GCBR Expert

Edgar Pimenta

GCBR role:

Member, GCBR Expert Network

Job title:

Head of Security

Organisation:

Infosec Heroes

Based in:

Portugal

Geographic focus:

Europe, Global

Languages: English, Spanish, Portuguese

--Security Director | Remote | Mar 2024 – Present Defined and executed Remote’s security strategy and roadmap across Application Security, GRC, and Security Operations, significantly strengthening the company’s security posture and reducing several risks. Key Achievements: -Restructured the Security team, hiring talent with the right skills to align with strategic security needs; - Led security efforts to obtain financial licenses in the Netherlands (EU), UK, and Canada and comply with DORA (Digital Operational Resilience Act) and NIS2 (Network and Information Systems) regulations; - Implemented a Vulnerability Management program with integrated pipeline security - SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing) and SCA (Software Composition Analysis) and containers scanning; -Built and scaled the Security Operations function, including SIEM implementation and development of automation for incident response; - Expanded SOC2 and ISO 27001 certification scope, enabling broader customer assurance; - Analysis and implementation of controls to align with AI Act and manage/reduce AI risks; - Hardened critical systems and improved security processes, reducing the overall threat landscape; - Established procedures to ensure alignment with the Data Protection team for security/privacy incidents, third-parties assessments, improved DPAs (Data processing Agreements), among others; - Improved overall Security governance practices, including Information Security Policies Management, Risk Management, Third-Party Risk Management, and security KPIs. -- Group CISO | YNV Group | May 2023 – Feb 2024 Revamped the Security program to increase maturity and alignment with business needs and each vertical/business requirements. Key Achievements: - Developed and implemented a Risk Management framework; - Established a BCM (Business Continuity Management) program aligned with customer requirements and business needs; - Strengthened the Assurance team by aligning roadmap with Risk Management and certification programs; - Provided support for ISO 27001 audits across several countries (in Europe, Asia, Central America and US); - Increased efficiency by introducing several automations in security processes and metrics; - Contributed to the creation of Cytek, a managed services provider for SOC (Security Operations Center) inside YNV Group and for external customers. -- VP, Information Security & Data Protection Officer | Talkdesk | Oct 2017 – Jan 2023 Defined, created, and matured Talkdesk’s Cybersecurity and Privacy programs, scaling the security team from 1 to 11 professionals. Key Achievements: - Built and executed a comprehensive security and privacy strategy fully aligned with business goals. - Developed the necessary policies and procedures and implemented several security and privacy processes such as Risk Management, Access Management, Third Parties Management, Incident - Response, Data Governance, and Data Subject Access Requests, among others. - Achieved multiple certifications: SOC2/SOC3, ISO27001, ISO22301, ISO27701, PCI-DSS, CSA Star Level1, Cyber Essential, APEC-CBPR, APEC-PRP; - Productize security with the addition of specific security features in Talkdesk’s core product - being Guardian - outlier login detection - the most relevant one; - Created an Incident Response team and procedures covering security and privacy incidents; - Drove revenue growth by supporting customer security and privacy assessments; - Increased visibility of risks and metrics through the Security & Privacy Risk Committee. --Earlier Roles (before 2017) Held leadership and management roles at Euronext (Financial sector), NOS (Telco sector), Sonaecom (Telco sector), PT-SGPS (Telco sector), and PT-Comunicações (Telco sector), focusing on GRC, information systems audit, compliance, privacy and security programs. Achievements include improving security policies, maintaining and improving ISO27001 certification, developing privacy incidents detections using Machine Learning (ML) based detections, investigating security and privacy incidents, leading international audit projects, and founding security and risk Committees.

Member of the GCBR Expert Network · Business Resilience Research · Paris Resilience Summit