Home · Engineer
Our engineer’s CV

Grégory Murer — BCP/DR & GRC Engineer

Business Continuity & Disaster Recovery Testing Manager at BNP Paribas Fortis and founder of XpandIT.be. Governance, risk, compliance and resilience for Belgian organisations and critical infrastructure.

27+ yearsIT, cybersecurity and resilience
Banking · insurance · critical infrastructureBNP Paribas Fortis, AXA, POST Luxembourg, bpost, SNCB, ESA
GRC & auditiHub (POST Luxembourg group), AXA, bpost

Certifications: ISO 27001 Lead Implementer (Certiprof) · Kanban KBPC

Contact

Profile

I help organisations hold firm when it matters: business continuity and disaster recovery testing (BCP/DR), governance, risk and compliance.
For more than 27 years I have worked in banking, insurance, transport, space and industry, with ISO 27001, ISO 22301, NIS2, DORA and CSSF.
My profile is twofold: I steer governance and I talk on equal terms with technical teams (cloud, IAM/PKI, SOC/SIEM, code).
I have worked closely with security teams and their leaders, and today I bring this experience to Belgian SMEs through XpandIT.be.

Expertise

  • Continuity & resilienceBCP/DR testing, tabletop, failover, RTO/RPO, DORA operational resilience
  • Governance & complianceISO 27001:2022 ISMS, ISO 22301, NIS2 / CyFun, DORA, GDPR, CSSF
  • Risk managementISO 27005, OWASP Risk Rating, MONARC, KPI/KRI dashboards
  • Third parties & supply chainSupplier risk reviews, supply chain security
  • Technical securityCloud (GCP/AWS/Azure), IAM/PAM/PKI/SSO, SOC/SIEM/EDR, OT/SCADA (IEC 62443)
  • Crisis & awarenessCSIRT coordination, recovery priorities, training and risk committees

Recent experience

Business Continuity & Disaster Recovery Testing Manager

Jul 2026 – present

BNP Paribas Fortis — Brussels, Belgium · Hybrid

  • I translate the Group’s BC/DR frameworks (Paris) into actionable test plans for each Belgian entity.
  • I design and run BCP/DR exercises (tabletop, failovers, full-scale recoveries) and challenge the RTO/RPO assumptions of business and IT teams.
  • I produce test evidence supporting DORA compliance and NBB/ECB expectations, and set post-incident recovery priorities.

Founder & principal cybersecurity consultant

Feb 2026 – present

XpandIT.be — Liège, Belgium · Self-employed

  • I support Belgian SMEs in their NIS2 / CyFun transition, from diagnosis to audit evidence, and in their ISO 27001 projects.
  • I offer penetration testing (PenTest), DR/BCP exercises and security hardware advice.
  • I integrate AI and agents into governance and risk processes, to make GRC accessible to small organisations.

GRC Engineer

Sep 2025 – May 2026

iHub (KYC for Deep, POST Luxembourg group), via portarium consulting (salary portage) — Kayl, Luxembourg · On site

  • I identified, analysed and tracked IT risks in a regulated multi-entity financial environment (OWASP Risk Rating, ISO 27005), including cloud architecture security.
  • I ran the audit cycle for ISO 27001:2022, ISO 22301, DORA and CSSF circulars, including third-party risk.
  • I provided direct GRC support to the information security function.

Local GRC Ops Expert

Mar 2022 – Sep 2025

AXA Group Operations — Brussels, Belgium · Hybrid

  • I was the NIS2, ISO 27001, ISO 22301 and DORA point of contact for local CISOs, with risk dashboards and risk champion forums.
  • I migrated the risk framework from NIS/OWASP to NIS2/CyFun, with KPI/KGI/KRI indicators for management, and rolled out Qualys with SOC integration.
  • I provided GRC support to entities without a dedicated security lead (Yuzzu, Ardenne Prévoyante, AXA IM).

External Security Project Manager

Oct 2017 – Feb 2022

bpost — Belgium · Self-employed · Hybrid

  • I led security and compliance projects: risk analysis, budgets, multidisciplinary teams.
  • I set up security frameworks, internal and third-party audit roadmaps, and DevSecOps practices.
  • I presented security risk reporting to top management.

Earlier career

RoleDateOrganisation · in brief
Cyber Security InstructorNov 2023 – Feb 2024IFAPME — bootcamp for ULiège students: vulnerabilities, penetration testing, cloud, Bash/Python
DB Migration ConsultantJan – Aug 2021Medical practices, Sankt Vith — database migration (Python, PowerShell, AD)
Embedded System Engineer / ETCSSep 2015 – Oct 2017SNCB — Java embedded systems on Siemens AM08 trainsets, safety-critical signalling (SIL)
IoT/SCADA cybersecurity consultantJan 2007 – Aug 2015Industrial clients — Belgium, Brazil, USA: IEC 62443 risk and architecture, Siemens/Rockwell SCADA
Cyber Security EngineerOct 2002 – Mar 2005Proximus — Brussels–Ghent datacenter load balancing, Check Point firewalls, LDAP
IT ManagerDec 2001 – Oct 2002mediafiles, Louvain-la-Neuve — IT for a company that grew from 5 to 25 people
Cyber Security EngineerSep 1999 – Dec 2001ESA, Noordwijk — securing the Galileo data uplink (QNX/C), NATO Secret clearance
Other experience2005 – 2015Ubisoft / Gameloft (sysadmin), Smals (LDAP – Oracle), craft brewing: brewer, IFAPME trainer and speaker

Certifications

  • ISO 27001 Certified Lead Implementer (I27001LI) — Certiprof · June 2026, valid until June 2029
  • Kanban KBPC — Kanban Foundation International · May 2026
  • Check Point CCSE / CCNA — via Dimension Data · 2003

Continuing education

Training modules completed, mostly funded by my employers (Skillsoft, LinkedIn Learning, universities). These are training courses, not certifications.

  • Offensive securityPreparation tracks for CEH v12, CompTIA CySA+ (including the business continuity module) and (ISC)² CC, OWASP Top 10 and DevSecOps (2023–2025).
  • Audit & GRCCISA 2019 and CRISC modules, ISO 27001 Annex A, cybersecurity supplier management (2024–2025).
  • AI & agentsAnthropic tracks (Claude, API, MCP, Bedrock, Vertex AI, AI Fluency), prompt engineering and Gemini (2025–2026).
  • Cloud & identityAzure Entra ID and Fundamentals, Docker, Active Directory, Splunk, Linux and Python.
  • Project & servicePRINCE2 2017, Agile, ITIL 4 Foundation, Six Sigma green belt and change management modules (2023–2025).

Academic education

InstitutionProgrammeDate
—Doctorate in theology, technology and digital culture — in preparation — thesis: The Divine Spark in the Age of Artificial Intelligenceongoing
King’s College LondonMilitary Healthcare Ethics2026
Ben-Gurion University of the NegevResilience911: disaster resilience2026
Tel Aviv UniversityUnlocking Information Security, level 1 (2023) and level 2 (2026)2023 / 2026
HEC LiègeMaster in Business Administration (Business Administration and Management)2021 – 2023
Rochester Institute of Technology (edX)Computer Forensics2020 – 2021
Université Henri Poincaré, Nancy 1Microbiology laboratory techniques2008
UCLouvain FUCaM MonsManagement Science1999 – 2001
ICET MonsGraduate degree, Marketing1997 – 1999
UCLouvainEngineering degree, Physics1992 – 1997

Languages

  • EnglishBilingual / native
  • FrenchBilingual / native
  • DutchBasic knowledge
  • HebrewBasic knowledge

Let’s work together

BCP/DR testing, NIS2 diagnostic, GRC governance or outsourced GRC support: a 30-minute call to clarify the need.

Contact