محمد السرحان

▪ Identifying security gaps and risks across the bank and providing controls and mitigations inline with the business need.
▪ Develop, implement, and maintain the Information Security risk management within the bank.
▪ Ensuring Information Security compliance against regulatory requirements and international standards.
▪ Conduct periodic assessments related to ISMS guidelines.
▪ Manage internal and external audits related to information security and develop and implement action plans to close findings.
▪ Conduct, supervise, and review technical assessments, penetration testing and vulnerability assessments and monitor the progress of mitigation and remediation.
▪ Work as liaison with all departments across the bank to ensure compliance against established policies and regulations; manage areas of concern and implement changes/corrective actions if required.
▪ Plan, design, implement, and operate security technologies (Proxy, Email Security, AV, IPS, IDS, EDR, Application Control, Sandboxing, vulnerability Management tool, PAM, IAM, HSM...) and ensure IT security activities are aligned with the bank security
policies and standards.
▪ Acting as the bank key manager by generating, maintaining and exchanging keys and encryptions internally and with 3rd parties such as SAMA, SARIE, SWIFT, VISA, and MasterCard and managing all the security aspects in those services.
▪ Acting as the bank security change manager (CAB committee member) by reviewing and approving all technical and business changes (CRs, projects, programs) across the bank from information security point of view, highlighting the risks and suggesting security controls and improvements to minimize the risk to acceptable level.

▪ Manage and review changes and projects across the hospital systems, monitor and supervise the flow of the development life cycle.
▪ Initiate and coordinate IT projects, insuring on time project delivery and conduct post implementation reviews.
▪ Conducting quality assurance testing to system changes.
▪ Document business requirements and system changes and write user guides prior to implementation.
▪Document and publish a complete User manual to the HIS to be used by HMG and MoH medical and business staff.
▪Managing Identity and access management for the hospital systems.
▪ Conduct remote and on-site training to users impacted from the system changes (Hospital staff, management and other audience).
▪ Worked as a team member to deliver successful PoC with the Ministry of Health (Unified National Health Record الملف الطبي الموحد).

Provided tech support and system analysis for the head office, I also provided system support for the factory, warehouses, and 60 sale points. I had the opportunity to analyze and work on IT related challenges and find solutions (Active Directory, ERP, and other business, network and IT infrastructure systems).