Walter Rocchi

• Successfully conducted risk assessments and strategy development to ensure projects' alignment with GDPR, ISO 27001, and ISO 22301 compliance standards, relevant to gain certification audits • Internal Auditor for ISO 27001, ISO 22301.

• Proactive Threat Mitigation: leading STRIDE-based threat modelling sessions for diverse product architectures, interfaces, and data flows, involving meticulously documenting identified threats, potential attack vectors, and vulnerabilities in formal reports, complete with CVSS scoring to prioritize remediation efforts. Identify, evaluate, and propose new technological solutions to improve employee productivity and well-being. • Conduct benchmarking analyses on emerging collaboration tools and methodologies. • In charge of design and coordinate pilot projects to test new solutions within AI and burnout. • I was part of a team for MCP design and workflows implementation creation and assessment to generate diverse, representative datasets covering a wide range of entities and scenarios relevant to MCP server use cases, applying coverage metrics such as unseen entity ratio and entity-null rate to quantify dataset comprehensiveness and guide expansions. • ROI and organizational impact of newly introduced technologies. • Regulatory Compliance & Risk Management: aligning product development with critical industry standards, including ISO 14971, FDA 21 CFR 820.30(g), and applicable SOPs. Supported Risk Benefit Analysis (RBA) alongside regulatory, safety, and business stakeholders, and consistently derive cybersecurity requirements based on guidelines like FDA Premarket Guidance and MDR. • Applying defence-in-depth principles, with a strong emphasis on zero trust and least privilege methodologies. Conducted hands-on SAST/DAST (Static/Dynamic Application Security Testing) and analysed results to pinpoint vulnerabilities. Perform and support SCA (Software Composition Analysis) to identify and manage SBOM (Software Bill of Materials) vulnerabilities. • Cross-Functional Collaboration & Documentation: Collaborating with diverse stakeholders, including Product Owners, Software Architects, Privacy, Regulatory, Product Security Office (PSO), and Safety teams. Actively supported the preparation of comprehensive cybersecurity documentation crucial for regulatory submissions (e.g., NMPA, MDR, FDA MDS2), ensuring clear communication and alignment across all key activities in the SPDLC. • Served as a DR Manager (ISO 22301 BCMS) for a 6-month project focused on enhancing the organization's disaster recovery capabilities. In charge for both project deliverables—such as creating DR architecture and governance frameworks—and ongoing operational duties, including planning and executing DR tests, updating documentation, and managing technical recoveries.

The goal was to completely rewrite Risk Management and Policies and Procedures • Oversaw the revision of governance standards, ensuring adherence to ISO 27001 and applicable risk assessment strategies, while leading a dedicated team of 10 personnel. • Conducted thorough evaluations of NIS 2 and DORA frameworks, contributing to improved data governance and regulatory adherence in line with enterprise risk management standards, including KRI and KPI Definitions • Led a comprehensive overhaul of risk management processes by integrating NIST, COBIT, and CIS V8 standards, focusing on compliance and advanced cyber security strategies. • Developed and managed comprehensive compliance strategies, conducting detailed audits that ensured adherence to ISO/IEC 27001, enhancing overall governance standards by 20%. • Responsible for developing, managing and overseeing compliance activities, conducting audits, maintaining and reviewing vendor qualifications and assessments; and providing guidance to cross-functional teams • Led strategic discussions with the steering committee to propel organisation-wide security initiatives, enhancing compliance with ISO 27001 standards by 15%. • Directed a specialised team in conducting thorough audits and revisions of contracts to ensure compliance with ISO 27001, GDPR, and national law requirements, resulting in a 20% improvement in enterprise governance frameworks.

Skills: ISO Standards · NIST · GRC · Risk Management

Ethical Hacker e Security Manager CompTia training

Skills: ISO Standards · NIST · GRC · Risk Management

Responsible for all aspects of risk analysis, operations activities, and technical / IT programme review • Appointed as IT Security Advisor, providing Subject Matter Expertise (SME) on IT security compliance • Leading stakeholder support, risks, gap analysis, remediation, team leading, and awareness activities • Full remit for end-to-end programme and project delivery, including project planning, scope and risks • Reviewing internal / external applications of operational risk design, complying with all security policies • Enforce highest standard and industry best practices, including implementing EU GDPR & ISO 27001 • Championed planning & conducting of audits, whilst also documenting higher-level compliance status

• Successfully established the whole Security activities utilizing Scrum Methodology • Responsible for the whole Security (Compliance, Regulations, Assurance program, Big Data, Cloud – CSA, CCM on AWS; GCP, Azure -, Containerization, Virtualization and SLDC Framework - against CERT, CWE, Android/Apple Secure coding, OWASP Code Review,) • Implemented Security frameworks (ISO 27001, NIST) and Risk Management • Threat modeling including STRIDE • Responsible for IoT / OT • Infrastructure Security and Technology Governance

Responsible for all aspects of project leadership, security expertise & provision of mission-critical IT • Led a comprehensive programme for assessing & deploying all applications for operational risk design • Utilised best practice methods for projects related to satellites / space system relevant to organisation • Drove audits & adoption of various frameworks, including Tempest, ISO 27001, NIST, ENISA, GDPR • Facilitated completion of essential tasks across function, leading risk management and gap analysis

Responsible for all aspects of capability assessments, strategy alignment, and service restructuring • Championed stakeholder support to ensure the effectiveness of data breached prevention procedures • Performed all comprehensive risk assessment, gap analysis, remediation, and awareness activities • Oversaw the analysis of internal and external applications for all operational risk design programmes • Enforced compliance with security policies, standards, and industry best practices (GDPR, ISO 27001) • Spearheaded efficient development & conduction of audits, ensuring alignment with compliance status

Responsible for risk management, project delivery, realising process & performance improvements • Spearheaded all stakeholder presentations, KPI / risk assessments and new gap analysis activities • Acted as point of contact to executive leadership for championing remediation of information protocols • Enforced security controls according to Deutsche Bank risk management tools (in line with ISO 31000) • Deployed cryptographic solution to internal / external vendors by applying highest security standards • Provided security guidance to engineering / operations partners to meet information security guidelines • Presented updates to functions and senior management through established communication channels • Reduced security risks by leveraging controls and minimising all weaknesses in infrastructure portfolio • Instrumental to consistently reducing likelihood of potential audit findings, regulatory & legal liabilities • Supported applications with MFA (Multi Factor Authentication) engaging regional / global risk teams • Reviewed and reengineered key controls / processes to effectively and efficiently manage IS issues • Defined and monitored security violations, determining most effective resolutions for security policies • Ensured stakeholders understood personal / individual remit regarding risk mitigation and remediation • Collaborated with IT Teams to ensure IT systems managed, operated and designed to minimise risk • Escalated all significant risks to the Regional / Sector / Global IS Leadership for information or action

I was acting as an External Project Manager on consultancy for supporting auditing activities for PCI DSS certification customers, Scope & Gap analysis activities compared to the PCI DSS standard, development and consulting for remediation \ de-scoping plans, IT security auditing Financial Institutions, including planning activities and meeting with Top Management. I am able to interact with the end customer, support auditing activities carried out by a QSA, carry out field and gap analysis activities over the PCI DSS standard, IT security auditing and interfacing with other team leaders. I am using careful attention to detail, accuracy, professionalism, availability to group work and ability to cope with stressful situations. I am in charge of support conduct of on-site audits for QSA-level 1 Service Provider / Merchant, provide advice to customers who undertake the certification path for Scope Definition and / or Gap Analysis activities - Provide advice to customers on the formal compilation of Self-Assessment Questionnaire (SAQ) - Develop remediation / de-scoping scenarios - IT Security Audit and EU-GDPR and Data Loss Prevention / Retention activities

Write Documentations, Policies, Guidelines and Key-Operating procedures Define Perform Risk-Analysis of current and emerging threats Project Management, Business Analysis, Operations, Risk Assessments, Change Management, Continuous Process Improvement. Delivery of Operational Risk methodologies, Business Continuity, Disaster Recovery and Crisis Management programme Define Support production problem solving Definition and maintenance of the CERT processes, including coordination of the process interfaces with the customer. Implement all guidelines and controls for the relevant processes to ensure compliance and quality. Collect, interpret and respond to changes in production data. Provide regular and reliable reporting of relevant data to meet management requirements. Engage with other service management groups to understand business requirements Define, collect, analyze and produce metrics on process data for KPIs Identify risks and issues related to the area. Coordinate the measures to eliminate the identified risks Provide governance to ensure appropriate planning and reporting

GRC and Business Continuity Management IT Security Policy Writing and Updating according to BCM Evaluating security technologies and solutions Ensuring alignment of security technologies used across the bank Acting as interface to the Enterprise Architects Promoting security awareness and educate people at all levels Identifying points of architectural risk in new projects using architectural threat risk assessment and threat modelling techniques. Responsible for secure design of various applications within the bank using security design patterns that confirm to the bank’s security policies, standards, procedures and guidelines using a risk-based compliance approach. Assisting in the design decisions proposed by the various design authorities to meet broader organizational security objectives. Review security design decisions which need to be taken through the development of a target operating model; or as a result of on-going change initiatives. Enforcing compliance of the bank security programs polices, standards, and procedures as relate to each project

Planning and producing the IT elements of the overall annual risk-based Internal Audit Plan aligned to corporate objectives. Conduct IT risk assessments as part of the regular review of the Internal Audit Universe / Integrated Assurance Map. Conduct end-to-end auditing including: open / planning meetings; preparation of scopes of review and technical work programs; audit fieldwork; audit close meetings and writing up audit reports. Business Continuity Management Crisis Management Technical Management Delivering Management IT Audit Management Data Protection Management PCI-DSS Management IT Risk Management. Design and deliver automated controls testing / continuous auditing through the use of data interrogation software i.e. ACL. Provide ACL support and guidance to the Financial/Operational based auditors. Assist with specialist IT co-sourcing arrangements and / or supervise any temporary IT resource when required. Provide independent assurance to Senior IT Management as regards the delivery of the IT Strategy. Regularly communicate with Senior Management on IT process and control deficiencies, proposed corrective actions and other value added recommendations (including cost reduction / efficiencies). In parallel delivering consultancies, Project Management and Team leading (Agile) in various small consultancies firms as Project Manager for Web Apps related projects which require a good knowledge of Python, PHP, Ruby, AngularJS, Clojure and AWS (Amazon Web Services), Continuous Improvement (Ansible, Chef), JSON Configuration Management (Bower, Pak) and containerization tools as Vagrant, Packer, Docker, Flockport, Panamax. Security Code Review according to the OSWAP Guidelines.

Business Continuity Management Crisis Management ISO 27001 compliance. Security Code Review (Agile OWASP) Security Guidelines Plan and develop new IT solutions their customer base IT Audit Management (specifically on VMware, SAP, CI) Vulnerability Assessment Penetration Testing (White Hat) Data Protection Management PCI-DSS Management Pre-sales activities (conducting demos, Q & A sessions and meetings) Asset and Data Management Monitoring (LANDesk, BMC Atrium (former Remedy) platform) on behalf of Accenture Defining business metrics and KPI for both internal and external customers. Server migrations from physical to virtualised environments (AWS, VMware) Linux and Windows systems, mainly from Win 2008/R2 to 2012.

Pre-Sales BCM Crisis Management Change Management Health & Safety Management for Data Centres IT Audit Management Vulnerability Assessment Penetration Testing (White / Grey Hat) Data Protection Management PCI-DSS Management Health & Safety Management for Data Centres Project Management SEPT. – DEC. 2012, Ministry of Justice - Paperless Civil Trials Project, 250 users JAN. 2011 – JUNE 2012 Ministry of Justice - Virtualized Environment Project , several thousand users; SEPT. 2009 – FEB. 2011 Ministry of Justice - Domain Rebuilding Project, 400 users; MAY – AUG. 2010 Ministry of Justice - Project Coordinator / Migrating physical location, 400 users; MARCH - JUNE 2008 Ministry of Justice - OS Switching - Desktop Migration Project, 400 users; Lead a team by training, coaching motivating and supporting professionals to reach personal, team and company goals, also by participating in training sessions as a faculty for fresher’s. New Disaster and Recovery Plan Policies implementation

Business Continuity Management, Crisis Management, Design Infrastructure Management, IT Service Management, Security Management, Knowledge Management and RFC’s.

IT System Admin (Windows, Unix, SAP) Business Continuity Management, Crisis Management, In charge for Department Financing and Control, IT Contract Management Dealing and liaising with 3rd party contractors (software and hardware reseller, telecommunications and storage firms), amending existing contract and creating new ones according to the business needs

User support and Application Service Management 24/7