Page * of *

JAWAID IQBAL FAZL KARIM

PO Box *****, Al Khobar, Saudi Arabia

Email : adejgb@r.postjobfree.com, adejgb@r.postjobfree.com

Cell Phone: 009**-***-***-***

SABSA Chartered

Security Architect

Foundation /

Practioner (Trained)

QMS 9001 LA

ISMS 27001 LA

Profile

Digital Transformation agent with extensive information technology, information Security, Security Architecture & Governance Risk Compliance GRC expertise achieving unparalleled result while bridging the gap between technical experts and company executives/boards. Seasoned leadership and management skills with ability to organize technology projects, improving team efforts and positively individuals and teams to produce. Adept with interpersonal oral and written skills with individuals and teams and at all levels throughout any organization. Skills

Information Governance

IT Governance Framework

IT Policies, Procedures, Roles & Responsibilities

Information Risk Assessment & Compliance

Information Security Program Management

Information System Governance – APQC’s PCF

Enterprise Security Architecture:

SABSA Enterprise Security Architecture

Security Design and Architecture Review

Business Architecture and BPM

Enterprise-wide Change Management

Virtualization & Could Computing

Information System Security and Audit

Information Systems Audit Program Development

IT network, System & Application Security

Incident Response, Business Continuity Planning

Vulnerability Assessment & Penetration Testing

Data Protection, Regulatory compliance,

Legal and Regulatory Compliance

Standards Implementation & Compliance

ISO27001/2, ISO 20000, CObIT5, ITIL, PCI-DSS, HITRUST

ISO 22301 – Business Continuity, NCEMA, NESA

NIST Cyber Security Framework, NIST Standards -800 52/53, 82,

ISA/IEC 62443, NERC CIP v3/v6, Cyber Resilience Review

SAMA Cyber Security Framework, NCSC Cybersecurity Controls

SWIFT Customer Security Controls Framework

Digital Forensics and Threat Analysis

digital forensics policies and systems - Development and implementation

Forensics Reports developments

Test and Validate mobile Application functionality

Project Delivery & Operational Excellence

Corporate Planning & Strategic Technology Initiatives

Emerging Technology Assessments

Team Building and Management

Knowledge Management

Accomplishment

Leadership

• Develop and implemented enterprise security strategy and framework that consists of strategically integrated elements SABSA, ISO 27001/27002, SANS Critical Controls.

Strategy and Planning

• Developed, established and implemented security policies, procedures, standards and guides and frameworks.

Team Collaboration

• Collaborated with company departments to establish security framework to accomplish IT security objectives and leverage common tools reduce cost

• Defined and established unified program-wide approach to address IT Security issues and mitigate security risks

Project Management

• Managed project planning and delivery related to Information security framework, SOC implementation, Security Audits.

Areas of Experience

Industries:

Manufacturing, Engineering, Financial Services and Utilities Technology Profile

Enterprise Architecture Frameworks: The Open Group – TOGAF; Zachman, SABSA,

Defensible Security Architecture: Zero Trust Architecture, Router & Switches (L2, L3) Firewall, NGFW, NIDS/NIPS, Active Directory, VPN, IPSec, Encryption and Cryptography, Sandboxing, PKI, digital signature, Endpoint Detection & Response DR, Security Monitoring -SIEM

Page 2 of 8

Data-Centric Security: Full Stack Security Architecture (Web Server, Application Server, Database Server), Web Application Firewalls, Data Loss Prevention, Mobile Device Management, Mobile Application Management, Data Loss Prevention DLP, Data Governance

Project Frameworks and Methodologies: Microsoft Solution Framework, Agile (Scrum, XP), Project Management BOK

Architecture Methodologies: Service Oriented Architecture, Cloud Computing Architecture, Enterprise Application Integration, Webservices, microservices

Architecture Tools: ADOit, ADONIS, BizzDesign, Enterprise Architect

Audit or Risk Management Software: Pentana, MetricStream, SimpleRisk, AutoAudit software

Frameworks/Change Management Tools: Team Foundation Server, Visual Studio Team Services, GIT

COBIT/COSO/ISO 27001/ITIL/SABSA: Orbus, ManageEngine, MOF

Systems and Software: Windows Servers, MS Exchange, MS SQL, Oracle, MS Azure

Vulnerability and Event Correlation Tools: Rapid 7, McAfee Enterprise Security Manager (ESM), Nessus, Qualys,

Penentration tools: Metasploit, Kali Linux, cuckoo sandbox, IDA, OllyDBG, WinDBG, metasm, ltrace, strace, volatilitux, sleuthkit, burp, OpenVAS, Nessus, Nexpose, nmap, w3af, TamperData

Digital Foresnics: SANS SIFT, Volatility Framework, The Sleuth Kit (+Autopsy), CAINE, Xplico, FTK, X-Ways Forensics

Security Operation Center: Splunk, ELK Stack (Elasticsearch, Logstash, and Kibana)

Languages/Technologies: Java, C++, ASP, HTML, DHTML, PL/SQL, SQL, UML

Databases: Oracle 8i/9i 10g, SQL Server, MS Access

Cloud: Windows Azure, Amazon EC2

PROFESSIONAL WORK EXPERIENCES

Cyber Security Consultant / Director Period December 2017 to Present Golden Rocks Services / AlShorouk Business Optimization Solutions – Cyber Risk and Security Consultancy

Information Security, Governance, Risk Management, and Compliance (GRC) Services Provided: o Lead IT Risk and control assessment; Business Impact Analysis; Risk mitigation and corrective action plan development, documenting and tracking risks mitigation efforts; analysing business processes and develop process improvement plan, implementing a governance framework; develop policies, standards and procedures to comply with organizational, regulatory and industry requirements; security awareness training; specialized training for technical staff and executives. o Lead the developed of enterprise information security framework. Ensuring data integrity, confidentiality and availability of information as well as creating controls on how data is processed by the organization. o Lead development of security architecture based on SABSA Security Architecture Framework o Developed methodologies to perform risk assessment, business impact analysis, and security assurance to improve systems and operational security

o Lead developing, implementing, improving and effectively managing security processes, programs, procedures and policies (BCP, Incident Response Planning, Risk Management, Vulnerability Management, and Privacy) to meet regulatory requirements

o Lead research and development of intrusion prevention models using a trusted framework and an anomaly approach.

o Lead Creation of IT security technical reference architecture and documented current state security capabilities, current state gaps and future state roadmap aligned with IT and business strategies o Lead evaluation, selection and implementation of following tools: Governance, Risk and Compliance (GRC), security information and events managements (SIEM), Automated penetration testing, application white listing, Data Loss Prevention, Intrusion detection and Prevention system (IDS/IPS), web filtering, malware defence systems for endpoints & network perimeter, and mobile device management. o Lead projects in the areas of Identity and Access Management, perimeter defence, wireless security, compliance audit, and evaluation.

Page 3 of 8

o Lead development of appropriate metrics and analytic reporting in order to have a solid understand of the operation issues and provide value reporting to the stakeholders.

SOC and Threat Management: Lead development, implement, and manage standard operating procedures for monitoring and incident handling program, network cyber security platforms, digital forensics and e-discovery program vulnerability management, penetration and application testing activities threat intelligence and threat hunting programs

Lead Implementation of automated process to manage change management for all security related infrastructure and architecture changes

Financial Sector Compliance Services

o Carried out Compliance review of following areas with respect to Saudi Arabian Monitoring Authority applicable standards and procedure guidelines:

Saudi Payment Network – SPAN

Saudi Arabian Interbank Riyal Express

PCI DSS Compliance Review

Utilities Sector Cybersecurity

o NIST Cybersecurity Framework Compliance and Maturity Assessment

Identify Gap of NIST CSF implementation

Identify Maturity level of Functions in accordance with Capability Maturity Model

Identification areas of improvement and Recommendations to improve the Capability Maturity level. ITQMS- MANAGER Period August 2003 to August 2017

Pan Gulf – Al Khobar, Saudi Arabia

Information Security Architect

o Subject matter expert and security architect for all security efforts across multiple IT programs. Advises executive management and representatives on security best practices for systems providing data to critical operations. Worked closely with users and technical personnel to evaluate, design and select solutions which suited their needs

Security architect for integration of multiple products to form defence-in-depth strategy for corporate information technology assets.

Policy formation and integration with security practices

Implemented penetration testing program for web architectures based upon OWASP top 10. Tests for XSS, SQL injection and other common vulnerabilities.

Lead risk assessment and reporting team, resulting in 80% reduction in security findings.

Chief architect of infrastructure security practices to include virtualization technologies which were used as a model for all future customer sites.

o Established the security and change/configuration management policies and procedures, advised and implemented infrastructure support for local/regional units and their expansion by providing the implementation, oversight, and management of network, operations, LAN, storage, PC’s, and client servers.

o Plan the infrastructure and operations for datacentres operations and successfully supported locally and remotely including disaster recovery.

o Lead implementation of security policies & procedures that focused on upgrading firewall, network, virus/spam protection tools, messaging systems and protection of agency sensitive information o Manage all external vendors, production support, LAN, enterprise architecture, enterprise systems, mobile handset management, data warehousing, and disaster recovery. Also determined capacity plans and managed project teams regionally.

o Manage Systems Vulnerability Assessment and Penetration Testing. o Monitor Security Vulnerabilities, Network and Host Intrusion Page 4 of 8

o Detection/Prevention Systems, Access Rights and Authorization of user IDs and group/profile memberships.

o Information Security Awareness and Training

Information System Risk Assessment and Auditing, Business Continuity o Document and maintain a Risk Management Framework and provide guidance and support to management on the tools and systems to monitor organizational, operational risk. o In conjunction with the Executive and management team develop a risk management strategy o Develop the tools to allow Leadership to maintain a Business Continuity Plan across all units. Assist business units with:

Assessment of potential business impact.

Definition of critical, time-sensitive functions.

Design, development, and documentation of work area (business function) business continuity plans. o Recommend recovery strategies and options, and assist with the implementation of recovery solutions. o Coordinate business continuity plan exercises.

o Develop schedules for training / awareness for business units. o Coordinate development of business unit schedules for annual business continuity documentation, maintenance and update, exercises, and independent review and validation. o Report the business continuity status of business units to senior management. o Provide expertise and support to management and business functional areas, as requested, when a business disruption occurs.

o Leads the design, implementation, operation and maintenance of the Information Security Management System based on the ISO 27000 series standards, including certification against ISO 27001 where applicable o Leads or commissions the preparation and authorizes the implementation of necessary information security policies, standards, procedures and guidelines, in conjunction with the Security Committee o Leads the design and operation of related compliance monitoring and improvement activities to ensure compliance both with internal security policies etc. and applicable laws and regulations o Leads or commissions suitable information security awareness, training and educational activities o Leads or commissions information security risk assessments and controls selection activities o Leads or commissions activities relating to contingency planning, business continuity management and IT disaster recovery in conjunction with relevant functions and third parties. o Leads Identification of Security solutions, testing and recommendations. o Vetting new applications using application Security checklist. o Reviewing and update Information Security Policies. o Performing Risk based Audit and reporting for IT Systems in the area of :

Software Development and Testing;

Software Changes;

Data Processing input and Output;

Application Controls; Access Control; Utilization; and Operation readiness. o Identifying and Auditing the IT general controls for adequacy, collecting and analyzing samples for testing the effectiveness of the controls.

o Perform SDLC audits for in house developed applications. o Perform key compliance audits and identifying critical IT vulnerabilities / issues in the applications which could lead to revenue leakage.

o Analyze risks related to new technologies (Convergence technologies). o Providing support to cross functional entities on Information Security requirements. Page 5 of 8

o Preparing Standard Audit Program in lines with IS Policy and ISO 27001. o Preparing and updating Network Assessment methodology. o Reviewing detailed BCP for Disaster recovery and identifying and reporting Audit risks. o Preparing questioners for various departments to identify the Organizational Information security needs. o Identifying security products, evaluations and provide a proof of concept based on different security technologies to the team.

o Conducting internal investigations relating to Information leakages. o Developing Information Security Policies and Procedures. o Monitor Security Vulnerabilities, Network and Host Intrusion o Detection/Prevention Systems, Access Rights and Authorization of user IDs and group/profile memberships.

o Information Security Risk Assessment, Documentation and Remediation. o Incident Monitoring, Response, Investigations and Reporting, o Information Security Awareness and Training.

Organization Learning and Knowledge Management

o Analysis of user information and knowledge needs, for example, through questionnaires, interviews, focus groups and other relevant methods. These analyses will focus on particular staff groups or networks working on topics of common interest and will involve staff in all organization of group. o Contributing results of analysis to design, delivery, maintenance, evaluation and development of online information and knowledge systems to meet the needs of target audiences. o Promote knowledge sharing among Pan Gulf organisational units through its operational business processes, strengthening links between knowledge sharing and information systems, and improving integration of information systems.

o Maintain a pro-active view of the organization’s capability to deliver service by trending against performance and quality statistics.

o Analyzing organization competencies and capabilities requirements against long and midterm strategic plan.

o Developing competencies framework that align organization Talent Management objectives with corporate goals and provide positive operational outcomes o Training conducted

ISO 27001:2005 Awareness

ISO 27001 and Internal Control

Strategic Leadership Imperatives

Transformational Leadership

Leadership and Emotional Intelligence

Risk Management: Concept and Implementation

Scenario Analysis and Risk Management

Balanced Scorecard and Implementation

Data Analysis Effective techniques

Six Sigma Champion

INFORMATION MANAGER Period Jan 1998 to November 2000 Juma Al Majid Dubai U.A.E

Description of Role:

o Undertake a short term Enterprise wide high level review of Working Links IT systems, and produce a technical document. Scope included Business, Application, Infrastructure, Data and Security architecture. o Document included identified concerns and issues which would be risk assessed and resolved by the business as usual IT team

Page 6 of 8

o Provided solution architecture support for project development and maintenance activities. o Developed portfolio of business solutions to improve productivity. o Provided guidance to marketing team during project launch phase. o Proposed new architectural frameworks based on business trends. o Performed upgrades to solutions to meet changing business needs. o Participated in development of business plan and financial models. o Participated in business development discussions with cross-functional teams. o Carried out performance and scalability assessment activities. o Co-ordinate test procedures, activities, testing, integration testing, and system configuration tool. o Designing and executing manual test plans and test scripts for complete modules and/or workflows. o Converting business requirements into test plans and test cases. o Working closely with software developers to develop test specifications and build test cases to rigorously test product functionality and investigate all potential product test failures. o Bug fix verification and validation.

IT MANAGER Period January 1993 to June 1995

Wahid Industries Limited Gujrat Pakistan

Description of Role:

o Plan, organize, direct, control and evaluate the operations of information systems and electronic data processing (EDP)

o Develop and implement policies and procedures for electronic data processing and computer systems operations and development

o Meet with managers to discuss system requirements, specifications, costs and timelines o Hire and manage information systems personnel and contractors to design, develop, implement, operate and administer computer and telecommunications software, networks and information systems o Carry out all technical requirements for the systems including system planning, set up and enhancement with close information exchange to future users;

o define functionalities according to data, retrieval and information needs; o establish and maintain a structure to effectively identify and handle data for targeted efforts; o establish quality control; presentation and information; installation; to ensure accuracy and integrity of the database and act as focal point for all related questions and functions with support and advice. o Control the computer systems budgets and expenditures o Ensure technology is accessible and equipped with current hardware and software o Installation of Oracle Software and Databases.

o Maintaining strong database level security.

o Upgrading and Patching Oracle software and databases. o Deployment of strong disaster recovery plans as per SLA. o Performance Tuning and proactive database tasks. o Maintain proper documentation for future usage.

EDUCATIO NAL QUALIFICATIONS

Master in Computer Science: The University of Punjab – Pakistan in 1991

Bachelor in Science: The University of Punjab – Pakistan in 1988. INFORMATION TECHNOLOGY QUALIFICATIONS ACHIEVEMENTS

CERTIFIED IN THE GOVERNANCE OF ENTERPRISE IT - CGEIT

CERTIFIED INFORMATION SECURITY MANAGER - CISM

Page 7 of 8

CERTIFIED INFORMATION SYSTEMS AUDITOR – CISA

CERTIFIED IN RISK AND INFORMATION SYSTEM CONTROL – CRISC

EC-Council Certified Information Security Officer

SABSA Chartered Security Architect Foundation - SCF

CERTIFICATE OF CLOUD SECURITY KNOWLEDGE – CCSK

CERTIFICATE OF TOGAF FOUNDATION

CERTIFICATE IN SOFTWARE QUALITY MANAGEMENT

ISO 27001: 2007 Information Security Lead Auditor.

ITIL v4 Foundation

CoBIT 2019 Foundation

GIAC Security Training

GIAC Security Leadership Certificate - GSLC (SANS MGT 521 SANS Security Leadership Essentials)

GIAC Security Essentials (GSEC) - SEC401: Security Essentials Bootcamp

GIAC Continuous Monitoring Certification - SEC511: Continuous Monitoring and Security Operations

Global Industrial Cyber Security Professional (GICSP) - ICS410: ICS/SCADA Security Essentials

GIAC Critical Control certification – GCCC (SEC566: Implementing and Auditing the Critical Security Controls - In-Depth)

GIAC Certified Forensic Examiner (GCFE) - SANS FOR408 (FOR500) Windows Forensics IT Management Training

ITIL V3 Foundation

CobIT 5 Foundation

SOA Certified Professional SOACP

ORGANIZATIONAL EXCELLENCE

ASQ CERTIFIED MANAGER OF ORGANIZATION EXCELLENCE / QUALITY

Six Sigma Black Belt

QUALITY, HEALTH & SAFETY, ENVIRONMENTAL AUDIT QUALIFICATIONS

ISO 9001:2008 Quality Management System Lead Auditor

OHSAS 18001:2007 Auditor

ISO 9001:2000 & Process Mapping

PROJECT MANAGEMENT QUALIFICATION ACHIEVEMENT

Software Project Management

Project Management

IT CPE

Private Cloud Computing and Infrastructure Management

Windows Server 2012 R2 Storage Jump Start: New Choices

Microsoft Desktop Virtualization

System Center 2012 SP1: Capabilities

Introduction to Hyper-V Jump Start

Introduction to the Microsoft Private Cloud

Private Cloud Computing and Infrastructure Management OTHER QUALIFICATION ACHIEVEMENT

Neuro Linguistic Program Practitioner

Certified Process Professional

Certificate Total Performance Scorecard

Page 8 of 8

Member of ISACA

Member of ISSA

Member of American Society of Quality

Member of International Society of Performance Improvement Personal Data

Nationality : Pakistan

Contact Telephone : 009***********

Home Telephone : 009***********

Email Address : adejgb@r.postjobfree.com,

Marital Status : Married and have 5 Children

Permanent Address in Pakistan : Faizabad, Street No.8, Gujrat Pakistan Phone No in Pakistan : 009***********

Miscellaneous Information

Driving License

Hobby: Reading and Research

Competent Communicator and Competent Leader as per Toastmaster International Management Skills

Leadership

o Motivates employees and utilizes their skills and knowledge. o Demonstrates values and communicates to team as part of team expectations. o Plans team direction and key outcomes to align with organizational strategy and objectives. o Strategic planning, development, implementation & review meet the business needs and reflected in team plans.

Budget Management

o Effectively plans, controls and executes the budget o Balances spending and saving, and appropriately allocates resources

Performance Development and Management

o Motivates employees as part of reviewing their progress and supporting them to achieve their goals. o Facilitates individual employee development program in line with the Performance Development Policy. o Gives employees regular, timely and balanced feedback about their performance. o Poor performance is managed effectively, and in accordance with the Counselling, Discipline & Termination Policy

Effective Communication

o Employees are treated with respect and are given equitable access to resources and support. o Speaks and writes in a manner that clearly, succinctly and appropriately transfers knowledge and delivers relevant information to employees.

Cultural Competence

o Able to respect the cultures of other people

o Able to communicate effectively with people from diverse backgrounds and uses an interpreter services

Contact this candidate