John Anthony O. Email & Phone Number

Finland

A part of Nordea’s second line of defence (2LoD) in Group Operational Risk (GOR) that provides Technology risk oversight and ensures that Nordea has adequate controls in place. I contribute by ensuring that Nordea IT risks are well understood, managed and I valuably influence the first line of defence to manage Technology related risks to risk appetite.ISO 27001 | NIS2 | DORA | EU AI Act • Participate in identifying, measuring, monitoring and reporting IT risks across the Bank.• Participate in the Risk and Control Self-Assessment and Change risk assessment to assess IT identified areas of inherent and residual risk.• Constructively challenge and proactively support the first line on risk management practices, regulatory compliance and control appropriateness.• Performing testing projects (assurance/auditing) across Nordea's Business Areas and Group Functions (1st line of defence), in accordance with the testing methodology and documentation requirements.• Monitoring the risk mitigation progress and effectiveness.• Report to Management, on the highest risks and topical or thematic risks and partner with the first line to enable the business to reach and maintain their risk appetite.• Assist in the review, analysis and revision of ICT Risk Management Framework (ICTRMF) in particular the risk and control requirements on IT stability.• Assist in preparation and review of responses to IT related regulatory requests.• Assist to build a culture of risk management in the organisation, to develop risk mitigation strategies by entities, process and/or project and to accumulate, synthesise and report on risks to management.• Assist in promoting and driving awareness on ICT risks and topics related to risk limits and appetite in risk meetings and committees.

Cloud Security (AWS/Azure) | GRC | Application Security | Identity & Access Management | Incident Management | Threat & Vulnerability Management | MDM/MAM | Data protection | Security Operations Center | Security TestingNIST SP 800-53 | ISO 27001 | PCI DSS | HIPAA | HITRUST | GDPR• Deliver hands-on security consultancy for clients, including technical assessments of cloud workloads, architecture reviews, report writing and presentations• Work with clients to provide tailored advice on securing their fast-moving, cloud native environments.

Helsinki, Southern Finland, Finland

Experience configuring security controls and developing architectures in a highly regulated industry according to various compliance standards and frameworksHIPAA | HITRUST | GDPR | NIST SP 800-53 | ISO 27001 This involved looking at security throughout the lifecycle of a project, from conception to production (and eventually to obsoletion) and shifting security left. It included:• DevSecOps (Security Linters, SAST, DAST, IAST)• Maturity Modeling (OWASP SAMM) • Ingraining security controls into new cloud deployments and building out security solutions into already running cloud workloads. (IAM, Security Groups, WAF, Network Segmentation, Encryption, Key Management)• Automating detection, incident response and remediation. (CloudTrail, CloudWatch, GuardDuty, Security Hub, Microsoft Defender for Cloud)• Governance as code (Cloud Custodian, Cloud Formation/AWS CDK, Terraform)• Participated in SOC2 Audit

Helsinki, Southern Finland, Finland

Tasked with ensuring security control implementation for On-prem/Private Cloud Data Center.• Security Operations (Firewall configuration reviews, Identity and Access reviews , log analysis)• Ensure compliance and participate in audits

Espoo, Southern Finland, Finland

In an ever evolving technology landscape, organizations need to keep ahead of the competitive curve by reaping the benefits of proactive risk and asset management. I'm tasked with maturing security controls to realize value (ROI) from information technology through inventory management, performance measurement, improving resource utilization, elevating enterprise wide compliance, risk management, supporting business continuity/disaster recovery planning, implementing industry best practices and continuous assessment. This harnesses and leverages the power of technology to increase end user satisfaction and improve operational efficiency there by meeting client/enterprise goals.

Turku, Southwest Finland, Finland

Kampala

Identifying, measuring, monitoring and reporting IT risks across the Bank. I worked to ensure that IT security/risk management was handled in alignment with the Bank's business strategy. Made certain that the risk mitigation controls were in line with the industry best practices, regularly tested and reviewed for sufficiency. Participated in audits, reviewed policies on information security and tested business continuity & disaster recovery plans/procedures. Building a culture of risk awareness and report on risks to management

Uganda

Maintain and up the throughput of the Network and domain at GPO: Uphold the reliability of the serversMaintain the confidentiality, integrity, availability and security of SQL application databasesManage and Maintain I.T. Network infrastructure:Ensure close to 24/7 uptime of the network. Routine analysis of Router and intelligent switch configurations to guarantee and monitor security, compliance, status of network.

Kampala, Uganda

Helpdesk duties.Troubleshooting Network, Database and System issues.

Bachelor Of Science (Bsc) Computer Science

Master Of Science (Msc) Tech. Information Security And Cryptography