Yan Massart
Cybersecurity Governance · Operational Resilience · Regulatory Compliance
Experience : 30 years
- Led a 20-person Agile team (France & India) delivering the Group’s Cyber Control Information System, a global GRC platform for cybersecurity governance, IT risk oversight and regulatory reporting (€1.5M 2024 budget).
- Defined and executed the product roadmap digitalising cybersecurity controls and risk indicators, aligned with NIST-based control objectives validated by LOD2.
- Integrated control data into the enterprise datalake (Spark / Starburst) and Power BI dashboards used by ORM and Compliance teams.
- Provided security and risk reporting to executive stakeholders and ORM SteerCo, ensuring alignment with ISO 27001, NIST CSF and DORA.
- Improved traceability and control quality across distributed teams via governance workflows under SAFe Agile@Scale.
- CISO for the Fixed Income perimeter, overseeing cybersecurity across Front, Middle & Back Office in a highly regulated, high-exposure environment.
- Defined and executed the cybersecurity and IT risk strategy, aligning with ORM, regulatory expectations and business priorities.
- Strengthened internal control and non-financial risk visibility achieving >10% risk reduction through structured identification, audit remediation and continuous monitoring.
- Participated in quarterly ORM SteerCos, leading discussions on risk appetite, remediation progress and strategic third-party oversight.
- Managed incident response, supplier risk reviews, operational resilience testing and internal audit engagements.
- Directed a global resilience program (Europe, USA, Asia, India) to strengthen IT resilience and reduce incident duration across the Group.
- Achieved >10% improvement in continuity KPIs, surpassing Group-level objectives.
- Established governance, audit and control policies at Group level, reinforcing operational risk and resilience frameworks.
- Managed a €15M CTB portfolio across 15+ transformation programs in investment banking IT.
- Delivered quarterly portfolio alignment through structured analysis and arbitration.
- Supported a €30M, 6-year transformation program redeveloping the Group’s client referential and KYC platform.
- Coordinated 80 staff (60 FTE) across Paris and Bangalore in Agile feature teams.
- Oversaw budget, staffing, risk management and chaired Steering Committees to align stakeholders on regulatory compliance.
- Led IT infrastructure delivery for new front-office and client-facing platforms, managing >50 FTE.
- Strengthened operational resilience by reengineering infrastructure following audits.
- Designed the ITIL industrialisation roadmap for GECD subsidiary.
- Defined and executed a managed outsourcing contract under eSCM standards between BNPP subsidiaries.
- Improved service delivery and operational risk control across support functions.
- Functional management of 120 contributors across IT architecture and SAP delivery.
- Managed delivery on budget and timeline commitments.
Earlier Career – Team & Operations Management
- Managed teams of 20 FTE, annual operational budget up to €3.5M (2008).
- Oversaw supplier investments and maintenance budgets across IT operations.
- Core team member for the consolidation of LVMH SAP environments.
- Addressed all functional steering committees dedicated to IT urbanisation.
Senior leader in cybersecurity, IT risk and operational resilience with 30 years of experience in banking, insurance and high-tech.
Former CISO for Société Générale’s Fixed Income perimeter, now leading the Group-wide Cyber Control Information System supporting ORM, Compliance and regulatory reporting (DORA, NIS2, MiFID).
Combining governance, technology and risk expertise to improve security posture and reduce operational exposure across complex organisations. Targeting leadership roles across Europe.
Risk Governance & Internal Control
Led cybersecurity governance and internal control improvements for the Fixed Income perimeter, strengthening non-financial risk visibility.
Enterprise GRC Platform Delivery
Delivered a Group-level GRC platform integrating cyber controls, risk indicators and datalake reporting for ORM and Compliance.
Third-Party Risk & Audit Remediation
Managed risk assessment, third-party reviews and audit remediation across multiple regulated environments.
Global Resilience & Continuity
Directed SecuriProd, improving continuity KPIs by >10% across Europe, Asia and the US.
Multicultural Team Leadership
Built and led multicultural teams up to 20 FTE directly and 120 contributors in programme mode.
Master’s Degree in Engineering
Project Management Professional (PMP)
Project Management Institute · 2013
SAFe® Product Owner / Product Manager
Scaled Agile · 2024
CISM – Certified Information Security Manager
ISACA · In progress
Official Referee
Fédération Française de Tennis de Table – organisation and supervision of individual and team competitions.
Graduation Examiner
ISEP – conduction of end-of-study interviews to validate diploma award.