Mustapha Baddou

—> Definition and deployment of the TRM (Technology Risk & Management) program for all BPCE SA entities (~30 entities) - Group's Cyber and IT risk management model

—> Facilitation of committees and coordination: Preparation and facilitation of security steering meetings

—> IS Security Policy: Derivation of the security policy, definition of needs, and implementation of appropriate procedures.

—> Risk and Incident Analysis: Identification of threats, impact assessment, and proposal of corrective solutions.

—> Risk Mapping: Updating, dissemination, and monitoring of IS risk mapping, presentation of risk maps to BPCE SA's CDG-1

—> Project Support: Integration of security requirements into new projects and products.

—> Cyber Crisis and Alert Management: RITM monitoring and resolution of security incidents.

—> Consulting and Awareness: Training and support for employees and managers on cybersecurity issues.

—> Controls and Audits: Development of control plans and participation in IS security audits,

—> Management of cybersecurity projects (administration bastion, network segmentation, log centralization, Azure Cloud security).

—> Deployment of protection solutions (OME for email encryption, DLP for data leak prevention)

—> Management of security incidents (phishing, malware, intrusions) and coordination of remediation plans.

—> Analysis of technical and business risks (ASA, ARA, flows, application projects, user needs).

—> Evaluation of application security (review, testing, compliance) and GDPR support.

—> Contribution to security qualification/validation activities for applications and monitoring/remediation of vulnerabilities on the Azure environment and critical applications.

—> Participation in the NIST-based monitoring program (control, audit, and compliance)

—> User awareness and regular reporting to the CISO,

—> Integration of security into projects (ISP) for France Télévisions.

—> CISO support (incident management, access requests, IS security committee…)

—> Security support for all projects (IT Department, Digital, Media Factory, CDE).

—> Drafting security requirements in projects according to security needs

—> Integration of security into contracts with technical or business suppliers

—> Analysis and evaluation of proposals from technical or business suppliers.

—> Security analysis of SaaS/non-SaaS applications (EBIOS RM).

—> Management and monitoring of an LPM security approval mission (audiovisual sector: Broadcasting and Exchange Center)

—> Identification and monitoring of operational committees, budget management

—>Detailed requirements related to LPM rules

Validation of the technical solutions' compliance, security analysis according to needs,