Gaëtan Fernandes

Led the update of the IS risk map, integrating the specifics of about twenty business lines and facilitating collaborative workshops with stakeholders. Adapted the mapping methodology based on ISO 27001 and the Group's methodology. Implemented an approach focused on risks associated with business processes, supported by automated calculations of risk impacts and probabilities of occurrence. Particular focus was placed on formalizing the remediation plan, its prioritization, and its follow-up, to ensure effective and sustainable risk management in a complex and highly interconnected environment. The mapping and its remediation plan incorporate the challenges associated with new regulations (Cyber Resilience Act, AI Act, NIS2...).

Led the update of the IS risk map, integrating the specifics of about twenty business lines and facilitating collaborative workshops with stakeholders. Adapted the mapping methodology based on ISO 27001 and the Group's methodology. Implemented an approach focused on risks associated with business processes, supported by automated calculations of risk impacts and probabilities of occurrence. Particular focus was placed on formalizing the remediation plan, its prioritization, and its follow-up, to ensure effective and sustainable risk management in a complex and highly interconnected environment. The mapping and its remediation plan incorporate the challenges associated with new regulations (Cyber Resilience Act, AI Act, NIS2...).

Within a Nantes-based startup handling sensitive personal data, provided support as an IS Security expert (definition and implementation of a BCP/DRP, deployment of a phishing reporting solution, deployment of an IS Security and GDPR training/awareness solution, pre-sales support...) and as an outsourced DPO (register updates, project support, awareness campaigns, DPIA execution...).

Project Manager – Cyber maturity audit, IS action plan, and scoping of the IS documentation strategy.

Conducted a cyber maturity audit of the central IT department and 6 co-supervised entities, based on the France Relance cyber analysis methodology. Formalized an IS action plan based on the maturity audit and penetration tests conducted by the firm. Assessed the existing IS documentation and identified documentation needs by level (strategies, policies, operational sheets) and by scope.