Sélim Houfani

– Designed security strategy aligned with the business for 2025 & 2026 – Partner with business stakeholders to address security topics and drive risk-based security initiatives aligned with business objectives – Security governance & policies: – Translated regulatory and Group security requirements into actionable controls, ensuring consistency between policies, procedures and day-to-day operations. – Integrated controls across SSDLC, vulnerability management, release management, incident handling and third-party security procedures. – Implemented Security Gates across the development lifecycle to enforce security checkpoints and ensure alignment with the security framework. – Established periodic vulnerability management meetings to monitor, track, and remediate vulnerabilities identified during development on a per-project basis. – Integrated security requirement checkpoints into project planning to verify proper implementation and gather evidence prior to Go/No-Go decisions. – Designed consolidated security dashboards and reports (KPIs, remediation plans, critical risk alerts) for presentation to executive and security governance committees. – Operational Risk Management & Permanent Control (LoD1 / LoD2 alignment): – Ensured ongoing compliance with regulatory and security frameworks (PCI-DSS, DORA, CRA, GDPR, NIST, ISO 27001) through the execution of permanent control activities – Designed and implemented a permanent control framework covering IT and cybersecurity risks, including governance, roles, control procedures, KPIs and reporting – Defined and executed the Operational Permanent Control plan (Level 1), including control testing, evidence collection, and documentation of results – Assessed control effectiveness, identified deficiencies, and defined remediation action plans with relevant stakeholders – Monitored operational IT risks and incidents, escalated major risk events, and coordinated remediation actions across IT, Security, and Business teams – Followed up on Internal Audit, External Audit, and regulatory recommendations, ensuring timely remediation, proper evidence, and formal closure – Performed risk assessments on AI-based tools used by business teams, evaluating associated risks and defining appropriate security and governance controls – Produced consolidated reporting and dashboards to support management decision-making and risk governance committees – Regulation: I work closely with the Legal and Compliance teams to ensure adherence to regulatory requirements – Digital Operational Resilience Act (DORA) – Impact assessment for Ingenico – Identification of security requirements to be implemented – Translate DORA requirement into actionable LOD1 controls and monitoring activities – Gap analysis between current controls and CRA expectations – Identification of the action plan – Cyber Resilience Act (CRA) – Impact assessment for Ingenico – Identification of security requirements to be implemented across Hardware, OS/System, Firmware and applications – Translate CRA requirements into actionable LOD1 controls and monitoring activities. – Gap analysis between current controls and CRA expectations – Identification of the action plan – SOC2 – Drafted SSDLC security requirements aligned with SOC 2 controls – Conducted a pre-audit readiness assessment within the application scope – Performed a gap analysis against SOC 2 control requirements – Defined and documented the remediation action plan – Security Audits & Third-Party Assessments – Conducted security audits on terminal Test Farms (infrastructure, access control and operational security) – Performed security assessments of SaaS tools (data protection, third-party risk and compliance) – Assessed AI-based solutions – Conducted Third-Party Security Assessments (TPRM) covering due diligence, risk evaluation, and control effectiveness – Defined and monitored remediation action plans with suppliers to ensure compliance with security and regulatory requirements – Incident management: Coordinate security incident with Business, CSIRT and SecOps team, – Business Plan Continuity: – Drafted a standardized BCP template aligned with business and IT continuity requirements – Delivered awareness sessions and explained BCP principles to Business Owners – Developed a BCP test reporting template to track test results (RTO/RPO, gaps, actions) – Awareness, training & risk culture : – Delivered awareness and training sessions on IT operational risk, cybersecurity and LOD1 responsibilities. – Promoted a strong risk and permanent control culture within IT and security teams through practical guidance and hands-on support.

– Designed security strategy aligned with the business for 2024/2025 – Identify the features to be developed for 2024/2025 – Analyze the security needs of each feature – Plan the secure design workshops with the business and the IT. – Perform the secure design : – With the business : threat modeling workshop – With the IT: Security assessment – Security requirements identification to implement during the development – Initiate the Security test strategy – Control the security requirement implementation with the IT team and Business during the SSDLC – Workshop with the IT team to identify which security measures should be implemented during the sprints – Define with the DevSecOps team the security gates and the rules – Plan periodically meeting with the IT team (Tribe) to control the implementation of security requirements during the sprints – Report the different result from the different scan: SAST, SCA, DAST and Pentest – Fill the security strategy test – Control the compliance with the NIS V2/GDPR/ISO 27001 framework – Perform periodically control on the application and identify the non-compliance – Launch periodically technical scan on the infrastructure and application (Qualys) – Perform habilitation control on the application – Report the result of the scan with the non-compliance – Help the IT team to define and implement the remediation plan – Follow the remediation plan achievement – Perform ISP (integration of security in the project) : – Perform an assessment of security for the new project – Third party assessment if the project are outsourced – Identify the non-compliance and initiate a risk form – Follow the risk form and the implementation of remediation plan – Report the posture of security to the management (reporting of metric and KPI) – Incident management: – Managed security incidents from detection to resolution in coordination with business and IT teams – Coordinated crisis management and response actions for critical cyber incidents. – Performed root cause analysis and implemented corrective actions. – Participate of Disaster recovry test and make a Retex to improve the process

– Audit DORA – Analyze framework Dora for ICT Risk management, Digital resilience test and ICT related incident. – Assessment to identify gap analysis between DORA regulation and the cyber requirements implemented. – Design Application Security process to address all mandatory security requirements for Digital resilience Test during the development (Agile). – Drafting training course on Application Security and DORA topic for developers and TechLead to acculturate them. – Support local IT Risk team to understand what it expected for the DORA pilar << Digital resilience test » and <<< ICT related incident >>> – Design a Security Test strategy to help team to be compliance with the Security requirement – Train IT team/Product Owner in different location (Bucharest, Madrid, Munich and Milan) – SPOC for: – Application Security and DORA – Security Champion role – Security test strategy – Vulnerability management – ISP: Integration security in the project – Agile Vs Security – Agile & Security – AppSec Programm – DevSecOps: – Work closely with technical team to implement Fortify – Implement a Pipeline security process – Writing AppSec & Vulnerability documentation: – SAST/SCA/DAST guideline – Vulnerability remediation procedure (reduce the number of legacy vulnerability) – Application security delivery presentation (Build and Run) – SSDLC presentation (activities and gates) – ISP: Implement security in the project – Integration security in the project Procedure drafting – Coaching Tribe leader and Security champion on Risk management procedure and good practices – Perform with business the secure design (implement Threat modeling methodology) to identify the possible case of fraud or non-compliance on use cases – Perform Security Assessment for all new project and take care are compliance with DORA/NIST/PCI-DSS – Implementing Threat modeling during the secure design phase – Follow the IT Risk and Security project – Perform permanent control for LOD1 and LOD2 – Writing AppSec & Vulnerability documentation: – SAST/SCA/DAST guideline – Vulnerability remediation procedure (reduce the number of legacy vulnerability) – Application security delivery presentation (Build and Run) – SSDLC presentation (activities and gates)

– Audit and support. – Responsible test methodology – Support/Coaching – Audit de maturité du processus de test basé sur les modèles TMMi et TPI (Cardif) – Help team to prepare for CMMi level 3 certification (Leasing Solution) – Problem solving on "requirements-Tests" disciplines (BDDF and SIT) – Perform a test process maturity assessment based on TMMi and TPI models (Cardif) – Improvement continous : – Improvement of the "requirement-test" methodology within the framework of the Opteam 2.0 Program (SIT) – Improvement of the "requirements-Test" methodology with the ISTQB and IREQB standards. – Improvement of the Quality Assurance process – Test communauty – Scoping and proposal topic for workshop – Working group animation

– Information consolidation provided from projects managers – Budget monitoring – Realization of dashboards project, monthly / quarterly reports and indicators – Qualification of the risks and impacts of new projects