Looks like you have JavaScript disabled. For the full Twine experience, you will need to re-enable it.

Security architect with 20+ years of experience designing and operating security across Cloud, On-Premises, and ICS/OT environments. Focused on Zero Trust, Defense-in-Depth, and network segmentation, bridging architecture with operations and governance to deliver secure outcomes at scale. Highly experienced in GRC, risk management, security blueprinting, SOP modernization, detection improvements, and audit readiness—translating regulatory and architectural constraints into practical, auditable security controls that work in real operations.…Security architect with 20+ years of experience designing and operating security across Cloud, On-Premises, and ICS/OT environments. Focused on Zero Trust, Defense-in-Depth, and network segmentation, bridging architecture with operations and governance to deliver secure outcomes at scale. Highly experienced in GRC, risk management, security blueprinting, SOP modernization, detection improvements, and audit readiness—translating regulatory and architectural constraints into practical, auditable security controls that work in real operations.

Enrique Gallardo





Security architect with 20+ years of experience designing and operating security across Cloud, On-Premises, and ICS/OT environments. Focused on Zero Trust, Defense-in-Depth, and network segmentation, bridging architecture with operations and governance to deliver secure outcomes at scale. Highly experienced in GRC, risk management, security blueprinting, SOP modernization, detection improvements, and audit readiness—translating regulatory and architectural constraints into practical, auditable security controls that work in real operations.…Security architect with 20+ years of experience designing and operating security across Cloud, On-Premises, and ICS/OT environments. Focused on Zero Trust, Defense-in-Depth, and network segmentation, bridging architecture with operations and governance to deliver secure outcomes at scale. Highly experienced in GRC, risk management, security blueprinting, SOP modernization, detection improvements, and audit readiness—translating regulatory and architectural constraints into practical, auditable security controls that work in real operations.

Available to hire

Security architect with 20+ years of experience designing and operating security across Cloud, On-Premises, and ICS/OT environments. Focused on Zero Trust, Defense-in-Depth, and network segmentation, bridging architecture with operations and governance to deliver secure outcomes at scale.

Highly experienced in GRC, risk management, security blueprinting, SOP modernization, detection improvements, and audit readiness—translating regulatory and architectural constraints into practical, auditable security controls that work in real operations.

Skills

Experience Level

Expert

Expert

Expert

Expert

Expert

Intermediate

Language

Spanish; Castilian

Fluent

English

Advanced

German

Intermediate

Work Experience

Security Architect at Capgemini

January 1, 2022 - February 1, 2026

Implemented a Zero Trust architecture for ruggedized military-grade maritime container mini data rooms based on VMware & Tanzu, supporting containerized GIS workloads in contested electronic warfare environments. Designed use cases to ensure workload, identity, and system elements remain independent and secure under degraded or disrupted scenarios. Defined enterprise and solution security architecture using LeanIX/Bizzdesign/HOPEX for architecture governance and security traceability; documented IT and OT designs with Sparx Enterprise Architect including trust boundaries and interfaces. Used IriusRisk for architecture-driven threat modeling and derived security requirements, countermeasures, and design gaps; supported risk and compliance management with Archer. Produced security blueprints, security workflows, and architecture decision records in Confluence, and OT security strategy aligned to multiple standards and models. Integrated defense-in-depth and Zero Trust into OT workflows a

Lead Security Architect at Sopra Steria

August 1, 2019 - January 1, 2022

Provided governance and control by monitoring risk appetite via metrics, managing digital forensics per ISO 27035, and delivering root-cause analysis reports to close systemic gaps. Worked on data governance models and access control policies to ensure business, regulatory, and architectural requirements were reflected in security controls and workflows across security operations, engineering, and advisory. Planned and managed migrations from VPN solutions to Secure Access Service Edge platforms and supported Zero Trust onboarding/lifecycle procedures. Developed and documented security strategy artifacts (SoW, HLD/LLD) and operational handbooks. Carried out risk analyses and defined processes based on ISO 27001, CIS 20, BaFin, KRITIS, and MaRisk, documenting processes and supporting implementation in Archer GRC. Led SOC operations management: threat identification/evaluation/quantification/reporting, detection monitoring use cases, dashboards/metrics, supplier oversight, and operationa

Security and Data Protection Consultant at Fujitsu

September 1, 2015 - July 1, 2019

Applied NIST SP 800-53 and SP 800-122 controls for privacy assessments and reviewed privacy risks related to systems of records and legal agreements (e.g., MOUs, CRADAs). Developed policies for data retention and media sanitization and created privacy handbooks aligned to CCPA/GDPR. Led privacy data mapping to discover PII, responsible for Article 30 processing records and data mapping frameworks. Coordinated migration of perimeter devices to ensure adherence to updated security controls; maintained repositories and validated evidence to ensure cloud provider corrections of audit findings; translated findings from ACAS/SCAP/HP Fortify into vulnerability/compliance context. Performed cloud governance/compliance activities across 70+ cloud vendors: remediation, provider evaluations, and participation in Microsoft Office 365 and Enterprise Mobility Suite transitions with cyber-risk reduction focus. Supported industrial security audits including hardening and vulnerability reviews; establi

Security Project and Governance Consultant at Computerfutures

April 1, 2010 - August 1, 2015

Centralized security for European branch offices and led migration to a new centralized data center to reduce costs and improve control. Built a full security policy program based on NIST/ISO guidelines and designed security standards in AWS/Azure with focus on IAM, encryption, and network controls. Developed security policy documentation for Office 365, CASB integration, and data exfiltration controls. Created and maintained policies/standards/procedures to support data protection and information security programs and authored continuity/emergency plans for network disruptions such as HA failures and DDoS. Supported reviews of SOPs, action plans, milestones, and internal compliance documentation. Developed risk-and-controls matrix mapping GAPP controls to inherent risks and supported SOC2 audits, facilitating audit activities to satisfy Trust Principles. Balanced governance with daily operability and auditability while integrating new infrastructure. Led SOC buildout including hiring/

Cybersecurity Auditor at Randstad

May 1, 2007 - March 1, 2010

Founding member of the IS Governance, Risk and Compliance Committee. Translated regulatory, industry, and contractual requirements into internal security policies, frameworks, and procedures. Created a security lifecycle roadmap and director-level security plan with gap analyses. Implemented Information Assurance Vulnerability Management (IAVM) process including POA&M creation/maintenance and a vulnerability management program covering scanning, monitoring, remediation, and reporting. Led planning and execution of 20+ security projects using commercial and open-source tools (OpenDNS, SIEM, MDM, IOC scanners). Worked with SOC leadership to define WAF integration use cases into SIEM and proposed detection strategies and retention filters to meet data regulation requirements. Initiated systems for inventory/asset management/classification/labeling. Performed technical assessments including web application log review and data lake security enablement. Built high-availability security infra

Senior Consultant (Governance) at Ernst & Young

February 1, 2004 - April 1, 2007

Ensured security methodologies met NIST-compliant frameworks including 800-53, RMF, and POA&M. Managed security plan implementation, security directive writing, and in-depth risk and business impact analyses across multiple sites, including action plan/milestone maintenance and risk remediation. Administered PCI-DSS self assessment questionnaires and supported ISO 27000 evidence audits. Led consolidation of the security policy program by drafting new structures and updating technical and process-level policies, identifying compliance gaps and aligning them to internal/external requirements. Collaborated with IT, Finance, and Legal for resolution of information security and vendor risk topics. Drove third-party risk assessments for new implementations/upgrades. Participated in pre-sales activities (proposals, statements of work, staffing estimates) for privacy projects and provided reporting to C-level executives including SWOT analyses; aligned stakeholders while advancing security mat

Cybersecurity Incident Handler at Accenture

June 1, 2002 - January 1, 2004

Managed Managed Security Services (MSS) for most banks in Spain, including implementation of anti-phishing solutions and management of perimeter defenses. Ensured services aligned with client compliance and governance requirements; provisioned and maintained SLAs to meet contractual obligations and service metrics. Coordinated support, sales, and engineering teams for MSS delivery, including significant customer-facing interaction and VIP support/escalation handling under pressure. Hands-on operational support for Verisign Teraguard SIEM including log analysis and event correlation. Provided operational support for the Andalusia government corporate network with 7,000+ network points using ATM/MPLS, performing troubleshooting and proactive maintenance. Worked with transmission and wireless technologies (SDH/PDL/DWDM) and multi-vendor hardware (Lucent, Alcatel, Cisco, Pirelli, Ericsson, Motorola, Juniper). Delivered Level-2 support for VIP customers and resolved complex incidents improv