Sasa Ivanovic Email & Phone Number

• Responsible for enterprise-wide Information Risk Management (IRM) program.
• Accountable for all enterprise data protection, including information security policy and strategy, incident response, cyber threat intelligence, supplier risk management, client audit and go-to-market support.
• Implemented on time (2016-2019) and budget Information security master program, containing 110 security controls. Master plan was response to changing risk environment where threats like APT were considered.
• Led PCI DSS program and achieved successful re-certification (from 2015 to 2020) enabling organization to have new business opportunities.
• Adapted information risk management practices into company-wide STAMP project management methodology;
• Influenced strong, company-wide security culture through awareness

• Security consultancy related to the Local regulations and Industry best practices
• Risk assessment
• Documentation development and review
• Permanent supervision
• Internal audit requirements fulfillment
• Information security awareness

• Information security management
• Compliance with the Group’s requirements
• Compliance with local laws and regulations related to Information Security
• Advisory function

• Information security management
• Compliance with the Group’s requirements
• Compliance with local laws and regulations related to Information Security
• Advisory function

• Re-engineering of information security program while taking into consideration - PCI DSS, Basel II, ISO 27001 and industries best practices.
• Local implementation of Erste Group’s Directives and standards
• Reporting about Information Security state in Erste Bank Serbia, during Quarterly held Information Security Managers meetings in Holding’s premacies.
• Participating in Cluster’s activities i.e. regional projects
• Gap analysis for National Bank of Serbia and legal compliance issues
• Security awareness training program development

• Information security program re-engineering
• Tracking legislation changes for Information Security Compliance issues
• Participating in development of new and reviewing of existing policies and standards
• Conducting security related awareness trainings (more then 300 hour of lecturing)
• Assessing compliance with Information Security Policies
• Triggering Internal Audit missions

Bachelor Degree, Networking And Databases

Master'S Degree, Management - Process Reengineering And Quality Assurance

Master In Business Informatics, Programming And Information System Development

Activities and Societies: Participated in security audit of E-Smart Systems d.o.o company. E-Smart Systems d.o.o is IT security service.