Eman Shami

Experience includes local and regional banks operating under strict regulatory and audit requirements. - Contribute to establishing and structuring the Information Security function, including governance, policies, and risk processes - Support the Cybersecurity Committee by preparing and presenting updates on security posture, risks, and compliance to management - Develop and maintain compliance and risk documentation aligned with regulatory and organizational requirements - Lead organization-wide information security awareness initiatives - Develop and enforce information security and data protection policies aligned with business needs and regulatory expectations - Collaborate with process owners to address and close audit and compliance findings - Coordinate security monitoring activities and follow up on third-party security assessments

- Executed and coordinated Change Advisory Board (CAB) activities in a regulated banking environment. - Reviewed system changes and ensured proper approvals, documentation, and compliance with change management procedures. - Participated in daily and weekly meetings to track progress, identify risks, and align testing and implementation activities. - Coordinated with IT and business teams to ensure changes were implemented in line with approved controls. - Ensured compliance with internal change management policies, audit requirements, and control standards. - Supported audit activities by providing evidence and addressing observations related to change management processes.

- Supported IT governance activities in alignment with COBIT framework. - Conducted risk assessments and supported the enforcement of information security policies and controls. - Coordinated with cross-functional teams to align IT practices with business and regulatory requirements. - Contributed to audit preparation activities and supported responses to audit observations. - Assisted in maintaining documentation related to IT governance, risk, and control processes.

- Reviewed IT audit and regulatory reports and supported structured follow-up on findings to ensure timely remediation. - Prepared weekly and monthly KPI reports for management covering audit and regulatory findings status, remediation progress, and outstanding actions. - Coordinated closely with process owners to follow up on audit and regulatory observations, including Central Bank of Jordan (CBJ) requirements. - Supported the follow-up and closure of regulatory and audit observations for local and regional banks operating in markets such as Jordan, Qatar, and Bahrain, UAE, Lebanon. - Assisted in preparing management responses and corrective action plans to address identified gaps. - Participated in internal, external, and regulatory meetings to clarify observations, responsibilities, and progress updates. - Maintained audit and regulatory documentation and tracking, contributing to improved visibility and timely closure of findings.

- Conducted IT audit fieldwork for banking and regulated clients, including telecom operators, in coordination with engagement teams. - Facilitated audit meetings with process and system owners to understand controls, request evidence, and clarify control implementation. - Reviewed and evaluated IT General Controls (ITGCs) including access management, change management, and IT operations. - Prepared audit working papers and supporting documentation in line with Deloitte audit methodology and standards. - Discussed audit observations and evidence with engagement team members and contributed to findings documentation and follow-up.

- Reviewed daily security monitoring reports and logs to identify potential security issues and anomalies. - Raised and escalated security red flags to relevant IT and security teams for investigation and follow-up. - Supported incident handling activities, including tracking and documentation of security-related observations. - Coordinated with IT teams to support timely resolution of identified security issues.

- Customized and updated group-level information and physical security policies issued by Société Générale (Paris) to align with local regulatory and operational requirements. - Supported information and physical security initiatives in coordination with business, IT, and support teams. - Identified information and physical security risks, raised them to business line managers, and contributed to defining mitigation controls. - Delivered information and physical security awareness and induction training for branch employees. - Reviewed daily security reports and followed up on issues, exceptions, and incidents. - Monitored physical security systems including CCTV, DVR, fire detection, and intrusion systems to ensure availability and proper coverage. - Coordinated with vendors for maintenance, testing, and issue resolution related to physical security systems. - Supported new branch openings by defining physical security requirements and overseeing on-site implementation. - Planned and conducted evacuation drills and prepared evacuation and emergency response plans. - Reviewed ICBS access rights, user changes, and exceptions, including checks related to resigned or absent employees. - Supported physical security arrangements for disaster recovery sites and secure storage facilities.