سراج شمس الدين

• Continuously assess and identify vulnerabilities in cloud infrastructure, collaborating with engineers to design and
implement solutions, leading remediation efforts that strengthen the overall security posture and minimize potential data
breaches.
• Lead penetration testing for internal and external applications, documenting and mitigating vulnerabilities, and ensuring
PCI compliance, resulting in enhanced application security.
• Design and implement security architecture for the banks systems, ensuring continuous compliance with industry standards
throughout the lifecycle, which enhances protection against cyber threats and mitigates security risks.
• Conduct threat modeling, risk assessments, and security audits, implementing encryption, authentication, and access
controls to protect sensitive data, thus reducing exposure to potential threats.
• Manage ongoing vulnerability identification and reporting, advising on prioritization and maintaining the vulnerability
management solution to ensure timely remediation and mitigate risks.
• Lead security hardening benchmarks (CIS, NIST), perform regular audits, and provide detailed reports to the Risk
Management Committee, which enhances security measures and strengthens risk mitigation strategies. Integrate security
testing and requirements into the DevSecOps pipeline, minimizing risks and reducing attack surfaces during the application
development cycle, ensuring more secure deployments.
• Monitor the external threat landscape, analyzing findings to adapt security strategies and improve the organizations
security posture based on emerging threats.
• Oversee brand protection measures, providing weekly dashboards and reports with KPIs to track effectiveness and optimize
security initiatives, resulting in better brand security management.
• Document security risk items, vulnerabilities, and audits in the Operational Risk Management System (ORMS), ensuring
accurate and timely reporting, which improves risk visibility and compliance.
• Ensure ongoing compliance with regulatory guidelines and InfoSec policies, maintaining alignment with industry standards,
which minimizes legal and financial risks for the organization.

• Maintained and updated information security policies and procedures, ensuring regulatory compliance and improving
security practices.
• Adjusted scanning strategies to address evolving threats, enabling proactive risk identification and improved threat
mitigation.
• Led the Data Loss Prevention (DLP) system, creating policies, analyzing incidents, and providing forensic evidence to
strengthen incident response.
• Conducted risk assessments, identifying vulnerabilities and recommending improvements to strengthen security protocols
• Resolved security weaknesses, ensuring faster remediation and minimizing security risks.
• Refined information security program policies, ensuring continuous improvement and alignment with best cybersecurity
practices.
• Supported the CISO in strategic planning, risk assessment, and cybersecurity controls, aligning with organizational goals to
enhance security posture.

• Supported the CISO in strategic planning, risk assessment, reporting, and the implementation of cybersecurity controls.
• Initiated and conducted risk assessments to ensure the adequacy of security protocols.
• Played a key role in maintaining and updating information security policies, procedures, and standards.
• Managed the Vulnerability Assessment (VA) and Penetration Testing (PT) programs using both internal and external
resources. Gathered requirements for threat and vulnerability information, adjusted scanning strategies, and addressed evolving
threat landscapes.
• Led the Data Loss Prevention (DLP) system, including policy creation, incident analysis, and participation in
investigations, providing forensic evidence as needed.

• Served as an Information Security Analyst, providing hands-on engineering, analysis, and systems integration to implement
authentication and authorization solutions, application onboarding, and PKI-related projects, ensuring robust security
measures and streamlined access control processes.
• Ensured the proper implementation of Public Key Infrastructure (PKI) and certificate management, guaranteeing secure
data transmission and enhanced encryption across the organization.
• Handled information security incidents by creating solution architectures, models, and designs that met client operational
and security needs, resulting in effective mitigation of risks and improved overall security resilience.

• Responsible for installing and maintaining firewalls and security software to safeguard personal user data.
• Focused on developing protection plans to prevent accidental modifications and unauthorized access to sensitive files
and data.
• Oversee the planning, configuration, and management of information security procedures, including the
administration of the enterprise antivirus manager.
• Accountable for executing and supporting vulnerability scanning programs, including configuring scan sites,
• Provided effective resolutions to identified security weaknesses.
• Updated and refined information security program policies, procedures, and standards.
scheduling scans, generating reports, and interpreting results.
• Responsible for managing Group Policy to establish user rights and privileges for data access.