Bülent Bingöl

GRC, Cyber Security Governance, IT Audit, Internal Controls, IT Service Management, ISO 27001, ISO 22301

Management of IT Availability Management and SLA Management processes, continuously improving IT availability and SLA’s with business and IT. Ensure that SLA reflects customer requirements, and SLA Monitoring and reporting are effective and efficient. IT Service Request Catalog Management process management and reporting of results to service stakeholders. Ensure that Incident Management, Major Incident Management, IT Crisis Management, Post-Incident Reviews and Problem Management processes are effective and efficient. Ensure that BCM steering meeting agenda includes major incidents information accurately. Ensure that NOC teams escalation procedures can react proactively to potential major incidents to improve IT resiliency and customer experience. Maintain and improve quality and efficiency of service delivery of IT services and IT operations with service owners and operations teams.

Manages IT change management process, manages CAB and eCAB changes. Review, design change management process to effectively and efficiently to assess IT change risks and plan controls to mitigate with change owners. Successfully manages and coordinates Isbank's IT and software teams projects to comply with Turkey's summer time window legal changes.

Ensure that our NOC teams are effectively can do 7x24 system monitoring activities and can follow escalation policies and procedures. Increasing our NOC team’s effectiveness and efficiency, availability of our systems and services by defining new actionable alerts

I was responsible from second line control activities for Information Systems (IS) of the Bank. I had planned and executed second line IS control activities. I had also supervised IS control staff to do their engagements. Responsible from new Banking product and services Risk-Control-Compliance (RCC) assessments with Corporate Risk and Compliance departments. I had reviewed many new Banking product and applications architecture, assess the residual risks in the design, I recommended new controls systems to minimize residual risks. I had also improved RCC process with Risk, Compliance and Internal Control functions of the Bank to be more systematic, effective and efficient. Responsible from subsidiaries internal control reviews. I had designed and help them implementing Monitoring of Internal Controls framework and procedures for Softtech (Bank’s software development subsidiary) with reference to COBIT and BRSA regulations with them. I had given consultancy to Milli Reasurans (Bank’s subsidiary in assurance sector)for COBIT and IT Governance and BRSA audit readiness and improving their first and second line internal controls.

Support developing of IT recovery strategy and capability with IT management to support BCM policy and business continuity plan of the Bank, also compliance to BRSA requirements. I had designed and developed the IS Continuity Plan. I had given awareness education to responsible teams, designed and executed desktop exercises and tests of the plan. I had worked with Business Continuity team to develop IT Crisis Command and Control Center policies and procedures to be integrated to Corporate Crisis Management. I was Business Continuity Coordinator of IT department. I had conducted Business Impact Analysis, Risk assessments, prepared departmental continuity plans with IT management. Manager of IT Risk, IT Compliance and IT Continuity Management Processes. I had developed and managed IT risk management, IT compliance management and IT continuity processes in line with Corporate Risk Management, Corporate Compliance and Business Continuity Management Programs and methodologies. I had also given recommendations to other processes and system owners to satisfy with BRSA and COBIT requirements. I had contributed compliance initiatives to BRSA's regulations about Supporting Service Providers. I had worked with Corporate Enterprise Architecture Department and IT Purchase and planning unit to design and implement controls and procedures. Supporting Internal Systems Departments to do Risk-Control-Compliance activities of the newly developed services and applications of the Bank. Planning and coordination of penetration testing and DDOS services for the Bank's Internet applications and infrastructure. Consultancy for the systems, applications when they were acquired and whether the contracts were satisfying Bank's security and compliance requirements.

Implementation of Information Security Management System for the Bank. Ensure that ISMS policy and security policies, standards and procedures are which are aligned with best practices and legal requirements. Coordination of IT compliance program to comply with COBIT and BRSA regulations for IT and Internet Banking applications. Planning and coordinating independent IT Audits. Reviewing and validating audit findings, consulting IT and business to define action plans to mitigate. Ensure that IT disaster recovery plan to comply with COBIT DS04 control objective and BRSA regulations. Conduct awareness program for IT teams participating in testing of the plan. Design and execution of IT risk management process, IT risk register, IT risk assessment and risk action plans and folllow-up activities. Reporting of IT risks to Top Management in line with Corporate Risk Department. Support procurement and contract management team to implement process and procedures and documents to comply with COBIT and BRSA regulations. Supporting legal departments with technical/security aspects of legal cases. Review and contribution of Turkish Banking Association (TBA) working groups about the BRSA regulations. I was a coauthor of TBA Internet Banking Security Standards which was published to Turkish Banks. Planning and coordination of penetration testing and DDOS services for the Bank's Internet applications and infrastructure. I had managed end-to-end pen-tests, from company selection to reviewing findings and planning action plans. Meanwhile I had acquired CEH certification and I had also started to conduct security tests for the newly developed product and services. I had also implemented vulnerability management processes to detect vulnerabilities for the existing IT systems and Internet facing applications.

compulsary military service at IT

• Designing and implementing the Bank’s first SAN infrastructure. • Planning and implementing local and remote DR solutions for IT infrastructure. • Intel based system administration. • Management of a large-scale infrastructure with Active Directory, MS Exchange, DNS, DHCP, SMS servers. • Administration of Microsoft SQL databases. • Administration of Microsoft IIS application farms. • Administration of Proxy Servers.