Thierry Zoller
Information Security - M.Sc. / MBA
Salaire / Taux journalier
Luxembourg
Mobilité : Bruxelles, Francfort-sur-l...
Freelance, ouvert au CDI
Peut venir sur site
Expertises
Langues
À propos
Introduction
Senior Information Security Executive specialising in Non-Financial Risk Management, operating in Second Line of Defence / Risk Control Function roles across complex, highly regulated environments. I have held multiple CISO roles building Risk Control functions from scratch, defining mandate and governance, establishing internal control frameworks, hiring and leading teams, and reporting directly to Boards and Supervisory Boards.
Expérience de travail
Technology Risk Control (CISO Europe)
Julius Baer
févr. 2025 - déc. 2025
11 mois
Luxembourg
– Executive Director and Non-Financial Risk Lead – Regulatory Key Function holder and 2nd Line of Defence (Risk Control) overseeing Technology Risk (ICT, Information Security, Incident Management, Resiliency). Certified DORA Practitioner.
J.P. Morgan Mobility Payments Solutions S.A.
juil. 2021 - mai 2025
3 ans 11 mois
Luxembourg
Head of Tech Risk and Tech Compliance (CISO)
févr. 2022 - mai 2025
3 ans 4 mois
Luxembourg
– Technology & Cybersecurity Risk Management Lead, point of contact for regulatory inquiries and in charge of oversight, board reporting, regulatory reporting of tech and security risks. (DORA, PSD2, PCI-DSS, EBA, CSSF, FCA).
Head of IT
juil. 2021 - mai 2023
1 an 11 mois
Luxembourg
– Joined as Head of IT with full responsibility for ICT Operations, reporting directly to the COO.
Information Security Officer / DPO
Confidential
août 2020 - juin 2021
11 mois
Luxembourg
– Accountable for information security and data protection governance within a public-sector environment.
Country Head of Security Risk Management (CISO)
HSBC
août 2018 - juin 2020
1 an 11 mois
Luxembourg
– Responsible for ICT and operational risk oversight across HSBC's Luxembourg entities (private banking, funds, corporate banking), reporting to the CRO.
Amazon
juin 2015 - août 2018
3 ans 3 mois
Luxembourg
Head of Security Risk and Compliance Europe
févr. 2017 - août 2018
1 an 7 mois
Luxembourg
– Appointed to establish and lead the Security Risk & Compliance function for Amazon's Luxembourg-regulated e-money institution, later expanding mandate across Amazon EU entities. Accountable for designing and operating structured risk governance aligned with CSSF, FCA and EBA supervisory expectations within a fast-scaling fintech environment.
Chief Information Security Officer
juin 2015 - août 2018
3 ans 3 mois
Luxembourg
– 2nd Line of Defense Information Security Control and Risk Management Function for Amazon Payment Europe (Regulated Entity). Responsible for security of Amazons European Payments Business
Practice Lead EMEA - Threat and Vulnerability Management
Verizon Enterprise Solutions
avr. 2010 - mars 2015
5 ans
Luxembourg
– Joined as Principal Security Consultant and promoted to Practice Lead within a CSSF-regulated PSF environment. Led enterprise technology risk programmes for regulated financial institutions across EMEA within a CSSF-regulated environment. Advised Boards and C-level stakeholders on risk exposure and control maturity, shaped enterprise-wide governance initiatives, and served as Subject Matter Expert to the European Commission (DG CONNECT) on the Network and Information Security Directive (NIS). Frequent speaker on regulatory and cyber risk developments
Founder
G-SEC Itd.
sept. 2009 - mars 2010
7 mois
Luxembourg / United Kingdom
– Non-commercial and Independent group of Information Security Specialists, sharing knowledge and protecting society through publications of whitepapers, vulnerability research and disclosure. – I was heavily involved in cutting-edge research and development projects. I researched, coordinated and responsibly disclosed multiple vulnerabilities
n.runs AG
août 2006 - mars 2010
3 ans 8 mois
Thale, Allemagne
Director of Product Security and Security Services
déc. 2008 - mars 2010
1 an 4 mois
Thale, Allemagne
– Joined as Senior Security Consultant and promoted to Director. Led complex offensive security and enterprise risk programmes for international organisations, combining deep technical expertise with strategic advisory responsibilities. Conducted high-impact security assessments and coordinated vulnerability disclosures, while advising senior stakeholders on technology risk and control maturity. Published research findings and regularly spoke at international conferences on emerging threat landscapes.
Senior Security Consultant
août 2006 - déc. 2008
2 ans 5 mois
Thale, Allemagne
– Led end-to-end security projects and mentored junior staff. Conducted security assessments for Fortune 100 and large enterprises, specialising in penetration testing, red teaming, advanced attack simulations, implant development, application security, threat modelling, and risk assessments. – Engaged in vulnerability research and coordinated disclosure, including publishing BTCrack, a method targeting Bluetooth key exchange weaknesses, and contributing to malware evasion research. – Author for BSI IT-Grundschutz and publications such as PC Praxis, Computerwoche, Heise (c't), and Hackin9.
Security Engineer / Consultant
Telindus Luxembourg
avr. 2005 - juin 2006
1 an 3 mois
Luxembourg
– Joined the CSSF-regulated Telindus PSF, delivering information security services primarily to Luxembourg financial institutions and public-sector entities. Conducted penetration testing and vulnerability management
Founder
YASC
juin 2001 - mars 2006
4 ans 10 mois
Hoyland, Barnsley S74, Royaume-Uni
– Founded and led a security-focused software company developing Windows-based hardening and network monitoring tools. Designed and commercialised system-level utilities (packet analysis and TCP/IP stack hardening) aimed at reducing attack surface and improving enterprise resilience. – Combined low-level technical engineering (network stack optimisation, protocol analysis, system hardening) with product strategy, distribution, and media positioning. Tools received coverage in c't / Heise, reflecting technical relevance within the German-speaking IT security community. – Press Coverage - Featured in c't / Heise: https://www.heise.de/hintergrund/Dynamisches-Duo-270644.html
Formation
Solvay Brussels School of Economics and Management
Executive Master In Cybersecurity Management, Cybersecurity Management
2026 - 2026
1 an
Luxembourg School of Business
Executive Master in Financial Services Industry (EMFSI), Banking and Financial Support Services
2023 - 2024
1 an 1 mois
Luxembourg School of Business
Master of Business Administration, MBA
2021 - 2023
2 ans 1 mois
École supérieure d'Informatique
International Master, Computer Science
2017 - 2019
2 ans 1 mois
Licences et certifications
Certified DORA Practioner
Délivré le : –
Google Cybersecurity Certificate
Délivré le : janv. 2025
Financial Industry Certified Professional (FICP)
Délivré le : sept. 2024
Certified Senior Lead ISMS Implementer (ISO27001)
Délivré le : mai 2022
Certified Senior Lead Risk Manager (ISO31000)
Délivré le : févr. 2022
Certified Lead Cybersecurity Manager (ISO 27032)
Délivré le : mai 2020
Certified Lead Data Protection Officer (CDPO)
Délivré le : févr. 2019
Certified Secure Software Lifecycle Professional (CSSLP)
Délivré le : févr. 2017