Yerzhan Yermekbayev

Developed and implemented a comprehensive information security strategy, with a strong focus on risk management, ensuring alignment with local and international standards and regulatory requirements. - Saved $66,000 by optimizing security tool procurement while maintaining full functionality. - Reduced data leakage incidents by 76%, cutting leaked files from 14,785 to 923. - Enhanced Microsoft Security Score from 58% to 74%, surpassing industry benchmarks.

Led the ISO/IEC 27001 implementation project. Identified risks and developed proactive risk treatment plans to mitigate them efficiently. Effectively communicated complex security principles to stakeholders.

Managed information security risks and led the development of cybersecurity initiatives across the KMG group of companies. Oversaw the implementation of information security risk management processes, achieving certification and compliance with the ISO/IEC 27001 international standard. - Integrated operations with a Security Operations Center, achieving 98% SLA compliance. - Recertified the ISMS to international standards.

Led the project to implement an Information Security Management System (ISMS) across the KMG group of companies, ensuring alignment with the ISO/IEC 27001 international standard.

Development in the sphere of membership and certification. Development and implementation of the plan to increase ISACA subscriptions. Work with the members of ISACA and NGO "ISACA ASTANA". NGO "ISACA ASTANA" is the Kazakhstani branch of the international professional association that is focused on IT governance - ISACA.

Development of the IT management model (business IT processes within the transformation of the Company's business), development of business information security processes, identification of possible contributions of IT to the development and support of the Company's business activities, implementation of IT initiatives aimed to optimize and improve the efficiency of the current operational activities of IT and ISMS. Development of the Company's IT Development Strategy and the IT Strategic Plan.

1. IT strategy development – National industrial company • Identification of current IT architecture (business, data, application and infrastructure) • Development of the target IT architecture (business, data, application and infrastructure) • Evaluation of alternatives and developing of an implementation plan • Development of the IT strategy 2. ISMS implementation – National industrial company • Identification of information assets and current IT and IS architecture • Development of IS risks assessment methodology • Evaluating of IS risks and risk treatment plan developing • Development and implementation of IT and IS documentation

Development of the methodology over IT and IS audit in the Bank, methodology approved by the Board of Directors. Participation in the preparation of the audit plan. Conducting an IT audit, consultation, and evaluation of IT controls in subdivisions, business processes, and information systems of the Bank. Preparing working papers and reports in accordance with best practices.

IT and information security consulting projects: 1. Formalization of IT processes – National industrial company (current IT processes identified, a new map of IT processes was developed and agreed, IT processes over Information security were formalized); 2. IT Strategy and IT processes development – National Holding (current IT governance and architecture assessed, different IT alternatives identified and compared, the target IT Architecture and IT operating model developed and agreed upon, the IT strategy implementation plan developed, IT policies, standards, and procedures developed and agreed); 3. IT & information security assessment – National Holding (information system usage and further development risks identified and mitigation actions are recommended, the IT Risk Management benchmarked against global managing holdings, general IT processes risks identified and necessary actions are recommended); 4. IT and IS Audit – Kazakhstan bank (the current software licensing model assessed and recommendations for optimization provided, general IT processes risks identified and necessary actions are recommended, information security vulnerabilities identified and recommendations for improvement provided).

Maintenance of an information system based on Oracle BI. Working out issues with the system supplier.

I have started my Master’s in Artificial Intelligence and Machine Learning at the University of Birmingham Dubai. This program will deepen my expertise in AI technologies, enhancing my skills in data analysis, machine learning, and intelligent systems development. I look forward to applying these advanced capabilities in my ongoing work in information security and beyond.