Recent role
Security Awareness & Communications Manager, BNP Paribas Fortis · Feb 2025 – Oct 2025
Contract & freelance · open via agencies & direct
Davide Guglielmi
Cybersecurity Consultant · Security Culture, Awareness & Human Risk
Security culture, awareness and phishing programs for regulated environments, aligned with ISO 27001 and NIS2.
Background
Certification
SANS Security Awareness Professional (SSAP) · GIAC, Oct 2024 · SANS LDR433 Managing Human Risk
Languages
Dutch (native)
English (professional)
French (conversational)
Italian (fluent)
What I bring
Phishing program ownership
Built and ran end-to-end phishing programs for 19,000+ employees across 27 entities: risk-based segmentation, scenario design, campaign operations, and knowledge transfer.
Security culture strategy
Contributed to cyber culture planning at BNP Paribas Fortis: translated maturity data into a 12-month awareness roadmap with target groups, priorities, KPIs, and management reporting.
Multi-client delivery
Delivered 8 concurrent client awareness programs in one year, from government agencies to 1,500+ employee organisations, on KnowBe4 and Phished.io.
KPIs & reporting
Produced maturity KPIs, management dashboards, and repeat-clicker trends, with SOC-aligned data quality that auditors can use.
Compliance alignment
Built audit-ready awareness artefacts for regulated environments: ISO 27001, NIS2, and internal controls.
Handover & process
Documented handover packs and process guides so phishing and awareness operations continue after the contract ends.
Stakeholder communication
Partnered with SOC, HR, Communications, CISOs, and DPOs, including a multi-month password manager rollout with measurable adoption.
Role-based awareness
Designed awareness and training for different audiences — executives, managers, engineers, operators — with content, risk, and reporting aligned to each group.
Role fit
- Security culture / awareness lead: structured programs, role-based awareness, KPIs, stakeholder reporting, and behavioral outcomes in regulated environments
- Phishing simulation / awareness program manager: owning campaigns, KPIs and stakeholder reporting
- Human risk / security culture roles: translating maturity data into prioritized, measurable plans
- Awareness maturity and gap analysis: baseline assessment, prioritized gaps, and a roadmap to close human-risk weaknesses
- Compliance alignment: ensuring awareness and human-risk activities support ISO 27001, NIS2, internal controls, and audit evidence
- Broader security or compliance mandates where awareness and human risk are a defined part of scope (ISO 27001, NIS2)