Vincent Fély

Groupe BPCE is a major French banking group formed by the 2009 merger of two major retail banking groups, Groupe Caisse d'Épargne and Groupe Banque Populaire. As BPCE API Security Program Lead, my responsibilities ranges from Risk & Compliance Management to Infrastructure & Application Security. - Identify & assess potential security risks associated with Open Banking. ISO 27005 Risk Manager certified. - Design & implement security policies to ensure compliance with industry standards and regulatory requirements (OWASP API, GDPR, PCI-DSS). ISO 27001 Lead Implementer certified. - Regular speaker as BPCE API Security Program Lead. Co-founded the “API Security Work Group” at Campus Cyber, gathering dozens of information security experts from banking and insurance industries.

DBS Bank is the largest bank in Southeast Asia. I joined DBS Cybersecurity team in 2020 to help build the Threat Intelligence team and enhance Cybersecurity department software engineering capabilities. Key responsibilities: - Help stakeholders define their TI requirements. Collection, analysis and dissemination of Threat Intelligence reports. - Develop a large set of tools (Jupyter Notebooks, APIs, Dashboards). Responsible for the infrastructure budget and maintenance. Main achievements : - Designed, developed and deployed a Risk-Based Vulnerability Management API that helped the Bank re-prioritize 40% of its patching effort.

Orange Cyberdefense is the Orange Group’s expert cyber security business unit, providing Managed Security (MSSP), Managed Detection and Reaction (MDR) and Threat Intelligence services to organizations around the globe. As part of the Computer Emergency Reponse Team, I have worked in a follow-the-sun shift model with Paris and Montréal analysts to deliver a 24/7/365 incident response service. Key responsibilities : - Analyse security events from internal and external sources to identify and remediate phishing threats. - Conduct in-depth sectoral studies and investigation on cybercrime for customers (C-levels and security analysts). - Contribute to the research and development of innovative threat intelligence and incident response solutions. Main achievement : - Built an email analysis platform that reduced manual processing of malware and phishing cases by 50%.

Orange, formerly France Télécom, is a French multinational telecommunications corporation. As part of the Orange Innovation, Marketing and Technology Security Team, I have worked with Orange Labs team to analyse and automatically reduce the risk involved in using IoT devices in an Information System. Key responsibilities : - Perform risk analysis on IoT devices using EBIOS (Expression of Needs and Identification of Security Objectives). - Conduct a study about state-of-the-art algorithms for risk data vizualisation. - Ensure the effectiveness of countermeasures using Alloy specification language. Main achievements : - Fully automated the whole process, from the data collection to the data visualization using Python with pandas, numpy and matplotlib. - In my spare time, got involved in the Security Watch team, redacted IoT security newsletters for Orange executives.

The GRIF brings together researchers of the Université de Sherbrooke working in fields related to the theoretical aspects of computer science. The expertise of the GRIF includes algorithms, bioinformatics, formal methods, quantum computing and automata theory. As part of a research partnership between XLIM (University of Limoges) and GRIF (University of Sherbrooke), I have performed research about vulnerability test generation on the bytecode verifier of Java Card. Key responsibilities : - Conduct a study on state-of-the-art methodologies for model-based vulnerability testing - Produce research reports and participate in scientific popularization workshops. Main achievements : - Extended the bytecode instruction coverage from sequential to iterative instructions using B method. - Built a software to automate vulnerability test cases generation using Python and ProB model-checker.

- Training, hosting, SEO - Development of Wordpress themes and plugins - Monitoring and incident response