Engineer / BCP-DR & GRC — Grégory Murer

BNP Paribas Fortis — Brussels, Belgium · Hybrid

Ensuring the bank stays resilient when it matters most. Leads the end-to-end lifecycle of BCP/DR testing across BNP Paribas Fortis’ Belgian entities, bridging Group-level strategy with local operational reality.

• Group-to-local alignment — Receiving Business Continuity & Disaster Recovery frameworks from Paris headquarters and translating them into actionable plans tailored to each Belgian entity’s operational, regulatory and technical context.
• Test orchestration — Designing, planning and driving the execution of BCP/DR exercises: tabletop simulations, failover tests, and full-scale recovery scenarios.
• Constructive challenge — Challenging business and IT teams on their continuity assumptions, recovery capabilities (RTO/RPO) and test readiness — because a plan that hasn’t been tested is just a hypothesis.
• Incident recovery decisions — Determining restart priorities and recovery sequencing following incidents, balancing business criticality, dependencies and risk exposure.
• Regulatory resilience — Contributing to compliance with operational resilience requirements (DORA, NBB/ECB expectations) through evidence-based testing and continuous improvement.
• Cross-entity coordination — Acting as the pivot between Group HQ, Belgian entities, IT operations and business lines to embed a genuine culture of resilience.

XpandIT.be — Liège, Belgium · Freelance / Hybrid

• CyberMurmureur; NIS2 / CyFun / DORA implementation stewardship; ISO 27001 audits; cybersecurity awareness.

iHub (Deep), subsidiary of Post.lu — Kayl, Luxembourg · On-site

• Led the identification, analysis, and monitoring of IT risk within a multi-entity regulated financial environment.
• Conducted technical risk assessments and cloud security evaluations (architecture and data-flow decomposition per OWASP Risk Rating and ISO 27005).
• Managed the full regulatory audit lifecycle: ISO 27001:2022, ISO 22301, DORA, and CSSF circulars, including third-party and supplier risk.
• Drove continuous improvement of risk management processes; coordinated cross-functional risk awareness initiatives.
• Acted as deputy/backup CISO, ensuring continuity of the CISO function and representing information security matters when the CISO was unavailable.

AXA Group Operations — Brussels, Belgium · Hybrid

• Primary point of contact for NIS2, ISO 27001, ISO 22301 and DORA across local entities; liaison with CISOs and Security Leaders.
• Owned risk-management dashboards for NIS2, ISO 27001, ISO 22301 and DORA programs.
• Coordinated risk-champion forums and produced compliance deliverables; disseminated requirements and risk culture.
• Led migration of the risk framework from NIS/OWASP to NIS2/CyFun; built KPI/KGI/KRI dashboards for senior management.
• Conducted risk/vulnerability/threat impact assessments; advised on remediation, hardening and supply-chain security controls.
• Point of contact for third-party security reviews and supply-chain risk assessments.
• Led group-wide rollout of Qualys vulnerability management across local AXA entities; coordinated deployment and SOC integration.
• Owned SOC use-case lifecycle: detection logic, alert-threshold tuning and collaboration with SOC analysts.
• Delivered CISO-as-a-Service coverage for local AXA entities without dedicated security leadership (Yuzzu, Ardenne Prévoyante, AXA IM).

IFAPME — Belgium · Freelance

• Hands-on cybersecurity bootcamp for ULG students: vulnerability assessments, penetration testing, cloud security, Bash/Python automation.

bpost — Belgium · Freelance / Hybrid

• Led security and compliance projects: risk assessment, budgeting, coordination of multidisciplinary teams.
• Implemented security frameworks and built internal/third-party audit roadmaps; embedded DevSecOps practices into the project lifecycle.
• Deputized for the CISO in meetings with Higher Management, presenting security risk dashboards and reporting in his absence.

Medical practices — Saint-Vith, Belgium · Freelance

• Tuned failing Python migration scripts; completed database migration (Python, Monarch RMOD, PowerShell, AD, Windows Servers).

SNCB — Belgium · On-site

• Embedded Java systems on Siemens AM08 trains for ETCS compliance — safety-critical (SIL) railway signalling, secure communication protocols.

Beryllium Erbium Brewery & industrial clients — Belgium, Brazil, USA · Freelance

• Risk assessments and security architecture reviews for industrial automation (IEC 62443); SCADA and industrial protocols (Siemens/Rockwell PLCs). Engagements including Egisa / USP (São Paulo), Bodebrown, Dama Bier, Crafted at the Port (Los Angeles).

Proximus — Brussels, Belgium

• Secured project management; designed load-balancing for Brussels–Ghent data centres (Cisco CSS).
• Tuned/managed Checkpoint Firewalls on Nokia; SunOne LDAP with full replication and automated backup; Perl/Python; FCCU liaison.

mediafiles — Louvain-la-Neuve, Belgium

• IT Manager as the company grew from 5 to 25 people; Netgear VPN/firewalls, Windows/Linux servers, OpenSQL.

European Space Agency (ESA) — Noordwijk, Netherlands · Freelance

• Secured the Galileo satellite data uplink (QNX/C) — recruited after independently identifying a critical GNSS vulnerability. NATO Secret clearance.