Curriculum Vitae

[vc_heading title=”Summary” position=”left”]

[vc_spacer]

A dedicated, enthusiastic and motivated technology professional, who has acquired extensive business, technical and management experience (Over 25 years working in technology arena). Extremely adaptable and quick to familiarise himself with the very latest technologies and industry developments, whilst demonstrating a logical and analytical approach, to solving complex problems and issues.

Has held permanent positions in both the United Kingdom and Switzerland working in large multicultural organisations. Plus, I have a range of experience working on short term assignments in Belgium, Denmark, Finland, France, Germany, Holland, Spain, Sweden, United States and across various locations in the United Kingdom.

Roles held: Information Risk Management, Information Security, IT Disaster Recovery, Business Continuity, Network Administration, Network Security, Server Administration (Linux, Unix, Windows Server Administration), Internet Services Administration, Intranet Administration, Web Development, Telephony Administration, Application Administration, Solution Architecture, Quality Assurance, Software Testing, Development and IT Service Desk.

Skills / Expertise: Information Security, Information Risk Management, Disaster Recovery, Business Continuity, Firewalls, Network Security, Risk Management, Cyber Security, Anti-Phishing, Malware Analysis, Computer Security, Unix, IBM HTTP Server, Apache Web Server, Risk Assessment, Windows Server, Risk & Threat Assessment, Operational Risk Management, Sarbanes-Oxley 404, Information Security Management, Key risk identification and testing, security requirements, security architecture, security reviews,PCI DSS, Network Administration, Network Design, Cisco IOS, Ubiquiti Edgemax, Management, WebSphere Application Server, SharePoint, Microsoft Office, RSA SecurID, Vignette, Tomcat, Two-factor Authentication, Avaya PBX, Physical Security, Sendmail, DNS administration, HTML + CSS, Lean Six Sigma.

[vc_spacer]

Aon
London, United Kingdom

[vc_heading title=”Information Security Risk Manager” position=”left”][vc_heading title=”March 2015 – Present” color=”#8224e3″ position=”left”]

[vc_list_item].[/vc_list_item][vc_spacer]

Barclays (ING Direct taken over by Barclays)
Reading, United Kingdom

[vc_heading title=”Information Risk Manager (IRM)” position=”left”][vc_heading title=”March 2013 – December 2014 ” color=”#8224e3″ position=”left”]

[vc_list_item]Perform gap analysis of control environment against Barclays Information Risk / Technology Risk policies and minimum standards. Where gaps are identified, put in place mitigation plans to bring control environment inline with Barclays control objectives.[/vc_list_item][vc_list_item]Working on the migration project to identify requirements, risks and controls necessary to ensure a successful migration of customers from Barclays Direct into Barclays UK RBB.[/vc_list_item][vc_list_item]Successfully planned, organised and carried out the annual Business Continuity Test covering all critical processes and services of the bank, this involved coordination of over 50 individuals across 30 areas of the bank to identify, define and carry out IT Disaster Recovery and Business testing of critical processes and systems at the recovery location.[/vc_list_item][vc_list_item]Planning, Coordination and Testing of Sarbanes-Oxley (SOx) requirements, ensuring that General Computer Controls (GCC) are in place, designed and operating effectively.[/vc_list_item][vc_list_item]Coordination of the Business Continuity Management (BCM) function within the bank, working in tandem with the various migration activities to ensure that the BCM scope and requirements correctly identify key processes, services and resources necessary to service customers in the event of a crisis situation.
[/vc_list_item][vc_list_item]Day to Day Information and Technology Risk Management – Working alongside the Business and IT to ensure that appropriate processes and controls are in place, where necessary helping to identify new approaches in mitigation and reporting requirements.[/vc_list_item][vc_list_item]As part of the Risk and Control Assessment (RCA) process, partake in assessments to ensure that Risks, Issues, Key Controls, Key Indicators and mitigating actions are identified, assessed and correctly documented. Review of business Key Control testing plans to ensure that the plans correctly measure the performance and effectiveness of the Key Controls within the bank.[/vc_list_item][vc_spacer]

ING Direct
Reading, United Kingdom

[vc_heading title=”Information (Technology) Risk Manager (IRM)” position=”left”][vc_heading title=”January 2009 – March 2013″ color=”#8224e3″ position=”left”]

[vc_list_item]Future threat assessments – Identification of e-Crime / Cybercrime, computer and human threats – assessment to establish the probability and impact of the threat in relation to the particular function of the service or business (Risk versus reward to identify key risks and controls).[/vc_list_item][vc_list_item]Internal Information Risk Awareness – Designed and rolled out awareness messages to staff and contractors to ensure they understand the risks and the control requirements in place within the bank.[/vc_list_item][vc_list_item]Review and coordination of the Ethical Hacking process to ensure that services and systems are assessed via via Penetration Testing, Web Application Assessment and Code Reviews to detect and mitigate security vulnerabilities.[/vc_list_item][vc_list_item]Working on the separation project to identify requirements, risks and controls necessary to ensure a successful separation of ING Direct UK from ING Group, including removal of ING Proprietary information from the UK operation before the transfer to Barclays.[/vc_list_item][vc_list_item]Customer security awareness – Designed and managed the structure and content of the customer security awareness section of the banks commercial website.[/vc_list_item][vc_list_item]Day to Day Information and Technology Risk Management – Working alongside the Business and IT to ensure that appropriate processes and controls are in place, where necessary helping to identify new approaches in mitigation and reporting requirements.[/vc_list_item][vc_list_item]Planning, Coordination and Testing of Sarbanes-Oxley (SOx) requirements, ensuring that General Computer Controls (GCC) are in place, designed and operating effectively.[/vc_list_item][vc_list_item]As part of the Risk and Control Self Assessments (RCSA) process, partake in assessments to ensure that Risks, Issues, Key Controls, Key Indicators and mitigating actions are identified, assessed and correctly documented.
Review of business Key Control testing plans to ensure that the plans correctly measure the performance and effectiveness of the Key controls within the bank.[/vc_list_item][vc_spacer]

ING
Brussels, Belgium

[vc_heading title=”Cybercrime Technical Consultant (Short Term Assignment)” position=”left”][vc_heading title=”October 2011 – December 2011″ color=”#8224e3″ position=”left”]

[vc_list_item]Assessment of attack used against the bank in compromising the security of their transactional website, by the identification of the attack methods followed by a review of the vulnerabilities and weaknesses within the transactional website.[/vc_list_item][vc_list_item]Identification and assessment of Anti-fraud prevention and detection solutions, ranging from off the shelf fraud detection solutions through to internal improvements to reduce the threat of compromise within their bespoke applications.[/vc_list_item][vc_list_item]Process reviews and design of new processes (BPM) to ensure that the approach is Lean and any weaknesses (Gaps, Bottlenecks, Risks) at a process level are reduced.[/vc_list_item][vc_list_item]Identification of organisational structure in regards to their ability to manage and react to cyber-criminal activities targeting them. This led to organisational changes and improvements in internal communications to reduce handoffs and delays in defending the customers’ accounts and the bank as a whole.[/vc_list_item][vc_list_item]Acted as a Subject Matter Expert (SME) for the entire team, performed training on technologies and cybercrime tactics (Phishing, Malicious Software, Detection and prevention methods).[/vc_list_item][vc_spacer]

ING Direct
Reading, United Kingdom

[vc_heading title=”Information Security Officer (ISO)” position=”left”][vc_heading title=”November 2004 – December 2008″ color=”#8224e3″ position=”left”]

[vc_list_item]Responsible for the management and supervision of security measures to protect customer and company data.[/vc_list_item][vc_list_item]Working with the business to ensure that information assets are protected at levels appropriate to its value and criticality.[/vc_list_item][vc_list_item]Designed and implemented an Information Risk and Technology Risk framework within the bank – Information Security / Technology Risk Policy creation, Guidelines and policy implementation support.[/vc_list_item][vc_list_item]Creation and maintenance of User Class Matrices for applications to map user roles [RBAC] to application and system functionality.[/vc_list_item][vc_list_item]Created and defined a process to allow the encryption (PGP) of ad-hoc files being transferred to external parties.[/vc_list_item][vc_list_item]Customer awareness – Designed and managed the structure and content of the customer security awareness area of the commercial website.[/vc_list_item][vc_list_item]Cybercrime – Customer authentication – anti-malware prevention – design and implementation of Mouse based keypad using random image positions and server side digit identification in order to mask PIN digits from client side.[/vc_list_item][vc_list_item]Implementation of real time fraud detection and prevention system within the bank.
[/vc_list_item][vc_list_item]Design and implementation of Joiners, Movers and Leavers [JML] user access process to ensure correct levels of access provided and revoked as employees change role.[/vc_list_item][vc_list_item]Design and implementation of a User Access Review process to report to line managers the access [Roles] assigned to their staff to allow them to review and approve or change currently assigned roles and permissions.[/vc_list_item][vc_list_item]Setup the Ethical Hacking framework and process in order to Detect, Assess and correct security vulnerabilities via Penetration Testing, Application Assessment and Code Reviews.[/vc_list_item][vc_list_item]Part of project team implementing Mortgage services to the bank. Focusing on ensuring that the services are robust and comply with Information Risk requirements.[/vc_list_item][vc_list_item]Implementation of Card services inline with PCI DSS, ensuring that anti-fraud and Card security rules are in place to match the card security strategy.[/vc_list_item][vc_spacer]

ING Direct
Reading, United Kingdom

[vc_heading title=”Senior Systems Engineer” position=”left”][vc_heading title=”July 2003 – October 2004″ color=”#8224e3″ position=”left”]

[vc_list_item]Incident and Vulnerability management – Designed and implemented an IT security incident and vulnerability management process and toolset to allow IT to identify and manage security incidents and vulnerabilities.[/vc_list_item][vc_list_item]Acting as the Technical IT gateway for ISO 17799/BS7799 compliance.[/vc_list_item][vc_list_item]Maintaining all External Connection Documentation (Change management of technical external connections).[/vc_list_item][vc_list_item]Designed and implemented an employee Internet cafe in the Reading and Cardiff offices to allow safe Internet use without compromising on the security of our customers and corporate information.[/vc_list_item][vc_list_item]Server Administration (Windows Server 2000/2003, Red Hat Enterprise Linux, AIX,Linux).[/vc_list_item][vc_list_item]Design and implementation of Cisco Local Area Network [LAN], Wide Area Network [WAN].[/vc_list_item][vc_list_item]Design, implementation and maintenance of Internet Services architecture (Cisco Internet Routers, Load Balancers, Checkpoint FW-1, Cisco PIX, DMZ services,ISS RealSecure Intrusion Detection solutions) and Proxy Services (Microsoft Proxy).[/vc_list_item][vc_list_item]Performing penetration testing and IT system security assessments.[/vc_list_item][vc_list_item]Design and implementation of Remote access services (IPSEC VPN, SSL VPN, Dial in backup) utilising Two Factor Authentication (RSA SecurID).[/vc_list_item][vc_list_item]Email and Directory Services (Microsoft Exchange 2000/2003, DNS/Bind, SMTP Internet Mail Relay).[/vc_list_item][vc_list_item]Design, Implementation of system and application monitoring solutions (Big Brother, Solar Winds, MRTG).[/vc_list_item][vc_spacer]

ING Direct
Reading, United Kingdom

[vc_heading title=”Systems Engineer” position=”left”][vc_heading title=”January 2003 – June 2003 ” color=”#8224e3″ position=”left”]

[vc_list_item]Launch – part of the initial project team implementing ING Direct into the UK market.[/vc_list_item][vc_list_item]Supporting End to End Transactional applications covering Front End Services (IBM HTTP Server [IHS],Microsoft Internet Information Service [IIS], Middleware Services (IBM Websphere application server [WAS], IBM Message Queue [MQ]) and Backend Services (Oracle Database Server, Profile Financial System).[/vc_list_item][vc_list_item]Setup and implementation of the banks core Payment Services (Microgen Payment system [PCS], Bankers Automated Clearing System [BACS]).[/vc_list_item][vc_list_item]Server Administration (Windows Server 2000/2003, AIX, Linux).[/vc_list_item][vc_list_item]Design and implementation of Cisco Local Area Network [LAN], Wide Area Network [WAN].[/vc_list_item][vc_list_item]Design, implementation and maintenance of Internet Services architecture (Cisco Internet Routers, Load Balancers, Checkpoint FW-1, Cisco PIX, DMZ services,ISS RealSecure Intrusion Detection solutions) and Proxy Services (Microsoft Proxy).[/vc_list_item][vc_list_item]Email and Directory Services (Microsoft Exchange 2000/2003, DNS/Bind, SMTP Internet Mail Relay).[/vc_list_item][vc_list_item]Design and implementation of Remote access services (IPSEC VPN, SSL VPN, Dial in backup) utilising Two Factor Authentication (RSA SecurID).[/vc_list_item][vc_list_item]Design, Implementation of system and application monitoring solutions (Big Brother, Solar Winds, MRTG).[/vc_list_item][vc_list_item]Setup and implementation of the banks customer and internal Telephony services (Interactive Voice Response [IVR], Avaya Definity Telephone System, VDN, ACD, Computer Telephony Integration [CTI]).[/vc_list_item][vc_spacer]

Bluewave
London, United Kingdom

[vc_heading title=”Systems Lead Engineer” position=”left”][vc_heading title=”August 2002 – November 2002″ color=”#8224e3″ position=”left”]

[vc_list_item]Managed Services Monthly reports (Availability, Capacity and Performance Management, Patch Management, Server administration, security assessment and incident management).[/vc_list_item][vc_list_item]Systems architecture design (Network Infrastructure, Server Infrastructure).
[/vc_list_item][vc_list_item]Re-design of Managed Services infrastructure to provide additional growth, redundancy and capacity.
[/vc_list_item][vc_list_item]Coordinating ISO 17799/BS7799 Security compliance.[/vc_list_item][vc_spacer]

Vignette (Now part of Opentext)
Maidenhead, United Kingdom

[vc_heading title=”Solutions Architect” position=”left”][vc_heading title=”May 2000 – August 2002″ color=”#8224e3″ position=”left”]

[vc_list_item]Pre-sales: Providing expertise to support the sales team and our future customers in selecting and successfully implementing products within their organisation.[/vc_list_item][vc_list_item]Implementation: Providing architecture / design, documentation and implementation services.[/vc_list_item][vc_list_item]Post-Sales: Setup an on-site critical situation troubleshooting support practice to enable on-site support for enterprise customers experiencing critical issues affecting production use of our products, Proof of Concept design and build), Architecture and Design (Requirements gathering and documentation of architectural design) and implementation (Architecture, Project Management, Systems Engineering).
[/vc_list_item][vc_list_item]Systems Implementation of Vignette solutions and systems configuration of :

Operating Systems: Solaris, AIX, Windows Server 2000

Application Services: Apache Web Server, IBM HTTP Server, Netscape Enterprise Server, Microsoft Internet Information Server, IBM Websphere, BEA Weblogic Server, Tomcat, iPlanet Application Server

Enterprise storage solutions: Network Appliance, Sun Network File System [NFS], IBM Distributed File System [DFS]

Database administration: Oracle, Microsoft SQL Server
[/vc_list_item][vc_list_item]Provided consultancy to the following organisations:

Financial Services: Barclays (UK), Lloyds (UK), Societe General (France), UBS Warburg (UK), ING Post Bank (Holland), Volkswagen Bank (Germany), WestLB Bank (Germany), AMB Generali (Germany), ABSA (South Africa), Banco Santander Central Hispano (Spain), Zurich Insurance (Spain)

Telecom: BT (UK), Nokia (Finland), Skanova (Sweden), Telia (Sweden),BskyB (UK)

Others: FIFA 2002 (UK), TF-1 (France), Sportal (UK), Diageo/Guinness UDV (UK), BMW (UK).[/vc_list_item][vc_list_item]Technical mentoring of the architecture team, with a goal of imparting knowledge and understanding of the various services and infrastructure solutions that the company’s products and solutions integrate with.[/vc_list_item][vc_spacer]

Autodesk
Neuchatel, Switzerland

[vc_heading title=”Network Engineer” position=”left”][vc_heading title=”April 1999 – May 2000″ color=”#8224e3″ position=”left”]

[vc_list_item]Designed, implemented and documented a VPN Solution within EMEA giving small offices and home office user’s access to the corporate network via secure Internet access. (Replace the existing infrastructure with cost effective alternative using Internet and Cisco IPSEC VPN).[/vc_list_item][vc_list_item]Implementation of Packet shaper Bandwidth management appliances and Quality of Service on the Global WAN to ensure that critical applications (SAP, Proxy, Database, Replication) had lowest latency and enough bandwidth to operate effectively.[/vc_list_item][vc_list_item]Maintained the Autodesk Internet Network Services comprising of Cisco PIX Firewalls, Cisco Routers, and Cisco Switches to ensure that the DMZ is sufficiently secure and available.[/vc_list_item][vc_list_item]Managed the Autodesk Wide Area Network [WAN] comprised of a hub and spoke setup using Cisco Routers communicating via Leased Lines (Frame Relay) and Internet Connectivity (IPSEC VPN) covering 20 EMEA and 30 US sites.[/vc_list_item][vc_list_item]Managed Autodesk Remote Access Service [RAS] using Ascend MAX Dialup and ISDN / Nortel Contivity VPN services.[/vc_list_item][vc_list_item]Maintained the Autodesk Local Area Network [LAN] comprising of Cisco Routers and Catalyst 5500 Switches.[/vc_list_item][vc_spacer]

Autodesk
Neuchatel, Switzerland

[vc_heading title=”Internet Systems Architect” position=”left”][vc_heading title=”July 1997 – March 1999 ” color=”#8224e3″ position=”left”]

[vc_list_item]Managed all aspects of customer facing web services, intranet services and employee Internet access. (DNS/Bind, Netscape Enterprise Web Servers, Netscape Proxy Servers, Sendmail, Cisco Routers, Cisco PIX Firewalls, Vignette StoryServer, Web Servers)
[/vc_list_item][vc_list_item]Designed, Developed and implemented service availability tools to monitor Internet services (Perl, Sed, Awk, Ping, Traceroute, Telnet, Webget, Shell scripts) and alert Support teams when issues arise.
[/vc_list_item][vc_list_item]Performed Vulnerability assessments and security audits of Internet Security infrastructure and internet applications. (Solaris, Windows, Cisco, Netscape, Vignette)[/vc_list_item][vc_spacer]

Autodesk
Neuchatel, Switzerland

[vc_heading title=”Information Systems Technical Specialist” position=”left”][vc_heading title=”February 1996 – June 1997 ” color=”#8224e3″ position=”left”]

[vc_list_item]Working as part of a global team, implemented a worldwide Autodesk Domain across three data centres. (Windows NT Advanced Server Primary Domain Controller [PDC] in San Francisco and two Backup Domain Controllers [BDC] in Neuchatel and Tokyo) This included the migration from Novell Network 3 to Windows as our primary authentication directory and file services platform.
[/vc_list_item][vc_list_item]Managed and Implemented an enterprise based backup system for our Sun Solaris Source Control systems (CVS running on Sun Solaris)
[/vc_list_item][vc_list_item]Managed all Sun Solaris, Microsoft Windows NT and Novell NetWare servers across Autodesk (EMEA).[/vc_list_item][vc_spacer]

Autodesk
Neuchatel, Switzerland

[vc_heading title=”Technical Services Specialist” position=”left”][vc_heading title=”March 1992 – January 1996″ color=”#8224e3″ position=”left”]

[vc_list_item]Designed and Implemented a Media testing process and toolset to ensure that Physical media master disks were correct (Exact gold master by Hashing/Check Sum) and free of any malicious content (Antivirus Scanning via Norton, McAfee, Sophos and Dr Solomon products) then ensuring that version control in place to track exact build/hash before being sent to Sony DADC in Austria for production manufacturing.[/vc_list_item][vc_list_item]Designed and implemented a Defect Tracking System for use with the Software Centre.[/vc_list_item][vc_list_item]Message and GUI comparison tools to allow product separation from translated text and graphics. Allowing translators and testers to test and compare strings before end to end integration testing. Used QA Partner and built software libraries to perform image comparison with masking of areas to prevent false positive on translated text changes.[/vc_list_item][vc_list_item]Setup and managed the Remote Access Bulletin Board Service (BBS) to allow sharing of files with Localisation contractors working from offsite worldwide locations. Used RA BBS Software and Haynes Modems (2400 and 9600 baud) to support facility.[/vc_list_item][vc_list_item]Set-up and maintained the Autodesk Localisation ports lab for porting AutoCAD to the following platforms, Sun Solaris, IBM AIX, HP-UX, SGI IRIX, Apple Macintosh with operating systems and applications running in French, German, Italian and Spanish. Systems Administration of the hardware, operating systems and AutoCAD builds.[/vc_list_item][vc_list_item]Managed the Local Quality Assurance network and file server infrastructure to support Quality Team. File server infrastructure was Sun Solaris (Sun Sparc running SunOS 5) and Novell Netware 3 (HP Server running Netware 3.11).
[/vc_list_item][vc_list_item]Developed internal tools to aid the localisation of Autodesk products in C/C++.[/vc_list_item][vc_spacer]

Autodesk
Guildford, United Kingdom

[vc_heading title=”Quality Control Assistant” position=”left”][vc_heading title=”January 1990 – February 1992″ color=”#8224e3″ position=”left”]

[vc_list_item]Managed production quality checks for media production facilities (Trace/Mountain Duplicators).[/vc_list_item][vc_list_item]Software Quality Assurance of the AutoCAD AEC Architectural Product (AutoLISP).[/vc_list_item][vc_list_item]Development of database to aid in calculating disk/media failure and sample rates (Clipper/dBase).[/vc_list_item][vc_spacer]

Insurance Courier Services (ICS)
Watford, United Kingdom

[vc_heading title=”Analyst/Programmer and IT Support” position=”left”][vc_heading title=”April 1987 – December 1989″ color=”#8224e3″ position=”left”]

[vc_list_item]Development of database applications (Dbase/Clipper).to support the business (Customer, Delivery and Payments).[/vc_list_item][vc_list_item]Supporting the business by providing IT Desktop Support (IS Help-desk).[/vc_list_item][vc_list_item]IT Server support (Novell NetWare 2.x).[/vc_list_item][vc_spacer]

Samson Bond
London, United Kingdom

[vc_heading title=”Analyst/Programmer and Client Support” position=”left”][vc_heading title=”January 1986 – March 1987″ color=”#8224e3″ position=”left”]

[vc_list_item]Development and maintenance of an accounting and stock control system written in PL/I.

[/vc_list_item][vc_list_item]Customer support (presales and post sales support).

[/vc_list_item][vc_spacer]