Zineb BAJAJA

PROJECT RISK ANALYSIS: – Leading a team to strategize, implement and manage the overall SG CIB IT Security Risk Management program. – Establishing, implementing and managing cyber security program and initiatives – Managing overall SG CIB IT Security Systems, Operations, Assets, Security Risks, Vulnerability Management, Third party Risks, Cyber Regulatory Programs – Cross functional management of new technologies or services to ensure data Confidentiality, Integrity and Availability for the Business. – Functional lead actively ensuring Business Data as well as Personal Information (PII) secured physically, legally and only accessible via secure and authenticated channels – Leading overall information security risk assessments, risk mitigation, IT Risk governance with Group Risk Committee and Board Directors – Ensuring SG CIB compliance towards applicable laws, regulations, standards and policies. – Strategizing alignment of InfoSec processes with different teams across the organization, training and change management on InfoSec processes and policies. – Leading the automation of security gaps and business risk management via workflow and processes to follow them through the closure and ensuring the integration of Security By Design to all initiatives. – Managing Global business information security risks and security compliance exception across 100 countries. – Designing, delivering and management of periodic IT security trainings for all staffs to prepare them against common security malpractices and risks. – Working with various teams to ensure technical and operational Monitoring of IT systems (governance, business processes) on several projects (IAM, PAM, SSO, Cloud, API, business intelligence, machine learning, big data and IA) – Development and management of IT Security policies, procedures, standards and guidelines OUTSOURCING/OFFSHORING RISK ANALYSIS: – Leading Third party risk management towards cyber security requirements and standards – Third Party regulatory and auditor management to ensure regulatory ad security compliance and certification – Coordinating between SG and vendors to support Third party vendor risk management in various areas through questionnaires, Due Diligence, presentations, etc. – Delivering Executive Summary report with the audit teams based on the Third Party vendor findings and reviewing remediation reports from the vendor to resolve findings appropriately. – Defining and negotiating with vendors to include the relevant security clauses according to service risk profiles for outsourcing projects (SaaS/XaaS, support/maintenance, software, etc.) COMPLIANCE AND REGULATION : – Regulatory Compliance support (European Central Bank, GDPR, LPM, DSP2, MIFID, CIS Benchmark) and/or normative (ISO 27005, NIST, CIS benchmark, SOC, PCIDSS) of critical projects and applications FOLLOW-UP AND Monitoring : – Follow-up of strategic projects and digital transformation (IA, BIG DATA, CLOUD (Azure, AWS, IBM)) – Continuous improvement of the security requirements and the risk mitigations (Follow-up of vulnerabilities, security exceptions, penetration testing in progress, new systems, new applications, application decommissioning, etc.) – Leading Single Sign On authentication deployment, Access review, DOP reviews, to all internal and external systems – Leading CyberArk and Illumio deployment to all systems – Follow-up of vulnerabilities and security bypass process, mitigations, Action plans, KPIs and KRIS – Reporting and alerts to the concerned security officer (CISO) – Participating to committees (GO/NO GO and Risk committees, Design Authority, etc.) – Change management, Awareness and Training – POWER BI Dashboard follow up STRATEGIC DEGITAL TRANSFORMATION (ex: COMMERCBANK, BERINSTEIN, FORGE, etc.) : – PRE- Analysis evaluating each partner systems and processes to define the Risk profile of each – Identifying and assessing cyber risk across the Joint Venture operations – Defining a Clear RACI, SLAS, KPIs and KRIs for cyber performance and project management. – Developing and aligning cyber security policies with both JV goals and agreed standards. – Ensuring the compliance with regulatory requirements and Defining compliance programs – Regularly report cyber posture to top management. – Strategizing alignment of InfoSec processes with different teams across both organizations on InfoSec processes and policies. – Conducting cyber awareness training across JV personnel – Aligning cultural approaches to security with all stakeholders

– Designing, delivery and management of cyber security framework based on (NIST and ISO27001/2700 referential) and Defining cyber security requirements and procedures concerning the following subjects: – Management and governance of IAM/IAG identities – Access Management – Assets Management – Cloud Management – Vulnerability and patch management – Outsourcing/offshoring IT management – Crisis and resilience management – Security incident management – IT Systems Auditing – Security risks management – Regulatory compliance (NIST, GDPR, LPM, EBA) – Aligning work of the company via workshop animations with the CISO of entities – Actively participate with security specialized to be aware about current security challenges and solution to ensure cyber security framework evolution – Liaise with senior stakeholders to understand business and regulatory constraints – Participating to the homogenization of guidelines and risk management requirements – Liaise with people on the ground to understand current policies, risks and conduct gap analysis – Elaboration of compliance indicators: KRIs and KPIs to monitor IT Security Risk – Ensure assistance to entities and functions of the company in terms of security requirements application and specification in their perimeters – Compliance follow up with CISO from different entities over 100 countries

Managing projects for the following clients : TOTAL/ AIRBUS / ALLIANZ EN FRANCE / BOUYGUES TELECOM / MANPOWER / AIRFRANCE / RAMSY GENERAL DE SANTE/ ADP HR/GSF/ BONDUELLE/ UIC/ESSEC / BAINS DE MER MONTE CARLO – Team leading to ensure SSO, IAM, IAM SaaS, MDM projects deployment – Analysis of the existing and needs assessments – Follow-up of solutions and define authentication modes – Enabling Single Sign on and MFA for applications using different authentication protocols SAML, Oauth, etc. – Vendor selection: needs, specifications, answer grid, prepare evaluation grids for the results analysis – Conducting PoCs with vendor to drive the success rate and provide recommendations to clients – Working with shortlisted vendors to map their ability to comply with client requirements and constraints – Comparison and recommendation of solutions. – Make financial analysis of the short-listed solutions – Integration of best fit solution – Connecting client legacy application to IAM, SSO or/& MFA – Assist Migration procedures (Give Pre, while and Post migration recommendations) – Defining profile dictionary, rights (RBAC templates) – Redesign roles with least privilege access and need to know – Defining toxic combination and segregation of duties (Chinese wall) – Give assistance concerning the deployment of selected solutions (Project management) – Regularly reviewing access and roles – Conducting Change management – Main tools: SAILPOINT, RSA, OKTA, PING identity, ILEX, One Identity (DELL), CyberArk, SUN IDM (Oracle)

In the context of fusion of two Organizations of BOLLORE Group, the Entreprise Architecture and urbanization department, intend to secure its modeling platform based on MEGA HOPEX socle and chart the future and existing processes in accordance with ITIL, BPMN2 and ISO 2700x standards, in order to give assistance and improve business transformation. – IT Governance and users rights management – Collect and analyze security needs: ISP, risk mapping, Access control matrix – Prepare Functional specifications – Configure and develop access units and users rights management – Managing users onboarding/off boarding and users movements – Process the acceptance phase, project deployment among users and account auditing, licensing, audit... – Strategy and IT governance – Elaboration of IT cartography – Modeling and urbanization (Enterprise Architecture for the main business processes BPM2 and TOGAF) – Pre and post fusion analysis. – Value chain for key processes

– Designing, Developing and delivery of J2EE application to centralize identity and access management