Xavier Bezerro

– In an era of rising energy costs, skills shortages, and strict data protection laws, I help Euroclear enterprises break free from legacy silos. As an experienced VCF Architect, I deliver a sovereign, consistent hybrid cloud that runs Tier-1 and containerised workloads (via Tanzu) with operational simplicity. By consolidating fragmented infrastructure onto VCF, I reduce opex, strengthen security, and enable global agility without compromising compliance or control. – Assessment & Discovery – Hybrid Cloud Design – Deployment & Modernisation – Stakeholder Engagement

– Deploy Saviynt IGA integrated with SAP ECC 6.0 and S/4HANA to automate user lifecycle, access certifications, role management, and compliance reporting. – Technical integration – Process automation – Compliance and reporting – Environment setup – Real-time bidirectional sync with SAP – Connectors for SAP ECC 6.0 EHP8 and S/4HANA 2020+ – Custom BAPI/RFC support for proprietary modules – Scale: 70,000+ users with 350+ attributes each – Throughput: 15,000+ daily access requests, <5s response

– Identity & Access Management (IAM) Architecture: – Security Engineering – Performance & Scalability – Security Implementation – DevOps & Automation – Translate business requirements to IAM architecture – Design multi-tenancy strategies (realms vs. separate instances) – Implement custom user federation patterns – Design disaster recovery and backup strategies – Extend Admin REST API with custom endpoints – Develop custom password policies and validators – Create webhook integrations for real-time events – Build custom admin console extensions

– Led strategy and implementation of IAM/PAM solutions, with a focus on forward-looking technologies including self-sovereign identity and AI-driven security. Developed tailored security concepts and navigated complex stakeholder environments to shape innovative IAM business models. – Drove DKV's corporate strategy and supported talent development, while delivering end-to-end IAM projects in highly regulated sectors (insurance, finance, healthcare). Managed technical teams and coordinated across IT, security, compliance, and business units to meet operational and regulatory standards. – Policy-based and role-based access control, authorisation models – Azure infrastructure build and expansion within Cloud Solutions – Full-cycle IAM delivery: SailPoint IIQ (implementation, JML, SoD, recertification, business roles) and OneIdentity Manager decommissioning – Hybrid and cloud IAM deployments (Azure, AWS, Microsoft 365, Saviynt, IBM Verify, directory services) – Integration with ERP/Service Management (SAP, ServiceNow) via REST, SCIM, SOAP – Delivered workshops, training, and clear documentation to support organisational adoption and ongoing optimisation of identity and authorisation structures.

– Led the end-to-end design and implementation of IAM pillars: IGA, AM, PAM, and AD Management. Developed the enterprise IAM architecture for the ECB, encompassing authentication, MFA, PBAC, RBAC, and self-service. Ensured regulatory compliance, improved visibility into user identities and access rights, and reduced unauthorised or high-risk access. Centrally managed AWS user credentials, permissions, and cross-account delegation, while enabling secure self-service capabilities. – Automated access provisioning, deprovisioning, and review workflows across users and applications. – Integrated IAM with enterprise directories via connectors and enabled entitlement management. – Enforced Segregation of Duties (SoD) to reduce fraud and operational risk. – Designed RBAC and PBAC policies using OPA and Rego, applying least privilege across AD, Azure AD, and AWS (S3, EC2, Lambda). – Enabled real-time monitoring and threat detection using secured API keys. – Developed reporting and analytics tools to support compliance audits. – Managed OPA policy lifecycle and automated IAM deployments with Ansible and Terraform. – Secured AWS services via S3 policies, Lambda VPC, EC2 settings, and CloudTrail logging. – Led IAM solutioning for major initiatives and RFPs, balancing security with business needs. – Acted as senior IAM advisor, defining governance frameworks and driving policy enhancements. – Architected scalable, cost-efficient cloud solutions with DR, HA, auto-scaling, and load balancing. – Oversaw Azure and AWS migrations, including lift-and-shift and disaster recovery. – Managed vSphere and vSAN environments, automating provisioning with vRealise/Aria. – Deployed NSX-T micro-segmentation and overlay networks for multi-tenant private clouds. – Supported hybrid cloud integrations with VMware on AWS and Azure VMware Solution. – Contributed to ITIL-aligned change management and capacity planning.

– Streamline the creation, management, and governance of user accounts, roles, and access rights across organisations. Enable secure, strategic provisioning and de-provisioning, lifecycle management, compliance, password control, access certifications, and risk insights. Centrally manage AWS access, credentials, and permissions across accounts, and support secure credential configuration. – Design, deploy, and maintain IAM, UAM, and IGA solutions across cloud and restricted environments, ensuring availability, security, and readiness. – Lead DevSecOps initiatives and collaborate with security, infrastructure, development, and service teams to translate client needs into robust technical solutions. – Conduct requirements analysis and develop tailored IGA architectures, including system integrations. – Advise on IT security strategies, architectures, and process implementation, with a focus on Azure AD, SailPoint, and One Identity. – Support cybersecurity assessments and awareness programmes. – Manage Kubernetes-based cloud systems and integrate cloud technologies within secure frameworks. – Provide expert guidance, training, and documentation on IGA topics, and mentor junior colleagues. – Shape IAM strategies, roadmaps, and role-based access models to enhance visibility and governance. – Streamline certification processes, ensure regulatory compliance, and reduce identity-related risks. – Drive operational efficiency and deliver projects end-to-end.

– Provided strategic direction and technical leadership in access provisioning and identity governance, with a focus on designing and implementing Policy-Based Access Control (PBAC) strategies. Managed secure access to AWS resources, including user credentials, permissions, and cross-account delegation. – Maintained and optimised the IAM platform's health and performance. – Designed, developed, and deployed IAM tools and onboarding processes for client applications. – Generated compliance reports for audit, SOX, and attestation purposes. – Defined user, business, and functional requirements; implemented custom and out-of-the-box workflows. – Scheduled and executed user entitlement reviews for applications and databases. – Configured custom Segregation of Duties (SOD) policies using rule-based logic. – Hands-on experience with PlainID, PingID, Microsoft Azure AD, Azure B2C, and Identity IQ. – Integrated IAM solutions with business applications, databases, middleware, and OS platforms (Windows, Linux). – Managed identity lifecycle (joiners/movers/leavers), RBAC, PBAC, and access certifications. – Developed automation for provisioning, de-provisioning, and access certification. – Built monitoring dashboards to assess IAM service health, effectiveness, and efficiency. – Designed and deployed security tools including SIEM, IDS/IPS, and EDR solutions. – Led vulnerability management, including scanner configuration and scan scheduling. – Conducted penetration testing and ethical hacking across client environments. – Oversaw threat detection, network security, and threat-hunting activities.

– Designing IAM involves structuring identity management to protect systems, data, and networks. This includes risk identification, defence implementation, and regulatory compliance. – Centrally manage users, credentials, and permissions across AWS accounts. – Enable delegated access and self-service credential configuration. – Promote security awareness through enrolment in relevant training.

– Lead the design and implementation of a comprehensive IAM strategy across Novartis Deutschland, covering all four IAM pillars to secure digital assets, close security gaps, and deliver a fault-tolerant, cloud-native unified identity platform. – Define and enforce authorisation policies for internal, third-party, and privileged users. – Centrally manage AWS access, including credentials, permissions, and cross-account delegation. – Implement and integrate authentication protocols (OAuth, LDAP, OpenID Connect). – Deploy RBAC and MFA (including OTPs) to strengthen access control. – Secure legacy and modern applications across hybrid infrastructures. – Centralise privileged account storage, define fine-grained permissions, and automate password rotation. – Establish custom approval workflows and time-bound privilege assignments. – Deploy session monitoring and auditing tools for compliance. – Integrate AD with cloud IdPs and PAM solutions; enforce RBAC over AD authentication. – Provision and configure cloud resources (VMs, storage, networking, databases) using IaC (Terraform, Ansible). – Automate deployment and configuration tasks to enhance scalability and reliability. – Apply security best practices and compliance frameworks (NIST, FIDO, etc.) to protect cloud data. – Lead cloud migration, DR, and HA initiatives to ensure business continuity.

– We are adopting IAM strategy that integrates all Microsoft IAM Security and DLP capabilities to protect Siemens AG Deutschlands digital assets, close security gaps, and establish a fault-tolerant, cloud-based unified identity platform. – Leading global DLP operations, including daily triage, incident response, and process improvement. – Defining and enforcing authorisation policies for internal, third-party, and privileged users. – Designing and maintaining enterprise cloud solutions (IaaS, PaaS, SaaS), with automation of workflows and policy management. – Providing technical leadership on data classification and DLP within Microsoft Purview. – Managing AD RMS and migrating to Azure RMS / Microsoft Information Protection. – Delivering end-to-end Purview and cloud architecture solutions. – Implementing centralised role management, RBAC, and multi-protocol authentication (including MFA, OAuth, SAML, OIDC). – Securing legacy and modern applications across hybrid infrastructures. – Applying security frameworks and compliance standards (e.g., NIST) to ensure confidentiality, integrity, and availability of cloud resources and data.

– Responsible for working within established methodologies to deliver a range of incident response services, including cyber incident management, proactive adversary hunting across internal and third-party networks, intrusion analysis (host and network), malware reverse engineering, digital forensics, and cyber threat intelligence. – Perform manual and automated vulnerability assessments and penetration testing (web, mobile, and API). – Support the full incident lifecycle – from identification to triage and containment. – Assist with engagement scoping and pre-sales activities, including workshops, solution design, and cost estimation. – Review and audit information security programmes, processes, and enterprise architectures (Active Directory, Windows, Azure AD, Linux/Unix). – Conduct network analysis, diagnostics, and intrusion detection reviews. – Ensure alignment between technical implementation and business processes. – Produce detailed reports in line with ANPL standards. – Contribute technical content for internal chapters and blog posts. – Develop and implement automation using BASH, Python, and PowerShell. – Support workload planning, forecasting, and certification tracking within the Azure Infrastructure Team.

– Provides daily global support and maintenance to ensures service uniformity, standards adherence, and consistent infrastructure delivery. Collaborates with external partners to provide high-quality services to both internal and external customers. – Drive architectural processes, including lifecycle management, design, build, and transition of new initiatives, with phase-gate reviews for stakeholders. – Maintain expertise in current and emerging IAM/IGA technologies, open system standards, and security risks relevant to Siemens' infrastructure. – Assume ownership of IAM infrastructure, project delivery, and security management. – Act as a senior mentor, guiding technical teams on IAM design, implementation, and availability. – Support regional application and infrastructure projects to ensure global consistency and reliability. – Gather requirements from customers and stakeholders to define roadmaps, support needs, and management frameworks. – Ensure third-party IAM integrations comply with Siemens' standards.