Vincent Draghi

Managed cybersecurity risk portfolio for €50M+ asset management firm serving many business units across multi-cloud infrastructure through systematic GRC program optimization and regulatory alignment Conducted comprehensive risk assessments for AI/ML and cloud architecture projects using ISO27005/EBIOS RM methodology, helping the project team to identify and mitigating 95% of critical vulnerabilities and risks before production deployment Evaluated vendor security maturity levels for 20+ third-party providers, implementing due diligence frameworks that reduced supply chain risk exposure by 35% Improved the vizualisation metrics dashboard and security tooling, helping my team and all assessors to automate their analysis and reducing security debt by 45%

IT risk management in the international financial services industry: -Third party risk management (due diligence based on NIST framework) and audits - Information security by design in the project lifecycle (review of the IT contracts and the technical architecture, asset sensitivity and data confidentiality) - Lead the Shadow IT campaign and designed the data visualization dashboard - Security review of the IT change management and the vulnerabilities detected in the DevSecOps toolchain (components, SCA...) - On demand risk assessment (ISO 27005) of incidents/requests from the CSIRT

Manager of many scholars for a blockchain gaming NFT-P2E project.

- Identity Access Management (employee onboarding/offboarding, PAM, MFA) - IT Process refactoring based on ISO 9001 and ITIL (CMDB, ITSM, KPI and SLA) - Implementation of an ISMS (ISO 27001) and creation of the information security policy, management of the user awareness campaign and remediation plan - Lead the audit and pentest with the National Cybersecurity Agency of France - Monitoring and data protection with a dedicated DLP platform

- Technical coordinator and incident response for many business department - Assets configuration and security baseline implementation. - Operating system migration/hardening projects and EDR deployment, users awareness…

Création de l'espace information famille (accueil du public, bureautique, archivage)