Pierre Fayolle

1. Project to obtain a Banking License:

Diagnosis and planning: Identification of gaps with ECB requirements, scoping and retroplanning.

Project management: 2-year management with regular reporting to sponsors (Global CISO, CIO, COO).

Key workshops: Outsourcing of logs (business/infra) to a SIEM, Immutable backup, implementation of an ISP process, deployment of a WAF, management of unique IDs for Ayvens employees, encryption of data at rest/in transit.

2. WAF Management

Explanation and support for internet-facing application managers for registration, certificate installation and DNS modification. Facilitation of monthly committees with local CISOs to monitor assets (protected apps, expired certificates). Implementation of on-prem FW rules restricting access to the WAF IP range. Creation of a public/private IP mapping to identify uncovered apps. Migration to a new generation WAF.

3. Compliance of Accounting Applications:

Monitoring and reporting: Management of the compliance of 35 Ayvens WW accounting applications. Reporting to Senior Management (SocGen and Ayvens) and validation of Risk Acceptance Forms by the CFO in case of discrepancies.

Support: Organization of workshops with application owners/managers to present security measures and support them in their implementation.

4. Data Loss Prevention (DLP):

DLP Management: Management of tools (mail, web, endpoints). Level 2 alert processing after escalation to the Global CISO for headquarters.

Projects: Version upgrade, web DLP implementation with infra teams, facilitation of monthly committees with CISOs to present the backlog and track actions.

Global impact: Align Ayvens WW security and compliance with regulatory and strategic standards.

Audit Security Integration in Projects, IT continuity and BIA Audit, risk analysis (EBIOS RM), Cyber risk awareness, security policy writing, team management,

▪ Responsible for compliance with BNPP Group rules on IT continuity

▪ ICO of the BNPP treasury entity and entities in charge of cross-functional functions

▪ PMO for the implementation of recommendations following audits by the EBE (European Banking Authority) and the General Inspection

of the Group

▪ PMO for a "recovery from scratch" project deployed on the most critical IT assets of an entity

▪ During the projects of the entities for which I was responsible, I was responsible for implementing a continuity architecture allowing to

meet the needs expressed by the business

▪ Organization and coordination of datacenter failover tests in Madrid and Paris

▪ IT Continuity team interface with audits (CaC, IG and permanent internal control)

▪ Monitoring and consolidation of the requirements of the main global regulators (ECB, MAS, HKMA, FDIC) on IT continuity