Eman Shami

- Established the Information Security function from the ground up, including policies, procedures, and governance structures aligned with PDPL, CBJ requirements, and international standards.
- Coordinated with the Central Bank of Jordan during inspections and audits and supported remediation planning with process owners.
- Contributed to the Cybersecurity Committee by preparing security posture updates, risk summaries, and compliance reports.
- Oversaw SIEM (Splunk) implementation with external vendors, including monitoring, incident follow-up, and coordination of PT/VA activities.
- Developed and maintained RoPA, DPIAs, and IT/information asset inventories.
- Conducted organization-wide risk assessments and defined risk treatment plans.
- Led security awareness initiatives and supported RBAC-based access control reviews.

• Executed and coordinated global weekly Change Advisory Board (CAB) activities across
multiple regions.
• Reviewed and managed system changes based on approved change documentation,
ensuring proper movement through testing and production environments.
• Conducted daily stand-up meetings to track progress, resolve issues, and align testing
and implementation activities.
• Reviewed testing results and evidence to confirm successful validation prior to
promoting changes to live environments.
• Ensured compliance with internal change management procedures, audit requirements,
and control standards.

-
Review audit report drafts with owners before issuing the final report (Globally).
-
Prepare management responses as well as suggesting solutions for the audit findings in order to address the risks efficiently and close all the gaps and provide them to the Audit. (Globally)
-
Attend audit exit meetings.
-
Ensure closing the audit findings in a reasonable time-frame. (Globally)
-
Prepare KPIs for the audit and regulations closures. (Globally)
-
Reporting dashboards to the management on monthly basis showing their progress regarding the audit findings. (Globally)
-
Perform re-assessment to a previously issued audit reports to ensure that all gaps are still closed.
-
Follow-up with IT owners to ensure their compliance with external regulations (Globally).
-
Collaborated with cross-functional teams

• Participated in IT audit engagements for banking and telecommunications clients.
• Tested IT General Controls (ITGCs), including access management, change
management, and IT operations controls.
• Reviewed and validated audit evidence to assess the effectiveness of implemented
controls.
• Documented audit findings and supported the preparation of audit working papers in
accordance with audit methodologies.

• Reviewed daily security monitoring reports and logs to identify potential security
issues.
• Raised and escalated security red flags to relevant IT and security teams for
investigation and follow-up.
• Supported incident handling and tracking of security-related observations.

• Reviewed, locally customized, and updated group-level information and physical
security policies issued by BHFM (Société Générale - Paris) to ensure applicability
across local operations.
• Initiated and managed information security and physical security-related projects in
coordination with business and support teams.
• Identified security risks affecting business operations, raised them to business line
managers, and participated in defining appropriate mitigation controls.
• Delivered information and physical security awareness programs, including induction
training for new joiners and physical security training for branch employees.
• Monitored and reviewed daily information and physical security reports and followed
up on identified issues and exceptions.
• Monitored CCTV, DVR, fire detection, and intrusion systems to ensure proper coverage,
availability, and functionality.
• Coordinated with vendors for maintenance, periodic testing, and issue resolution
related to CCTV, alarm systems, access control devices, fire alarms, sprinklers, and fire
extinguishers.
• Participated in new branch openings by designing and validating physical security
layouts, including camera placement, alarm coverage, and security system
requirements, and followed up on on-site implementation with vendors.
• Conducted regular preventive and corrective maintenance follow-ups for all physical
security systems.
• Supported physical security arrangements for disaster recovery (DR) sites and storage
facilities.
• Planned and conducted evacuation drills, prepared evacuation plans, and coordinated
related awareness activities.
• Reviewed ICBS access authorizations, exceptions, and changes, ensuring alignment
with approved access rights.
• Performed monthly reviews of closed areas, resigned employees, and user access to
ensure timely deactivation and compliance.
• Ensured that absent employees did not access ICBS systems during their absence.
• Reviewed database-related changes to ensure compliance with security and access
control requirements.

• Assisted in reviewing and updating information security policies and procedures.
• Supported the update and maintenance of the Business Continuity Plan (BCP).
• Reviewed daily security reports related to authentication and access systems, including
TACACS and RADIUS.
• Monitored AML-related system reports and escalated observations when required.
• Reviewed and followed up on security-related Jira tickets to ensure timely resolution.