Xavier Cessac

• Maturity assessment on technological obsolescence, presentation to management, technical debt management, and implementation of remediation action plans. • Development of the Cybersecurity Master Plan (2026-2028) structured around 8 themes (Governance, Risks, IAM, Data Protection, Detection, Resilience, Awareness, and Vulnerabilities). • Alignment and compliance of the Information System with major European regulations (NIS2 Directive, Cyber Resilience Act). • Integration of CRA requirements into development cycles, including the requirement for Software Bill of Materials (SBOM) generation and vulnerability control (SCA/SAST). • Study of a CSPN (First-Level Security Certification) product certification approach. • Scoping of the privileged access security project (deployment of a PAM Bastion) and access rights cleanup across a hybrid environment (Active Directory / Azure).

• ISO 27001 Compliance: Led the implementation of the Information Security Management System (ISMS) to achieve ISO 27001 certification. • Conducted comprehensive risk assessments, defined the Information Security Policy (ISP), and developed the risk treatment plan. • Security Awareness: Managed and modernized the company-wide cybersecurity awareness program. • Organized phishing simulation campaigns, created engaging educational materials, and delivered security training sessions. • Technical Audit & Control: Performed and supervised technical security audits (configuration reviews, vulnerability scans) and organizational assessments. • Managed external penetration tests and tracked the implementation of remediation plans. • Project Security Integration: Embedded security into new projects from the ground up (Security by Design). • Defined security requirements, validated technical architectures, and provided expert guidance to business and IT teams. • Operational Security Management: Managed the relationship and performance of our MSSP partner providing Security Operations Center (SOC) services. • Defined SLAs and monitored detection/response KPIs to ensure service excellence. • Coordinated security incident response efforts and continuously improved detection rules.

• Implementation and achievement of ISO 27001 certification within the department's scope. • Implementation of a SIEM across the branch (technical selection and definition of use cases). • Centralization and operation of the postal network's security solutions (EDR, EPP, MTD). • Implementation of vulnerability management (detection, assessment, remediation, and monitoring). • Implementation and operation of Identity and Access Management (IAM). • Security awareness sessions (training, phishing campaigns, etc.). • Implementation of the SAFe (Scaled Agile Framework) methodology within the department. • Operational (tactical) implementation of strategic Group security directives. • Management of security monitoring and threat intelligence (CERT bulletins, Cybelangel, OSINT, CTI).

• Expert in penetration testing, technical and organizational audit. • Co lead for the Audit and Penetration team. • Penetration testing of multiples applications in different kind of environment (energy, bank, insurance, aeronautic, online gambling, ...) and from several type of access (internal, external, client-side) • Audit of multiples COTS (Cyberark, Plasnet) • Technical and organizational audit of multiples SWIFT infrastructures elements for a bank • Organizational audit for worldwide company affiliates based on internal policy and ISO 27002 good practices • Awareness about secured development and coding good practices for insurance company • CISO support for an online gambling company

• Realization of multiples IT security oriented missions.

• IT audit for TSRS branch.