Guillaume Morillon

Cybersecurity initially seemed like an obscure and complex subject. Being curious by nature, I wanted to understand its various aspects. I began to take an interest in it by focusing on the technical side towards the end of my studies in 2012. Understanding and mastering the methods and tools used to launch cyberattacks should allow me to deduce the measures to protect against them. After a work-study network engineering degree, a lot of monitoring and training on the subject, as well as technical training, I defined a list of measures and participated in implementing them within the information system of a large international group (now considered vital). This significantly improved the cybersecurity level of the perimeter. I quickly realized that without follow-up, purely technical security measures were very quickly bypassed, forgotten, or obsolete. I then became interested in organizational methods to maintain and improve an organization's cybersecurity level. The ISO 27001 standard seemed to address this issue correctly by proposing the creation and implementation of processes, procedures, indicators, etc. for the security management system in a continuous improvement approach. I therefore obtained the ISO 27001 Implementer/Lead Implementer certification in 2019. Since then, I have implemented this standard in various contexts and have had to work on other demanding frameworks (LPM and RGS, for example). In the course of these missions, I have had to communicate, raise awareness, gain acceptance, implement, etc. And this, with many different stakeholders, ranging from operational staff to directors. I participated in the development of risk analyses using the "EBIOS RM" and "ISO 27005" methods.