Stefano Terraneo Email & Phone Number

Bioggio, Ticino, Switzerland

Manage the client relationship from the security governance perspective throughout the lifecycle of the client IT and Business processesContribute to the definition of the client specific security baseline and act as single point of contact for client audits executionConsult and advise internal and external clients about security topics and support the opportunity management process by providing subject matter expertise and supportManage the Security SLA governanceBank C-level executives are the primary interlocutors: CISO, CSO, COO, CIO, CRO, CIA,..

Lugano, Canton Ticino, Svizzera

Management of information security risks for outsourced services, corporate and compliance projectsMain duties:1. Outsourcers / Vendors Risk Management- Conduction of assessments / audits at the group's outsourcers/vendors based on security frameworks like ISO 27001: 20013, GDPR, PCI/DSS, Cloud Security Alliance (CSA)- Definition of mitigation measures and security controls to be introduced at project and contractual level2. Compliance Risks- Assessment of national and international regulators requirements regarding data protection- Definition of compliance plans and adequate controls, update of the information security policies3. Bank projects- Definition of security requirements at applications/infrastructure level.- Coordination of vulnerability assessment and penetration testing activities, definition of remediation plans4. Incident Management- Management of information security incidents (internal and/or with outsourced services)5. Security Audits- Interfacing with auditors during internal or external audits and management of findings.

Lugano, Ticino, Switzerland

In charge of the Information Security Governance Risk & Compliance (GRC), performing all activities required to ensure proper oversight, risk management, and compliance with legal, regulatory, policy, and other security related requirements which the organization is required to comply with.Main activities:- Risk management: establish an information security risk management strategy, process, and program- Perform global and vertical risk assessments / audit. Definition of controls (countermeasures, KRIs,..)- Compliance: Ensure that controls are adequate to meet legal, regulatory, policy, standards, and security requirements- Define, implement, and enforce information security framework and policies- Implement an enterprise-wide role-based information security awareness and training program- Governance of the outsourcers’ security (assessment, security controls definition, monitoring, audit)

Lugano, Canton Ticino, Svizzera

Beyond the CISO role, appointed as Chief Security Officer for the BSI Group. In scope: protection of information, people, building and physical assets.Main activities:• Definition of a a risk driven strategy which demonstrates the Company's commitment and establishes the security objectives and plans that are in line with the strategic direction of the Bank. • Definition of a business operational risk driven and control framework to security Management, aimed to establish, implement, operate, control, review and improve the security within the Group.• Management of the assigned resources to determine their adequacy in term of number and competences, in order to support the security objectives and plans and ensuring that all personnel are competent to perform the required tasks.• Internal and external communication related to security issues. International and external counterparts coordination• Maintain proactive relations with the needed stakeholder and reporting to the Organization’s Management • Coordination of the Group Security Officers

Lugano, Switzerland

Duties: as a CISO, definition, implementation and application of the Information Security Management System (ISMS) based on ISO 27001:2013.Main activities:1. Governance and Strategy • Definitions of information security strategies • Definition and management of information security budget • Interfacing with the bank's management regarding the reporting of risks, incidents, safety strategies. • Management and planning of internal and external resources. • Coordination of the group Security Officers2. Regulatory aspects and training • Drawing up and updating of the regulatory framework for Information Security (regulations and procedures) addressed to the employees and other technical areas. • Evaluation of the requirements of national and international regulators (FINMA, Singapore MAS, HKMA , ..) and definition of compliance plans. • Security awareness programs preparation and delivery in several languages ​​(Italian/German/English/French) 3. Projects • Definition of the security requirements in the bank projects. • Basing on the risk assessment results, definition and conduction of information security initiatives/projects. • Vulnerability assessment and penetration testing activities coordination, finding evaluation4. Outsourcing • Conduct outsourcer security assessments and audits. • Definition of security controls to be introduced in the outsourcing contracts.5. Risk Assessment and Audit • Conduction of risk assessments based on internally developed methodologies. • Interfacing with auditors and information security findings management6.Incident Management • Management of information security incidents.

Lugano, Switzerland

Lugano, Switzerland

Lugano, Switzerland

Lugano, Switzerland

Lugano, Switzerland

Zug, Switzerland

Zug, Switzerland