Expérience

Risk-Driven Governance Advisor (RDG™)
I help organisations turn risks, regulatory obligations, cybersecurity challenges and transformation initiatives into informed governance decisions.

My approach is based on a simple principle:
Risks should inform decisions. Decisions should drive governance.

I work with business leaders, IT managers, public sector organisations, SMBs and growing companies to strengthen their governance capabilities, improve risk awareness and support decision-making processes.

My areas of focus include:
Governance and management systems
Cybersecurity and security governance
Risk management and risk-based decision making
Third-party and supplier governance
AI governance and responsible AI
Regulatory readiness and compliance programs
Organisational transformation and continuous improvement
My objective is not to produce more reports, controls or procedures.
My objective is to help organisations understand their risks, evaluate their options and make clear, pragmatic and defensible decisions aligned with their strategy.

In addition to my advisory activities, I contribute to several independent initiatives:
MS4ICT™ – a governance method focused on risk and coherence to unify all MS
RT4MS™ – a Risk Transformation for Management System
BARELLA.APP® – publishing governance, risk and compliance content
BARELLA.DEV – developing tools, frameworks and future governance solutions

Group Information Security Office (GISO).

·        Designed and implemented a Group-wide Information Security Management System (ISMS) aligned with ISO/IEC 27001.

·        Designed and implemented an integrated governance model based on MS4ICT, serving as the foundation for ICT governance, cybersecurity, risk management, compliance, vendor risk management and AI governance across the Group.

·        Designed and implemented an Artificial Intelligence Management System (AIMS) aligned with ISO/IEC 42001.

·        Established AI Governance principles and controls based on ISO/IEC 38507 and AI risk management practices aligned with ISO/IEC 23894.

·        Developed a Vendor Risk Management (VRM) assessment framework integrating cybersecurity, privacy, operational resilience and AI governance requirements.

·        Defined cybersecurity policies, risk methodologies and executive reporting mechanisms across Group entities.

·        Led awareness initiatives covering both cybersecurity and responsible AI governance.

·        Assessed ICT and AI-related third-party risks supporting regulatory compliance and sound governance practices.

·        Designed and implemented an ISO/IEC 42001 Artificial Intelligence Management System (AIMS).

·        Established an AI Governance framework aligned with ISO/IEC 38507.

·        Developed a Vendor Risk Management framework integrating ICT, cybersecurity and AI governance dimensions.

Cybersecurity Audit & Risk Advisor

Contributed to the development of cybersecurity and IT risk practices, including risk models, templates and control frameworks.

Performed risk analysis and second‑line‑of‑defence activities for financial institutions.

Supported ICT risk, compliance and governance initiatives for public and regulated organisations.

Roles performed in a client delivery context as part of employment with Sogeti Luxembourg.

IT Cybersecurity Risk Consulant

On mission @BCEE as Cyber Security risk consultant.
Perform Risk Analyst.
Design the futur framework using ISO, ENSISA, and compliance with EBA, GDPR,…
Design and implement new Risk Model.
Create new assessment for next annual campaign.
Design and implement new Risk Template for self assessment.
2nd Line of Defense, perform RCSA review and control review

Founder – GRC Consultant

Mission/Project Consutlant
Description a. DPO as a Service
b. Privacy Risk Consultant
c. Privacy Consultant
d. Cyber Security Consultant
Tasks a. Act as DPO, follow up and advice CEO about privacy problem or new.
b. Help and design a new framework for DPO using ISO 29100, 29154 and 27701, perform pre-screening for elected processes.
c. Advice about news rules or best practice in privacy, train IT and CEO on GDPR.
d. Cybersecurity analyst and advisor

Other task :
• Perform risk analyse
• Design RBAC
• Perform security analyse
• Implementing GDPR
Environment Prince2, Compliance, IT Risk, Privacy requirements, Process Management, Security requirements, Network topologies, Policies, Security Management.

Senior Consutant

Adviser GDPR after organizing session work and information in collaboration with Uptime-ICT and Cronos Security.
Explain to the customer in a simple way that does a GDPR program and how to prepare the program.

Auditing for compliance with the GDPR all Uptime Group website including recommendations for the implementation of conformity for all.

– BSA (Brussels South Airport): Advisor for the implementation of a GDPR Program.

– SWCS: Advising the client on the part GDPR of the AD project.
The AD project management, achieved: go given by the customer, have passed all documentation to the client after the implementations, validation of all accounts minutes of meeting.

– Test Achats – Eurocosummer: Advise and explain how to be implementing a GDPR program, implementation of a new wireless infrastructure.

– For FN Herstal: Advise and explain who, and how-to setup a GDPR Program.

– For SPW (Service Pubic de Wallonie): Project of implementation of the new solution of backup.
Main achievements: received the customer Go, delivery of the completed project, receipt of the acceptance of the end of the project and the project is closed.

– Governance project: Retake of the current project, create of the main governance based on Cobit5, writing of the part of governance on the CMDB using the Cobit5 process and the different standards such as ITIL.
– CHR Citadelle: Organization of the launch meeting, reception of Go of the launch of the project, creation of the planning and validation received by the client, communication on the progress of the project.
– CWAPE: Retake a project, receiving a Go for all phases of the project, final acceptance of the deliverables of the project which was to move their infrastructure to the cloud, project closure and reception, as well as the validation of the closure of the project.
– GhDC: Project Manager for implementing new Backup and Storage Architecture
– BIO-Invest: Advice on GDPR, Project of migration on premise to the cloud.

Senior Program – Project Manager

In mission for ENGIE as Senior Project Manager.
– Engie Generation Nuclear: Security project, receive the formal Go for the project, project initiation, communication, implementation.
– Engie Generation: Dismantling a classical powerplant: receive the go for the project, formal acceptance of the project delivery and closure.
– Engie Generation: Build a new powerplant receive the go on the scope, the outcome, receive the Go for the project, for the delivery outcomes receive the formal acceptance and receive the formal closure acceptance.
– ORES: Advise on the EU regulation in Energy sector and implanting the segregation of the network and receive the Go for implementing, receive the formal acceptance of each site performed.

Change management.
– Project Management from A to Z (from the commercial proposal to the close of the project)
– Customer relationship management.
– Incident management.
– Planned tasks and their follow-up.

For INTM:
– Design & Implementation of KPI for contract monitoring for ENGIE in service mode.
– Implementation of Capacity Planning of the consultants
– Follow-up of INTM consultants working at ENGIE IT
– Validation of skills at Project Manager.
– …

Project Manager

In mission as IT Network Project Manager @ ENGIE
Project Manager dedicated to the DSI of the ENGIE group, for the implementation of the program of NFG.

– Implementation of a new infrastructure network overall of the Belgium.
– Preparation and presentation of the project to the CEO of each entity in Belgium, the CIO, the CISO. Result, go for the launch of the program in Belgium, receipt of all migration networks and the closure of the Belgian program
– Retake of a governance project security for the implementation of a new solution of firewall for the protection of the different datacenters of the Engie Group. Receipt of a Go for the launch of the POC, the project has been stopped after the reorganization of the Group pending the implementation of a new strategy group.
– Migration of the VIPs of Cisco ISE to F5

Process and Project Manager

In mission at BNP Paribas Fortis as Process and Project

• Analysis of the existing and the rewriting of all the processes for guarding, all rewritten process received a formal acceptance.
• The new telecommunication network analysis project internal (Walkie Talkie) for caretaking, creation of a methodology for the analysis of the spectrum and verification of the power of the radio signal, output of the project: acceptance of the presentation of numbers validate by the client and the report and recommendations were also approved by the provider. Review the service contract and to find anomalies.
• Help BNP to renegotiate the contract on the performance of the network.
• Help find security vulnerabilities, Advisor on the safety of privacy compared to the acquisition of an application for guard in SaaS.
• Advise on security on the implementation of a new site for a data center in Belgium and recommendation. Validation of the recommendations by the customer.

Consultant Cybersecurity – Project Manager IT Infrastructure

– Design and development of Web site (Harley Luxembourg, Luxembourg HOG, Motorcycle Tours Luxembourg)
– Recruiter for some SMEs and external resource manager.
– Project manager in IT infrastructure and security.
– Team leader,
– Advice on the law of privacy about CCTV cameras and how to get a record of statement to the Belgium For Logistical Company :
Privacy Commission, establish network architecture for camera network.
Setting up a report to the management.
– Implementation of processes and best practices in term of the law on the private security, guard training.
For a private security and a new Industrial SEVESO Company
– Advise how to declare CCTV to the Belgium Privacy Commission.
– Create the plan of implementation of the CCTV and retention, about law for people training in private sector (Tobback Law)
– Incident management.
– Set up a report to Bio Wanze, Seris Security, Desmet Engineering management.
– Create processes monitoring and documentation.

For another private security
– Incident Analyst.
– Auditing process after incident. advice performed.

Consultant Cybersecurity – Project Manager IT Infrastructure

– Design and development of Web site (Harley Luxembourg, Luxembourg HOG, Motorcycle Tours Luxembourg)
– Recruiter for some SMEs and external resource manager.
– Project manager in IT infrastructure and security.
– Team leader,
– Advice on the law of privacy about CCTV cameras and how to get a record of statement to the Belgium For Logistical Company :
Privacy Commission, establish network architecture for camera network.
Setting up a report to the management.
– Implementation of processes and best practices in term of the law on the private security, guard training.
For a private security and a new Industrial SEVESO Company
– Advise how to declare CCTV to the Belgium Privacy Commission.
– Create the plan of implementation of the CCTV and retention, about law for people training in private sector (Tobback Law)
– Incident management.
– Set up a report to Bio Wanze, Seris Security, Desmet Engineering management.
– Create processes monitoring and documentation.

For another private security
– Incident Analyst.
– Auditing process after incident. advice performed.