Vincent Draghi

Managed a cybersecurity risk portfolio for an asset management company of €50M+ across various business departments.

Assessed risks for diverse projects including: ML, MCP, AI Agents, blockchain using the ISO 27005/EBIOS RM methodology, helping the project team identify and reduce 95% of High/Critical vulnerabilities and risks before production deployment.

Reviewed complex multi-cloud architectures.

Evaluated/performed due diligence on maturity levels with third-party vendors. Analyzed questionnaires and evidence, which reduced exposure to supply chain attack risks.

Improved the KRI visualization dashboard and security tools, helping my team and all evaluators automate their analyses and accelerate them by over 45%.

- Managed risks and indicators with vendors, subcontractors, and clients (per NIST), performed due diligence, reviewed contracts and security addenda, audited evidence, and strengthened client relationships and security assurance plans.

- Assessed cloud risks (Ebios RM), reviewed architecture diagrams.

- Integrated security into projects (security measures per 27002).

- Conducted Shadow IT campaigns (declaration, assessment, evaluation, treatment).

- Managed vulnerabilities in the CI/CD toolchain (DevSecOps).

- Strong interaction with CSIRT and SOC teams for investigations.

IT Project Management:

- Unified CRM/DMS/CEM applications and improved user journey.

- Identity management (IAM, employee onboarding/offboarding).

- ISO 9001 and ITIL (knowledge management, process sheets).

- MFA, strong authentication.

Compliance and Information Security:

- Implemented an ISMS (ISO 27001) and drafted an ISPS.

- Risk analysis, management, and security plan, supported by France Relance/ANSSI.

- Awareness campaigns.

- Security workshops: password policy redesign, directory and cloud hardening...

- Monitoring and protection of sensitive data via a DLP platform, automated reporting to the DPO.