Abdoulaye Aw

• Integration of security into Projects (Security by Design) for internally hosted or Cloud applications

• Security support for projects related to artificial intelligence (Github Copilot, creation of business chatbot assistants)

• Performance of risk analyses based on ISO 27005 standards

• Analysis of DAT (Technical and Functional Architecture Document, HLD, LLD, flow matrix)

• Evaluation of vendor Pentest reports with the Pentest team

• Collaboration with technical teams to integrate internal security solutions (SIEM, bastion, firewall, SSO, etc.)

• Evaluation of vendor questionnaires (analysis of responses and evidence, evaluation)

• Project and evolution assistance: support and monitoring of action plans

• Assistance in project contracting

• Monitoring and comparison of Security Assurance plans, contractual clauses

• Drafting of Governance documents (ISSP, IT charters, user guides, etc.)

• Integration of GDPR, DORA, IA Act requirements into the risk assessment form

• Awareness of stakeholders (Management, Business Units) regarding cyber risks and threats

Responsibilities

- Risk analysis based on ISO 27005, EBIOS, NIST standards

- Security support for projects related to artificial intelligence (Copilot, GCP, creation of business chatbot assistants)

- Application of GDPR, DORA, IA Act, NIS 2 regulations

- Awareness of stakeholders (Management, Business Units) regarding cyber risks and threats

- Analysis of vendor pentest reports

- Collaboration with technical teams to integrate internal security solutions (SIEM, bastion, firewall, SSO, etc.)

- Evaluation of vendor questionnaires (analysis of responses and evidence, evaluation)

- Project and evolution assistance: support and monitoring of remediation plans

- Assistance in project contracting (Monitoring and comparison of Security Assurance plans, contractual clauses)

- Drafting of Governance documents (Information System Security Policy, IT charters, user guides, etc.)

- Acting as a reference for information protection technologies;

- Monitoring of exceptions

- Publication of articles

Technical Environment

- Deployment of tools (Crowdstrike EDR, software versioning, ...)

- Deployment of HSM KMS (Google)

- Generative AI (internal chatbot, augmented developer, ...)

- API Security (Apigee)

- Mainframe z OS Security

Operational Environment

- Office 365 Suite (Outlook, Excel, Powerpoint)

- Collaboration Tools (Microsoft Teams, Planner)

- Internal application referencing tool (Atlas)

- ServiceNow, JIRA

- Confluence

Context

Within the SSI team, I am responsible for providing SSI assistance services entrusted by the operational manager. My main activity consisted of providing technical expertise through risk analyses of third-party projects and Cloud infrastructure.

Responsibilities

- Performance of third-party risk analyses (Cloud providers, Insurance Delegates...)

- Project and evolution assistance: support and monitoring of remediation plans

- Assistance in Cloud project contracting (PAS monitoring, amendments)

- Community animation

Deliverables

- Risk analysis documents

- Project validations

- Vendor questionnaire responses

- Security Assurance Plans

- Amendments

Functional Environment

- Risk analysis in EBIOS format

Operational Environment

- Office 365 Suite (Outlook, Excel, Powerpoint)

- Collaboration Tools (Microsoft Teams)

Technical Environment

- EGERIE for risk analyses

- ADO IT for project information (infrastructure, project code, etc.)

- Archer RSA for monitoring Group Level risk analyses