Sofiene Daoud

Senior GRC Consultant – ISO 27001:2022 Program (major construction group, multi-entities)

• Construction / recovery and structuring of the ISMS: policies, procedures, standards, registers, matrices, dashboards.

• Risk Management (ISO 27005 / EBIOS RM depending on context): workshops, risk register, treatment plans, prioritization.

• Derivation of ISO 27002 into auditable requirements: IAM/access controls, hardening, logging, vulnerabilities/patching, backup & restore, change management, workstation/server/network security, secure development.

• Operational management: RACI, committee, RAID monitoring, reporting, coordination of IT/CISO/Infra/SOC/application teams.

• Audit preparation (internal/external): evidence consolidation, traceability, compliance, and continuous improvement.

Information Security Officer, Governance & Cybersecurity @ Geodis SCO (2023 - 25)

Cybersecurity Governance, Implementation of the group security strategy, Compliance with security directives, Vulnerability management and monitoring, Application security, Integration of security in projects, Vendor management.

Senior Consultant, Compliance @ eXalt Shelid

Internal DORA compliance referent, Creation of training content, Conducting training sessions for consultants on topics such as cybersecurity awareness, Risk Management, and DORA regulatory compliance.

Main Missions:

Writing typical deliverables for the Cyber-Strategy offering, Cybersecurity watch, Contribution to tender responses, Mentoring junior profiles, Organizing and leading sharing sessions within the community.

ISMS implementation, ISO2700 Certification compliance, ITIL maturity assessment, IT Risk Management program implementation, SI governance diagnosis (ITSM-ITIL).

Cyber Resilience strategy development, Disaster Recovery Plan development, Documentation of NIST controls and assessment processes, IT Compliance and regulatory compliance, Operational security hardening.

Business Continuity Plan development, Risk management and Business Impact Analysis, Business continuity strategy development and deployment.

Update of operational risk mapping, Risk assessment, Development of an audit plan for risk treatment.

Update of the risk management program, Improvement of subsidiary security in line with group security strategy.