payments auditing projects devs environment :Java , C, C++, Python, php, C#, Vb.net

checkmarx environment trainings appsec process remediation coaching devs devs environment: java, php, c/c++

fortify sca and asc environment training remediation coaching devs devs environment : java

Author and trainer of some course : - Course 364H : Secure Coding in C (French specific course; ask me for TOC) - Course 419Z : Secure Coding in Java (French specific course ask me for TOC) Trainer on : - Course 940 - Securing Web Applications, Services and Servers: Hands-On : http://www.learningtree.com/courses/940.htm - Course 2781- Mobile Application and Device Security: Hands-On : http://www.learningtree.com/courses/2781.htm -Course 2055 - Digital Forensics: Windows System and Mobile Investigations : http://www.learningtree.com/courses/2055/digital-forensics-windows-system-and-mobile-investigations/

Advens is a company specialized in managed cyber-security. Innovation and Technology@Advens ispart of Technical Direction for new services, solutions for our customers. My job consists to : - Digital / Network agitator - Represent Advens at conferences and associations. - Assist customers on application security - Training on Securing your Code (C/C++, Mobile, IoT, Java, PHP, ...) - Testing new tools, methods, and more on Application Security - Conduct code review, pentesting on application for customers (Web, mobiles, ...)

- Groupe leader "Application Security" I'm involve in some study you can find on the CLUSIF webSite : - MIPS (Threat and Security Practice in France) - Vulnerability Management - ISO

I was leading the IT & Security Audit branch in a Legal auditing company. Working with Financial audit , accountant & lawyer as well for other customers. Starting the branch from scratch in 2007. - Marketing services, customer sales and services delivery. => IT Audit : ISACA standard, SOX, ... => Security audit => PenTesting => Risk analysis => Security expertize => Forensics => Software auditing => Account auditing for legal review Revenue growth : +20% 2009, +20%2010, +10% 2011, +15% 2012 Company was based in south of France (Niort, near the most big insurance) and got office in : - Paris - Poitiers - Nantes - La roche sur Yon. Some of the projects done: - Security Code Review for an insurance - IT Auditing with the COBIT standards for an insurance - IT Project auditing for a bank - Pentesting of the new partners extranet for a health company.

Pour faire face à la menace sur les systèmes d’information numériques, la capacité de l’État doit être renforcée tant au niveau central que local. Parmi les nombreuses mesures annoncées dans le Livre blanc sur la défense et la sécurité nationale, il a été décidé, en complément de la création de l’ANSSI, la mise en place au niveau de chaque zone de défense et de sécurité d’un observatoire zonal de la sécurité des systèmes d’information (OzSSI). Ces observatoires, créés par le ministère de l’Intérieur, ont pour mission de relayer, sur l’ensemble du territoire national, les mesures prises pour améliorer la sécurité des systèmes d’information. À cette fin, ils animent un réseau largement ouvert à l’ensemble des acteurs concernés : échelons déconcentrés de l’Etat, collectivités territoriales, organismes ayant une mission de service public, entreprises et opérateurs privés, etc...

Was in charge of some course like : - PERL programming - Shell programming - Linux/Unix administration - pentesting and countermeasures - Cisco courses - security courses

Was the principal contact for all the translations in French of the FreeBSD documentation project. Contact in France for the translation of the BSDCertification group See www.FreeBSD-fr.ORG for more details of the project

Security services Security appliances Open-source Consulting Security Consulting

Working on the security team with the CSO for : - security politics (ISO 27XXX view) - business continuity - pen-testing - internal audit - legals issues (Solvency 2, CNIL, ..) - risk analysis - support/expertise of security for architecture and production team

CTO and CSO for a value added hosting company.

e-learning University of Technology in the IONIS Group (EPITA/EPITECH) Course planning and validation Relationship with the professors. Validation of their courses Relationship with the enterprises. Modification of the course, relationship with students Internal procedures Organisation Project leader of the e-learning system

I was : - Driving deployment project in security - Driving auditing project - Making risk analyze for the Telecom and Production services

My jobs was to : - Driving a smal staff of manager in network, security, systems and applications. - Doing pre-sales - Designing and validating new architectures for customers and for internal use - Helping Sales guys to design the catalogue of services

Assist customers with their architecture Helping Pre-Sales for bidding Maintain and evolve IT architecture

Setting up a new offer Security Consulting