The information system (IS) security management consultant plays an essential role in protecting a company's digital assets. In a world where cyber threats are omnipresent, it is imperative for businesses of all sizes to take a proactive approach to IT security. An IS security consultant provides his expertise to evaluate, advise, implement and supervise the necessary measures to guarantee the integrity, confidentiality and availability of data.



<div class="wp-block-columns">
<div class="wp-block-column">
<h2 class="wp-block-heading">Main missions :</h2>



<ol>
<li>Audit &amp; Diagnostic: Evaluate the company's current security posture, identify vulnerabilities and weak points, and propose recommendations to improve them.</li>



<li>Development of security strategies: Design a comprehensive IS security strategy that is aligned with business objectives and current regulations.</li>



<li>Training &amp; Awareness: Educate company staff on security best practices and make them aware of different potential threats.</li>



<li>Incident management: Implement procedures to respond effectively to possible intrusions or security violations, as well as analyze incidents to prevent recurrences.</li>



<li>Technological &amp; regulatory monitoring: Stay informed of the latest trends in cyber threats, as well as applicable regulations and standards to guarantee optimal security.</li>



<li>Collaboration with internal teams: Work closely with IT, legal, and operational teams to ensure smooth implementation of security strategies.</li>
</ol>
</div>



<div class="wp-block-column">
<h2 class="wp-block-heading">Types of deliverables:</h2>



<ol>
<li>Audit report: Detailed document on current vulnerabilities, associated risks and recommendations.</li>



<li>Strategic security plan: Overall framework for IS security, including policies, procedures and technical recommendations.</li>



<li>Initial assessment report: Accuracy of the company's positioning regarding certification requirements.</li>



<li>Certification Roadmap: Detailed plan to achieve ISO 27001 or SOC2 certification.</li>



<li>Incident reports: Analyzes of security incidents with recommendations to prevent their recurrence.</li>



<li>Security dashboard: Tool for monitoring key performance indicators related to IS security.</li>
</ol>
</div>
</div>

Information System Security Management

In today's digital age, online presence and efficient web platforms have become essential for any business. The “Web Development Consulting &amp; Strategy” offer aims to support companies in their digital transition or optimization, by providing in-depth expertise in web development. From design to production, each step is taken into account to guarantee a high-performance web platform adapted to the specific needs of the company.



<div class="wp-block-columns">
<div class="wp-block-column">
<h2 class="wp-block-heading">Main Missions:</h2>



<ol>
<li>Audit &amp; Diagnosis: Assessment of the current situation, identification of needs and opportunities in terms of web development.</li>



<li>Technology Consulting: Recommendation of the technologies and solutions best suited to the objectives and constraints of the project.</li>



<li>Design of the Technical Architecture: Development of a robust and scalable architecture, guaranteeing performance, security and scalability.</li>



<li>Choice of Service Providers: Assistance in the selection of suppliers or agencies, based on their expertise, their references and their suitability for the project.</li>



<li>Project Owner support: Definition of needs, drafting of specifications, monitoring and validation of deliverables.</li>



<li>Project Management Support: Supervision of technical implementation, coordination between teams, management of schedules and compliance with budgets.</li>



<li>Team Management: Establishment and supervision of technical teams, guaranteeing fluid communication and achievement in line with expectations.</li>
</ol>
</div>



<div class="wp-block-column">
<h2 class="wp-block-heading">Types of deliverables:</h2>



<ol>
<li>Audit Report: Detailed document presenting the current state of the project or platform, with strengths, weaknesses, opportunities and threats.</li>



<li>Specifications: Detailed document specifying the technical and functional needs of the project, as well as constraints and recommendations.</li>



<li>Technological Recommendations: List and description of technologies, tools and platforms recommended for the project.</li>



<li>Technical Architecture Plan: Detailed diagram of the architecture recommended for the site or web application, including technological choices, interactions between the different components and integration points.</li>



<li>Shortlist of Service Providers: List of recommended service providers or agencies with justification for each choice.</li>



<li>Project Planning: Detailed calendar with the different stages, milestones and associated deadlines.</li>



<li>Monitoring Reports: Regular updates on the progress of the project, any problems encountered and the solutions proposed.</li>



<li>Technical Recipe Document: List of tests and validations to be carried out before going into production, ensuring that all requirements are met.</li>



<li>Best Practices Guide: Document providing advice and recommendations for the maintenance, security and evolution of the web platform.</li>



<li>Project Review: Final report detailing achievements, lessons learned and recommendations for future phases or for other similar projects.</li>
</ol>
</div>
</div>



<h2 class="wp-block-heading">Methodology</h2>



<ol>
<li>Listening &amp; Understanding: An in-depth understanding of the needs of the company and its environment to propose an adapted strategy.</li>



<li>Recommendation &amp; Strategy: Proposal of a clear roadmap, including appropriate technologies and key stages of the project.</li>



<li>Design &amp; Planning: Development of a solid technical architecture and detailed planning of the different stages of implementation.</li>



<li>Implementation &amp; Monitoring: Continuous coordination between all stakeholders, ensuring smooth development in line with expectations.</li>



<li>Validation &amp; Production: Verification of the conformity of solutions with needs, followed by secure production.</li>



<li>Support &amp; Evolution: Offering post-launch support, with particular attention to the evolution and optimization of web platforms.</li>
</ol>

Web Development Consulting & Strategy

Today's IT landscape requires fluid collaboration between development and operations to ensure fast, efficient and smooth deliveries. The “DevOps &amp; Outsourcing” offering focuses on this alignment, providing automation, continuous integration, continuous deployment and optimized hosting solutions. The goal is to guarantee efficient, secure and scalable web applications, while facilitating their daily management.



<div class="wp-block-columns">
<div class="wp-block-column">
<h2 class="wp-block-heading">Main Missions:</h2>



<ol>
<li>Diagnosis &amp; Audit: Assessment of the current situation in terms of development, deployment and hosting, with recommendations for adopting a DevOps approach.</li>



<li>Implementation of DevOps Practices: Continuous integration and deployment, automation, configuration management and monitoring.</li>



<li>Design of Hosting Architectures: Choice and implementation of suitable infrastructures, whether on dedicated, cloud or hybrid servers.</li>



<li>Optimization &amp; Scalability: Improvement of performance and implementation of auto-scaling solutions to adapt to the varying needs of applications.</li>



<li>Security Management: Implementation of security protocols and tools to protect infrastructures and applications.</li>



<li>Maintenance &amp; Support: Continuous monitoring, updating, incident resolution and technical support.</li>
</ol>
</div>



<div class="wp-block-column">
<h2 class="wp-block-heading">Types of deliverables:</h2>



<ol>
<li>Audit Report: Detailed analysis of the current state of infrastructures and processes, with recommendations for a transition to DevOps.</li>



<li>DevOps Pipeline: Documentation and implementation of continuous integration and deployment pipelines.</li>



<li>Hosting Architecture: Diagrams and detailed descriptions of the proposed hosting infrastructures.</li>



<li>Security Protocols: List of security measures applied, including configurations, tools and best practices.</li>



<li>Optimization Guides: Tips and methods for maintaining and improving the performance of applications and infrastructures.</li>



<li>Monitoring reports: Regular updates on the status, performance and security of applications and infrastructures.</li>



<li>Maintenance Plan: Calendar and list of periodic tasks to ensure the health and evolution of systems.</li>
</ol>
</div>
</div>



<h2 class="wp-block-heading">Methodology:</h2>



<ol>
<li>Listening &amp; Analysis: Before any intervention, it is essential to understand the specific needs, the culture of the company and the current state of its infrastructures and practices. This phase includes a technical audit and interviews with key stakeholders.</li>



<li>Planning: Based on the initial analysis, an action plan is established. This plan details the steps to follow, the technologies to use and the execution schedule.</li>



<li>Implementation of DevOps Practices: Integration of the tools and processes necessary to automate the software development lifecycle, from integration to release into production.</li>



<li>Infrastructure Design &amp; Deployment: Selection and implementation of the most suitable hosting solution, with particular attention to security, performance and scalability.</li>



<li>Continuous Optimization: Based on monitoring and feedback, adjustments are made to ensure optimal performance and respond to changing business needs.</li>



<li>Training &amp; Skills Transfer: To guarantee the sustainability of the solutions implemented, it is crucial to support internal teams, train them in new tools and processes, and pass on the necessary skills to them.</li>



<li>Maintenance &amp; Support: Once the solutions are deployed, continuous monitoring is put in place, with proactive interventions to prevent or resolve potential problems.</li>
</ol>

DevOps & Managed Services

Creation of an interface with a message broker in order to carry out tasks asynchronously.
Interface with RabbitMq and AWS SQS
Simple and complex asynchronous tasks performed:
<ul>
<li>Maintenance tasks</li>
<li>Mail sending</li>
<li>Image processing</li>
<li>Request to third-party services (mass data recovery)</li>
</ul>

Development

Technical Design

Interface with message broker

Creation of interfaces with different identity providers with the SAML protocol:
<ul>
<li>Okta
Microsoft Entra ID (formerly Azure Active Directory)
OneLogin
Ping Identity</li>
</ul>
Technical design of the interface with the existing identity service
Writing technical and functional specifications
Interface development with SimpleSAMLHPp

Project management support

Interface with SSO systems

Organization and holding of internal audits in order to validate the processes established within the framework of ISO or SOC 2 certification

Audits

Security

Internal audits

Réalisation d'une application Microsoft Teams pour offrir une expérience du Saas Grytics au sein de <a href="https://learn.microsoft.com/fr-fr/microsoft-365-app-certification/teams/1339-sas-grytics-companion" target="_blank" rel="noopener">Teams</a>.
<ul>
<li>Conception des interfaces dans le respect des guidelines de Microsoft (adaptation des principes de navigation et de la charte graphique)</li>
<li>Conception technique pour permettre l'interface entre l'application Teams / les services d'identification de Microsoft / les webservices du Saas</li>
<li>Réalisation des spécifications techniques</li>
<li>Gestion de la soumission, du parcours de test et de l'obtention de l'attestation Publisher et Microsoft 365</li>
</ul>
&nbsp;

Project owner support

Creation of Microsoft Teams application

Carrying out code reviews and audits:
PHP (Vanilla, Symfony, WordPress)
Javascript (ReactJs, NodeJs, NextJs)
MySQL
Static and dynamic analyzes

Code review and audit

Creating REST APIs with Symfony, PHP Vanilla and NodeJs
<ul>
<li>Design, technical specifications</li>
<li>Specificities :
<ul>
<li>Custom or JWT authentication</li>
<li>Development with Symfony (5.X, 6.X), PHP Vanilla and NodeJs</li>
<li>Interface with database (Doctrine or custom)</li>
<li>Interface with external APIs</li>
<li>Internal and public use</li>
</ul>
</li>
<li>Development</li>
<li>Test management</li>
<li>Documentation management</li>
</ul>

Rest API Development

Implementation of high availability architecture on public clouds (Amazon Web Services and Microsoft Azure) for a SaaS application &amp; showcase sites
<ul>
<li>Adaptation of application components in order to take advantage of the advantages and specificities of each</li>
<li>Simultaneous hosting of the application on several clouds</li>
<li>Automated deployment</li>
<li>Load management</li>
<li>“Classic” hosting on servers</li>
<li>Serverless hosting</li>
<li>Use of PaaS (AWS RDS, OpenSearch, etc.)</li>
</ul>

Outsourcing and hosting

High availability multi-cloud architecture

Write functional and technical specifications in order to realize the vision of the project based on specifications and/or on the work carried out during workshops with end customers (external or internal).
Projects can be technical or functional:
<ul>
<li>websites</li>
<li>apps</li>
<li>webservices</li>
</ul>

Technical and functional specifications

Design of showcase websites: project management and development
<ul>
<li>Writing functional and technical specifications</li>
<li>Management of development teams</li>
<li>Recipe management</li>
</ul>
Technical specificities :
<ul>
<li>CSS Framework: Bootstrap</li>
<li>Component libraries: ChakraUI, Tailwind, Fluent UI</li>
<li>Using CMS (WordPress) in classic mode</li>
<li>Using CMS in HeadLess mode: front with NextJs + WordPress in Headless with Rest API</li>
</ul>
&nbsp;

Design & Creation of showcase sites

Collection and translation of needs with a view to drafting specifications, whether formal (calls for tender) or more informal (development of specifications for a tool to be developed by internal teams).
Projects can be technical, organizational or functional:
<ul>
<li>websites, applications, webservices, etc.</li>
<li>organization of the IS</li>
</ul>

Writing specifications

Design, development and management of SaaS applications from A to Z
<ul>
<li>Functional design</li>
<li>Technical design</li>
</ul>
Achievements:
<ul>
<li>Grytics</li>
</ul>

SaaS web application development

Web project management from A to Z on both the client and agency sides.
<ul>
<li>Manage the teams under my responsibility: developers, other project managers, web designers and hosting engineers. This includes managing their schedule, answering questions, clarifying misunderstandings.</li>
<li>Write functional and technical specifications in order to realize the vision of the project concerned based on specifications and/or on the work carried out during workshops with end clients (external or internal).</li>
</ul>
Manage the functional and technical recipe
Some examples :
<ul>
<li>CEA (Atomic Energy and Alternative Energies Commission)
<ul>
<li>Creation of the internal DSI site for a knowledge base;</li>
<li>Redesign of the complete graphic charter of the CEA sites (still current): creation of all navigation principles, compliance with accessibility standards, HTML integration applicable on the CEA Sharepoint sites.</li>
</ul>
</li>
<li>Plus Belle la Vie: Creation of the community site (2011/2012).</li>
<li>Editions Harlequin: various showcase sites.</li>
<li>Editions Hachette Jeunesse: Various showcase sites and reader community sites.</li>
<li>Equidia &amp; PMU: Redesign of all TV channel sites and interface with the PMU for sports betting.</li>
<li>France TV: Redesign of broadcast sites (C dans l’Air for example).</li>
<li>Radio France: Functional and technical specifications on internal projects.</li>
<li>Grytics</li>
</ul>

Web project management

Mastery of interface to payment solutions: Stripe, Paypal
<ul>
<li>Management of one-time payments and subscriptions</li>
<li>Interface with business solution to manage its specificities (rights management, order management, etc.)</li>
</ul>

Interface with payment solutions

Use of different Microsoft APIs: Graph API, Yammer API, Activity API
<ul>
<li>Interface with authentication services (Consumer and Business)</li>
<li>Interface with endpoints dedicated to Yammer</li>
<li>Interface with endpoints dedicated to the Activity API for Azure tenants</li>
<li>Interface with SAML services</li>
</ul>
Technical design of interfaces (in PHP and NodeJs)
Development
Managing Application Review

Interface with Microsoft APIs

Using the Meta Graph API (Facebook)
<ul>
<li>Interface with Facebook Connect for authentication management</li>
<li>Interface with endpoints dedicated to Groups</li>
<li>Interface with endpoints dedicated to Pages</li>
<li>Interface with endpoints dedicated to Workplace</li>
</ul>
Technical design of interfaces (in PHP and NodeJs)
Development
Managing app review by Meta

Interface with Meta APIs

Compliance of SME procedures and practices in order to obtain ISO 27001-2013 certification.
<ul>
<li>Audit and study of the existing</li>
<li>Team training</li>
<li>Drafting policies and procedures</li>
<li>Creation of the monitoring framework</li>
</ul>

IS compliance with ISO 27001

Creation of the websockets architecture with SocketIo (interface in Php, NodeJs and ReactJs)
System development
Types of production:
<ul>
<li>Sending notifications to a customer</li>
<li>User authentication</li>
<li>Complex online gaming system</li>
</ul>

Websocket interface/management

Management of security audits from an application and development point of view
<ul>
<li>Implementation of internal procedures</li>
<li>Selection of service providers for organization of pentests</li>
<li>Security audit performance (code review and audit, pentest in gray box and white box mode)</li>
</ul>

Security audit

Compliance of SME procedures and practices in order to obtain SOC2 Type 1 certification.
<ul>
<li>Audit and study of the existing</li>
<li>Team training</li>
<li>Drafting policies and procedures</li>
<li>Creation of the monitoring framework</li>
</ul>

IS compliance with SOC2

Architecture design to store, analyze and consult these analyzes a large quantity of data (&gt; 2 million)
<ul>
<li>Ops Architecture: Intelligent Use of AWS Services</li>
<li>Back office architecture and design: MySQL optimizations, cache management, data flattening</li>
</ul>
Case: Grytics

My services

Web Development Consulting & Strategy

DevOps & Managed Services