pedro C.

Define, maintain, and govern the OT Security Policy, aligned with the overarching ISMS, establishing security objectives, roles, responsibilities, accountability, and policy lifecycle management across industrial environments Develop and enforce OT cybersecurity standards and control baselines aligned with IEC 62443 and NIST Cybersecurity Framework (CSF) 2.0, translating policy requirements into measurable, auditable, and risk-based controls Alignment with NIS2 for the OT/ICS scope Create and maintain OT security guidelines, procedures, and operating instructions to ensure consistent policy implementation while accommodating site-specific operational, safety, and availability requirements Integrate OT cybersecurity risk management practices into policy and standards, ensuring continuous risk identification, assessment, treatment, and compliance with applicable regulatory and industry obligations Design, deliver, and continuously improve OT-focused security awareness programs and role-based training initiatives tailored to operational roles, engineering staff, and third-party access Review, enhance, and enforce network segmentation in alignment with the Purdue Enterprise Reference Architecture, including zoning and conduits, to reduce attack surface and limit lateral movement Define and govern OT-specific endpoint protection controls designed for OT/ICS environments, including allowlisting, integrity monitoring, anti-malware where feasible, secure configuration, and compensating controls for legacy or safety-critical systems, ensuring protection without impacting availability or safety Establish and integrate OT-specific cyber threat intelligence capabilities to identify relevant threats, vulnerabilities, and attack techniques, supporting proactive risk mitigation and informed response

ISO 27001 NIST SP 800-63 for Digital Identity Guidelines Security Awareness Conditional Access Policies - Zero Trust Passwordless

Ensure high level of Information Security compliance for a regulated market IAM Governance Identity Zero Trust Strategy Privileged Access Management IdP Hardening SOC Use Cases - Identity scope Cyber Crisis Coordination & Table Top Exercises Swift Customer Security Controls Framework Integration of Security into Projects - Risk Assessment Security by Design Threat Modeling Network Security ISO27001/2 Controls NIST Cybersecurity Framework NIST SP 800-53 Rev. 5 CIS Critical Security Controls CIS, AWS and Microsoft Benchmarks MITRE ATT&CK™ framework Zero Trust Strategy SWIFT Security Controls Framework NIS 1&2 Directive DORA EBIOS for Risk Assessment ISO 27005:2018 - IS risk management ISO 31000: Risk Management NIST Risk Management Framework

Control Design, Implementation, and Monitoring with NIST CSF, ISO 27001 & CIS Critical Security Controls MITRE ATT&CK™ framework CIS Critical Security Controls v8 Vulnerability Management Risk Assessment on Projects (EBIOS, ISO 27005/31000) M&A Information Security Follow-up Zero Trust Strategy User Awareness Training & Influencer Automation w/ Powershell & Python SAST/DAST Analysis/Assessment Security Awareness Program (focus on dedicated webinars, phishing campaigns, newsletters)

Network Segmentation/Filtering based on Purdue Model Stateless and Stateful filtering/inspection Firewall rules Network and Security Project Management Network Design (Physical and Logical)

MSc Dissertation: "Implementing a Framework for Continuous Improvement in Cybersecurity" More info about the Msc: https://www.dei.uc.pt/msi/?en