Sasa Ivanovic Email & Phone Number

• Responsible for enterprise-wide Information Risk Management (IRM) program. • Accountable for all enterprise data protection, including information security policy and strategy, incident response, cyber threat intelligence, supplier risk management, client audit and go-to-market support, vulnerability management, regulatory compliance and controls assurance.• Implemented on time (2016-2019) and budget Information security master program, containing 110 security controls. Master plan was response to changing risk environment where threats like APT were considered. • Led PCI DSS program and achieved successful re-certification (from 2015 to 2020) enabling organization to have new business opportunities. • Adapted information risk management practices into company-wide STAMP project management methodology; • Influenced strong, company-wide security culture through awareness • Chaired Information Security Steering Committee

• Security consultancy related to the Local regulations and Industry best practices• Risk assessment • Documentation development and review• Permanent supervision• Internal audit requirements fulfillment• Information security awareness • Served as point of contact related to the IT documentation, internally to the bank’s Organizational unit and Compliance department, externally for auditors• Processes improvement• DRP related planning

• Information security management• Compliance with the Group’s requirements• Compliance with local laws and regulations related to Information Security • Advisory function

• Information security management• Compliance with the Group’s requirements• Compliance with local laws and regulations related to Information Security • Advisory function

• Re-engineering of information security program while taking into consideration - PCI DSS, Basel II, ISO 27001 and industries best practices.• Local implementation of Erste Group’s Directives and standards• Reporting about Information Security state in Erste Bank Serbia, during Quarterly held Information Security Managers meetings in Holding’s premacies. • Participating in Cluster’s activities i.e. regional projects• Gap analysis for National Bank of Serbia and legal compliance issues • Security awareness training program development• Interacting with Internal Audit, Legal, Operational risk, Organisational and Administration departments, Business Continuity officer• Providing assistance while new banking services and projects were being introduced• Driving PCI DSS certification activities

• Information security program re-engineering • Tracking legislation changes for Information Security Compliance issues • Participating in development of new and reviewing of existing policies and standards• Conducting security related awareness trainings (more then 300 hour of lecturing)• Assessing compliance with Information Security Policies • Triggering Internal Audit missions • Managing and participating in projects • Coordinating Information Security Committee activities • Participating in Business continuity and Disaster recovery planning and Plan testing • Participating in Risk assessments• Bimonthly reporting to the Chairman of Executive board and monthly reporting to the Chairman of the Executive board • Interaction with Physical security, Internal Audit. Legal department…• Data privacy and „Poverenik“ interaction,• Managing and participating in projects related to the physical protection of the information assets i.e. physical access to the areas with sensitive hard copy documents etc.

Bachelor Degree, Networking And Databases

Master'S Degree, Management - Process Reengineering And Quality Assurance

Master In Business Informatics, Programming And Information System Development

Activities and Societies: Participated in security audit of E-Smart Systems d.o.o company. E-Smart Systems d.o.o is IT security service.