Viterra B.V.

- Due to the nature of the assignment, information can not be disclosed. -

Chief Information Security Officer (CISO)

Justitie en v

Designing and implementing the Information Security Risk Strategy for the Department of Justice and Safety in the Netherlands, based on the ISO 31000.

Strategic Advisor Information Security (CISO)

ABN AMRO Clearing Bank

Accountable and Responsible for Cyber Security within all of ABN AMRO Clearing Bank World Wide.
Functional lead of three international teams (APAC – US – EU), total of 15 security officers
Direct report to Global CIO

As part of the Global Management team IT (GMT-IT), I reported directly to the Global CIO about all security matters amongst; HR, Projects, Operations, Tactical and Strategical initiatives & budget. 

Vendor Management
Cognizant (CTS) is the, India based, strategical outsourcing partner for ABN AMRO Clearing Bank and needed to be managed on all (contract / project) aspects of Cyber Security. Including migration plans and projects, strategical initiatives & reporting.

Several projects and plans included;

- Temporary Security Operations Centre (SOC/SIEM) implementation.
- RFP Global (SOC/SIEM) execution.
- Audit Remediation
- Security Architecture
- ISO 27001 Control Implementation

Global IT Security Officer (CISO)

Novamedia

Designing and executing an international Information Security & Cyber Security program. 
Building a strategic Information Security & Cyber Security roadmap for the group, incorporating GDPR compliance, based on the good standard for information security (ISF) and the ISO 27001. Developing and implementing tailored international governance frameworks for Information security, Cybersecurity & Data Protection (privacy)

Strengthening the group IT security posture by expanding one security ecosystem.
Managing & implementing group SIEM & SOC solution. Implementing one security eco-system, Cloud (AWS) Security. Establishing 24x7 penetration testing.

Responsible for audit management, security compliance and IT Security Group contracts.
Building and maintaining a compliance program (ISO27001, Local Permits Specific). Managing the international & local audit programs, primary contact for the external auditor.  Responsible for the International (Cyber) Security budget, managing & negotiating vendor contracts.

Leading an international group of Information Security and IT Security officers. 
Establishing reporting lines & building relationships. Implementing group risk-based security thinking, as part of enterprise risk management. Mentoring information security officers, offering guidance and training. Leading the CSIRT teams on a global or local level in case of breach or severe incident.

Assisting the Enterprise Architect & Infrastructure Architect by filling the Security Architect gap. 
Acting as primary “go-to” when Security Architecture questions arise. Building a security architecture framework Including principles, artifacts, building blocks & functional stacks. 

Reporting to the COO, the Company IT director, the executive board & supervisory board. 
Establishing executive reporting lines for Information Security Strategy, Cyber Security, Security Risk Management, Data protection, Security Projects & Security budgets (finance).

Logius

In the role of Security Manager at Logius, I fulfilled a CISO position for the product MijnOverheid.nl, Overheid.nl and Life Events, with a primary focus on Cybersecurity, where I directly report to the Management Team. 

In addition to writing the information security policies and the implementation of the BIR (ISO 27001/27002), I advised on the vision, strategy, and goals of cyber & information security.

I have written the information security roadmap and set the objectives for operationalization in the years to come.  After the development of the information security policy, I guided & monitored the implementation of the security policies. For compliance & reporting, I developed a methodology that kept the business in the driver seat, without surprises in the area of information security and data privacy. 

Although my daily work has been mostly on a  tactical and strategic level, I also outlined the technical (cyber) security architecture.  I had direct control over the enhancement and implementation of IDS, Anti-Malware, Web Application Firewalls (WAF) and Vulnerability Scanning. 
At a corporate level, I advised the CISO Logius, and I supported him to strengthen information security at Logius. I have been involved in the introduction of the IRAM as a risk management methodology, establish and improve a Logius information security policy framework (policy house) and implementation of a Governance, Risk & Compliance (GRC) tool.

The implementation of the BIR (ISO 27001), the operationalization of the SIEM, various compliance processes (BIR-ICV, TPM), developing of a single audit methodology, the commissioning operational security reports, implementing Dutch privacy laws (WBP, Meldplicht datalekken) and the anchor of security architecture principles are just a few examples of my successes.

Security Manager Portaaldiensten (CISO)

GlobalCollect

In the role of Senior Information Security Manager I have been assigned several projects. I reported directly to the Chief Credit and Risk Officer which has a seat on the Executive Board.

The success for the (re) certification GlobalCollect for the annual PCI DSS audit. Through creative and pragmatic guidance GlobalCollect passed this audit successfully. The biggest challenge in this has been to, with a fixed deadline, provide the correct pragmatic solutions to senior management to so that they could take a well considered decision. 

It was the wish of GlobalCollect to get a better grip on Information Security Governance & Control. For the introduction of Information Security Governance and Control I prepared a roadmap with associated scope, schedule, deliverables and dependencies. To give effect to this implementation roadmap I helped GlobalCollect to create new structure for the Information Security Department. This new structure held, in addition to determining the work package, also introducing a new division and new roles within the team.

As the first point of contact for recruiting new information security officers for this department I have drawn the job descriptions within the team and I have been involved in the selection for the appointment of the new Director of Information Security which utilizes the roadmap as a "battle plan” in lifting  GlobalCollect to a higher level.

To enhance the grip on projects in progress (projects in stock), I designed an assessment model that can be used for those projects. From a information (data) perspective on risks and measures, discussed from a business perspective, the mitigation measures to be taken with respect to the risks defined can then be translated. These risks can be translated into functional and non-functional requirements (mitigating actions). In the end these requirements can be translated into testing criteria to be tested by the QA team or by an external penetration (compliance) tester.

Senior Information Security Manager (CISO)

ING Insurance Central and Rest of Europe

In the function of Security Architect Web Infrastructure I addressed all external accessible Web Application Infrastructures throughout the CRE Countries. I made new blueprints; took part in task forces and pressure-cookers. In addition, I replaced the project leader at absence, delivered input to project management for budgeting and I drafted, along with the project manager, the PID.
 
The role of Security Architect Web Infrastructure is part of the newly established Centre of Expertise (CoE) Web Application Security. Next to my responsibility of the establishment of the Centre of Expertise, I had an operational task to create logical and technical (security) documentation for infrastructure components, such as Web Application Firewalls (WAF), Secure DNS, Browse in/out, IDS/IPS, Firewalls and so on. As a guide for this device I used information already available from the insurance company and (mainly) the information available through Open Web Application Security Project (OWASP). In addition, I was involved in setting up (automated) vulnerability checks, penetration testing and the remedy (mitigation) of identified risks.
 

At international level, I take care of presentations, workshops, training and guidance in the field of information security, architecture, blueprints, designs, risk management, organizational design & communication. My conversation partners are the CIO, COO, IRM (Risk Management), Heads IT, architects and Designers.

I advised senior management in regards to decision making on middle and long term (information) security perspective, return on investment and strategy to be chosen.

Security Architect for Centre of Web Application Security

Dienst Uitvoering Onderwijs (DUO)

As Security Architect I have been responsible for the design of the new security architecture (picture 2015) that the link between DUO and the educational institutions as well as the educational institutions will facilitate.
 
For this design I made use of the various available research models so I can get my design can auditable was. My biggest challenge, within the time available, was the "business alignment". 
 
The search for the underlying problem, the aggregation of requirements and needs and a sense of what the "market
developments" until 2015 have input supplied for my design (s).
 
In addition to designing this new architecture, I am involved in the technical design of a solution to store digital certificates (signatures, PKIoverheid). A business analysis (risk analysis) about the value of licenses has given input for the specification of the principles. After I did a stakeholder analysis, I used requirements modeling (ISO 9126) to select the desired quality requirements that have to be adhered. In addition, the stated conditions of the enterprise architecture, reusability and management were included in the final design. 
 
I guided/facilitated several and different risk management sessions to ensure that all departments aware of the potential risks and how to design mitigation to the identified risks.

Security Architect

As the lead costumer security officer I am responsible for the security policy (implementation and maintenance) of the KPN branch “Finance and Retail Services”.  Finance and Retail Services has *** Bank Netherlands, *** Bank Belgium, Insurance company (1) and Insurance company (2) as main customers. Supporting over 15000 external users and accommodating over 250 internal KPN / Getronics employees.  

Each customer has its own support group with separate management, contracts and agreements. Each has its own set of services that KPN / Getronics is providing for them. All these services include separate security services. 

Each support group is using the ISO 27001 certificates from higher or lower organizational units with an addition of the customer specific implementation of some ISO 27001 controls. Most management controls are selected by the costumer through the use of the COBIT. Trough the use of the ISACA mapping table the link between COBIT and the ISO 27001 is made.

Lead Customer Security Officer

COLT Telecom

Solution Architect

European CISO of the year 2024. 

I am a visionary coach, trainer, and executive passionate about revolutionizing the world through profound cybersecurity management. 

As a dynamic leader, I thrive on challenging traditional thinking in these domains, always embracing the power of "Yes!" to drive innovation and transformation.

My unwavering commitment to continuous training and education has propelled me to the forefront of the information and cybersecurity field. Renowned as one of the top specialists, I possess an extensive network of influential peers and constantly seek new connections to expand my knowledge. 

However, my ambitions extend beyond these realms. I am particularly intrigued by the intersection of leadership, organizational behavior, and cybersecurity culture, recognizing their vital role in fostering sustainable success.

Throughout my illustrious career, I have successfully constructed and guided information and cybersecurity programs and teams on a global scale. As a strategic change agent, I have spearheaded initiatives that redefine the landscape of information and cybersecurity. 

Drawing upon over two decades of experience, I excel in delivering visionary strategic planning, inspiring leadership, incisive analysis, and tailored solutions. My expertise ensures that businesses remain secure amidst the ever-evolving security landscape.

If you seek a visionary executive who can orchestrate cutting-edge information and cybersecurity strategies while instilling a culture of innovation and resilience, I am the ideal candidate. I possess the acumen, experience, and unwavering dedication needed to lead organizations to unparalleled heights of security and success. 

Let's connect and explore how my transformative leadership can drive your company's growth in today's complex digital landscape.

Certified as: CISSP, CISM, CISA, CRISC, CGEIT, CSX-P, CDPSE, CCT, C|EH, E|CSA, L|PT, C|CISO, C|HFI, C|NDA, CIPP/e, CIPM, CIPT, FIP, CCSP, CCSK, S-ISME, S-DPP, C31000, PCS, SABSA, I am a Cybersecurity Rockstar!

Patric J.M. Versteeg, MSc.

✨ Information Security Forum World Congress 2025 — what an experience!

I had the privilege to present on Cybersecurity Leadership, powered by Lectorship Cyber Security - Utrecht University of Applied Sciences 

Bringing together research, field experience, and cultural leadership insights sparked truly meaningful conversations — and I couldn’t be more grateful for the response.

Here’s what participants shared:

“Excellent.”
“Inspiring.”
“Solidly founded by research and personal experience.”
“Nice, authentic way to present this.”
“Invaluable insight to bridge the gap between different styles of working and cultures.”
“Fun and engaging talk – a great start to the day!”

Hearing words like authentic, inspiring, practical, and engaging reinforces the importance of blending academic rigor with real-world leadership — and the human side of cybersecurity.

A heartfelt thank-you to the Information Security Forum community and everyone who joined, shared stories, and made this such a rewarding session. 🙏

Onward — to building trust, connection, and leadership that transcends culture and complexity. 🌍🔐

#CyberSecurityLeadership #ISF2025 #TrueNorth #NextGenCISO #CrossCulturalLeadership #AuthenticLeadership #UtrechtUniversity #CyberSecurity #LeadershipInAction

Patric J.M. Versteeg, MSc. MBA

taplio