Luis Andrés Gonzalez Gaytán

Develop a strategy for Information Security and Cybersecurity risks that evolves continually to provide even stronger protection. Expanding its scope, along with significant improvements in its architecture and the adoption of a zero-trust security model, enables us to proactively detect and mitigate threats, effectively manage risks, and minimize any potential impact. The above has formed the foundation not only for our distinction in the insurance sector but also for our leadership in cybersecurity, providing our clients with the assurance that their assets are protected by the latest in secure technology. GNP is more than an insurance company; we are your trusted insurance partner in the digital era.

Develop an Information Security strategy to achieve the objectives of each of the following businesses: - Banco PagaTodo (BPT), a Digital Bank, certifying it in PCI-DSS, SPEI, and ensuring strict regulatory compliance. - Obtén+ (DSM), a digital wallet (ewallet), certifying it in Integrated Management System (ISO 9001:2015 and ISO 27001:2013). - Ya Ganaste (ACO), a Fintech with presence in 7 countries, facilitating payments, certified in PCI-DSS. The information security strategy was developed corporately based on ISO 27001, utilizing a risk-based approach and the principle of proportionality, aiming to optimize the use of available resources and establish security by design.

Develop the strategy and management of Cybersecurity risks within the company, focusing on the following processes: - Information Security Awareness - Base Security Configuration for G Suite (Google) - Control and segregation of access to the G Suite (Google) Administration Console - Information Security Policies - Investigation of Information Security breaches (Data leaks, unusual activity, etc.) - Security Controls Evaluation (Risk Control Assessment) - Cybersecurity Risk Assessment - Cybersecurity Risk Acceptance Design, implement, and operate the following processes: - Phishing Tests and Training Campaigns - Administration and Implementation of Data Loss Prevention (DLP) Rules - Security Incident Management

BUSINESS INFORMATION RISK OFFICER & BRCM MANAGER Develop strategies for risk management related to: • Application issues under HSBC methodology • RBWM information security events & incidents management and response • End User computing reviews (EUC) • ATMs security • Branches security controls • Security information components in HSBC network branches • Tracking of Issues, MSII, Dispensations & Risk acceptances • Third Party Security Management • Risk assessment according with the international methodology • Information & Cyber Security Risk • Systems Risk Assist and support to: • New projects engagement • Staff Training • Exceptions process • Business requirements  Direct Reports: 3 staff in Mexico  Indirect reports: 30 staff in Mexico / 2 staff in LAM

Support to country group Divestiture Support to new company deployment Support to LATAM for the Information Security issues related to the region. DLP rules testing owner

RBWM Risk Steward FEB 2015 - to the date - Specialist in an operational risk area. - Oversee and assess the operational risk managements activities. - Set policy. - Set the overall maximum risk appetite for their particular operation risk type (e.g. financial crime risk, regulatory compliance risk, legal risk, tax risk, accounting risk, people risk, fraud risk). - Own the FIM for this operational area. - Provide specialist advice. - Support and challenge to risk owners and control owners. - Support the Risk Owners with setting the risk appetite for their business within the Group`s overall risk appetite. S&F (Security & Fraud Investigation) APR 2013 - JAN 2015 Manejo de incidentes - Entrevistas sobre el incidente - Aplicación de técnicas para entrevista e investigación de incidentes - Coordinación de acciones para mitigación o Investigaciones especializadas de T.I. FRT (First Response Team) SEP 2012 - APR 2013 Atención de eventos e incidentes bajo las siguientes categorías: o Uso inapropiado de la información Fuga de información Préstamos de credenciales Sitios WEBMAIL Sitios de almacenamiento en nube (NAS) o Pérdida y robo en tránsito o Pérdida y robo en hardware o Phishing-Scam o Malware o Acceso no autorizado SPAM Ingeniería social Estafas Nigerianas - IMT (Incident Management Team) o Manejo de incidentes o Análisis de riesgo o Coordinación de acciones para mitigación o Manejo de incidentes en base al negocio o Entrevistas sobre el incidente o Documentación sobre incidentes o Remediación post incidentes -Impartición de presentaciones

- Desarrollo de proyectos de TI - Respuesta a Incidentes de Seguridad - Análisis de sistemas de seguridad - Análisis de riesgos de TI - Recuperación de desastres - Informática Forense - Estrategias de seguridad SABSA / ITIL / COBIT - Seguridad en Redes / Inalámbricas - Rastreo y prevención de Intrusiones

Impartición de clases a nivel primaria,secundaria y preparatoria Desarrollo de auditoría de redes Utilización de Linux básico – intermedio Desarrollo de robótica