Romain P.

DLP expert in an environment fully hosted on Microsoft Azure, as a **consultant for Exalt**. For this assignment, I was responsible for covering data leakage risks on user terminals (Professional computers and BYOD), through various topics:

-DLP - Netskope:Implementation of DLP rules and exception management, deployment of Netskope Cloud Firewall, monitoring of blocked uploads/downloads, publication of private applications via Netskope Publisher

-SIEM - Microsoft Sentinel:Forensic investigation of incidents and implementation of alerts using KQL queries

-Microsoft Defender:Monitoring and detection of spoofing and phishing attempts, monitoring of vulnerabilities on professional terminals (computers and phones)

-Zero Trust - Microsoft Entra:Implementation of conditional access rules for better control and security of access within the organization

-Microsoft EASM:Monitoring of tenant-opened URLs and remediation of associated risks

Following an audit recommendation, Allianz Partners had to carry out a risk assessment of all its IT service providers. For this project, I was responsible for organizing and monitoring the risk level evolution of all concerned partners (280 IT partners worldwide), from their evaluation to the validation of remediation actions, as a **consultant for Exalt**.

- Compilation and management of a questionnaire covering a wide range of cybersecurity controls, referencing various standards (ISO27001, COBIT, CCM, CAIQ, etc.)

- Analysis of service providers' responses to the questionnaire and validation or non-validation of provided due diligence evidence, calculation of arisk level**, and presentation of a report to the service provider mentioning **conclusions and recommended remediation actions

-Integration of security in projects(Security by Design)

- Facilitation of project steering committees

-International context- More than 30 Business Units involved across as many countries

Cybersecurity project manager on 4 compliance projects covering different NIST themes, as a consultant for Headmind Partners. For this assignment, I had to assemble a team of Cardif experts for each project, manage committees, budget, and planning, and validate the various validation points of the V-cycle.

Project 1 - Data Security: Deployment of a set of data security solutions (IBM Guardium, Varonis, Vormetric VTE, Oracle TDE, Thales CipherTrust, Microsoft AIP) internationally (EMEA, APAC, LatAm) ° Study of existing data security tools in all regions ° Configuration of data discovery tools (DLP), automatic classification... ° Definition of a deployment strategy for tools across different regions and Target Operating Model ° Definition of the deployment schedule across all territories

Project 2 - Privilege Access Management: Monitoring the deployment of the CyberArk PAM solution (Access Control) ° Definition of authorization matrices according to an R-BAC model ° PSM technical user support ° Responsible for managing Business Profiles and assigning rights

Project 3 - Logging & Detection: Deployment of a log collection infrastructure as part of setting up a SIEM for the Europe region (Elastic Stack solution): ° Design of the log collection architecture ° Definition of RACI to ensure operational maintenance ° Choice of solution for monitoring the log collection infrastructure

Project 4 - Application Security: Deployment of Fortify (SAST) and Sonatype (SCA) solutions for security scans on application code: ° Implementation of a vulnerability scanning tool service offering for all Cardif entities Group ° Deployment of tools on a platform managed by the Group ° POC management on a test application