Freelancer profile translated to English.
Back to original languageAbout Ana
I am Ana, a GRC Cybersecurity Consultant, certified CISSP, CISM, CISA, ISO 27001 Lead Implementer and Auditor, EBIOS Risk Manager, and PMP (project management).
I have carried out GRC-oriented missions such as CISO support, PCI DSS, ISO 27001, DORA, and GDPR compliance.
I have also conducted numerous risk analyses according to ISO 27005 and EBIOS RM.
🛡️ Information Security Governance (ISG) - CISO Assistance
- Assistance in defining and steering the Cybersecurity roadmap
- Drafting of Security Policy (PSSI), security procedures, and processes
- Assistance with DORA, PCI DSS, and ISO 27001 compliance
- Risk analysis and definition of the action plan
- Training CISOs on the EBIOS RM methodology
- Cybersecurity / GRC project management
- Creation of ISG awareness materials
- Preparation for cybersecurity audits
- Cybersecurity / IT security audits
- IT security / GRC management and steering
- GRC Consultant missions
📜 PCI DSS, ISO 27001, GDPR, DORA Compliance
- Support for establishing (BUILD) and maintaining compliance (RUN)
- Preparation for PCI DSS and ISO 27001 certification audits
- Controls for maintaining compliance with ISO 27001, PCI DSS, and GDPR
🌐 IT Risk Management and Analysis
- Perform risk analyses according to EBIOS RM / ISO 27005
- Integration of security into projects (ISP)
- Keep the cybersecurity risk map up to date
- Monitor the cybersecurity risk treatment plan
🌍 Third-Party Risk Management (TPRM)
- Definition of the supplier audit program
- Management of ICT service provider risks (DORA)
- Supplier audits according to PAS (Security Assurance Plan)
- Monitoring the implementation of audit recommendations by the supplier
📩 Contact me today to discuss your project!
French
Native or bilingual
English
Fluent
Remote only
Primarily works remotely
Experience
- Cyber-FlowGRC Cybersecurity ConsultantBANKING AND INSURANCEOctober 2024 - Today (1 year and 8 months)Paris, FranceDrafting Cybersecurity Documentation:🎯 Creation of Cybersecurity Policies (PSSI) and BCP/DRP🎯 Performing Risk Analyses (EBIOS Risk Manager / ISO 27005)🎯 Completion of Security Questionnaires / PAS (Security Assurance Plan)🎯 Definition of a roadmap adapted to the Business / Cybersecurity context🎯 Support on GRC (Governance, Risks, Compliance) aspects of CybersecurityStartup Support - GRC Cybersecurity Lead:🎯 Support on Cybersecurity issues (quick wins approach)🎯 Structuring the Security documentation foundation🎯 Completion of Security Questionnaires (strengthening responses to RFPs)🎯 Steering the Security roadmap🎯 Preparation for ISO 27001 certificationISO 27001 / ISMS Compliance:🎯 Definition of the ISO 27001 certification scope and ISMS framework🎯 Performing ISO 27001 audits and gap analyses against the standard🎯 Definition and monitoring of ISO 27001 compliance action plans🎯 Steering the BUILD phase up to certification achievement🎯 Internal training / awareness of teams on ISO 27001 requirements🎯 Performing security controls for certification maintenance (RUN)Risk Management - Cybersecurity Risk Mapping:🎯 Development and maintenance of the IT and Cybersecurity risk map🎯 Evaluation of risks related to Information System Security (ISS)🎯 Definition and monitoring of security remediation plans🎯 Consulting for business units on Cybersecurity risk management🎯 Acting as an interface between Cybersecurity Consultants and the CISO
- MAIFCybersecurity / GDPR Third-Party Audit Program ManagerBANKING AND INSURANCEJanuary 2025 - Today (1 year and 5 months)Paris, FranceDORA Compliance - Third-Party Risk Management (TPRM):🎯 Development and steering of the third-party risk management strategy🎯 Steering of the Cybersecurity / GDPR supplier audit program🎯 Coordination of Cybersecurity / GDPR audits🎯 Analysis of supplier risks🎯 Monitoring of corrective action plans🎯 Contribution to DORA regulatory compliance🎯 Awareness of business units on service Cybersecurity🎯 Management and monitoring of third-party Cybersecurity scores (Cybernotation tool)🎯 Implementation of committee governance related to third-party cybersecurity risks🎯 Reporting to the CISO and Risk Manager on third-party cybersecurity risks🎯 Transversal coordination between internal teams (CISO, ISG, DPO, Procurement, Business Units) on Security topics🎯 Optimization of cybersecurity risk management processes🎯 Steering and transversal communication on GRC-related topics
- Chequers CapitalGRC Cybersecurity ConsultantBANKING AND INSURANCENovember 2024 - February 2025 (3 months)Paris, FranceUpdating Security Documentation following a DORA Audit:🎯 Identification of DORA gaps🎯 Updating the PSSI according to cybersecurity best practices and DORA compliance🎯 Definition of a third-party control plan (TPRM)🎯 Updating the BCP and creating scenarios for the DRP🎯 Drafting of incident management and crisis management procedures🎯 Performing risk analysis using EBIOS RM, with CISO training🎯 Supporting the CISO on cybersecurity GRC aspects
Reviews
Recommendations
CD
These freelancer profiles also match your criteria
Agatha Frydrych
Backend Java Software Engineer
4.7
(3)
2
Baptiste Duhen
Fullstack developer
4.6
(4)
5
Amed Hamou
Senior Lead Developer
4
(2)
7
Audrey Champion
Web developer
4.3
(3)
4
Education
- Master's Degree in Digital CybersecurityINSA LyonCybersécurité / Sécurité informatique / RSSI / ISO 27001 / GRC / Management et cartographie des risques ISO 27005 et EBIOS RM / Gouvernance - Risques - Conformité GRC / Gestion de projets / Amélioration continue / Risk Management / Audit / Sécurité / Sensibilisation / Informatique / Pentest / Cybersecurity Consultant / Assistance RSSI / PSSI / PCA et PRA / Questionnaire Sécurité / Protection des données (RGPD) / Cloud et Sécurité / Consultant GRC / Sécurité des infrastructures / Audit Sécurité
- Master's in Information Systems Risk ManagementUniversity of PoitiersCybersécurité / Sécurité informatique / RSSI / ISO 27001 / GRC / Management et cartographie des risques ISO 27005 et EBIOS RM / Gouvernance - Risques - Conformité GRC / Gestion de projets / Amélioration continue / Risk Management / Audit / Sécurité / Sensibilisation / Informatique / Cybersecurity Consultant / Assistance RSSI / PSSI / PCA et PRA / Questionnaire Sécurité