Mourad Ayadi

Information and product security professional who builds security functions from the ground up and turns EU regulation into working practice.

At Mitsubishi Electric

Europe, I established the EMEA product security programme and PSIRT for 7 business units and 12 affiliates within my first year, operating at Information Security Management level as the right hand of the Regional CISO EMEA. I combine governance (ISO/IEC 27001, BSI IT-Grundschutz, NIS2, CRA) with a technical background in software, automation and IT operations, and I am at home in international, multi-entity organisations, working daily with headquarters in Japan, affiliate leadership and EU authorities.

PSIRT / Product Security Expert, EMEA at Mitsubishi Electric Europe B.V. (2025-05 – Present)

Reporting to the Regional CISO EMEA. Scope: 7 business units and 12 affiliates across Europe, operating at Information Security Management (ISM) level.

• Built the EMEA product security governance and PSIRT from scratch: roles, responsibilities, escalation paths and processes connecting business units, affiliates, headquarters in Japan and EU authorities.
• Authored the Product Security Vulnerability & Incident Management policy with mandatory and recommended requirements for all business units and steered its rollout ahead of the CRA deadline.
• Run vulnerability intake, triage and coordination with product owners, define risk-based handling and prepare CRA reporting obligations towards EU authorities.
• Automated the intake process end to end so every report is captured, traceable and routed without manual handling.
• Steer the external CRA product scoping assessment (KPMG) and report CRA and NIS2 status and risks to senior management.
• Drive the NIS2 programme for the affiliates: incident response guidebook, EU-wide authority reporting map, ransomware runbook and third-party supply chain security template.
• Map security frameworks (NIS2, NIST and others) onto a common control set to derive consistent requirements for the affiliates.
• Jointly design a harmonised security reporting channel with headquarters in Japan, aligning product, NIS2 and other security reporting routes.
• Act as the right hand of the Regional CISO EMEA on strategy and priorities; prepare decisions and management communication.
• Advise affiliate management up to CEO and CIO level on CRA, NIS2 and OT security; coordinate the OT security workstream for European affiliates.
• Set up a CRA working group and a European product security community with the affiliates.
• Plan the annual budget for security advisory and GRC tooling; prepared CRA and NIS2 content for senior management and the EMEA IT managers meeting.

Cyber Security Analyst at Accenture (2023-07 – 2025-04)

• Designed and established a complete ISMS governance for a large German federal agency based on BSI IT-Grundschutz (ISO/IEC 27001-based) within a large-scale, multi-team programme.
• Integrated security requirements into the agency's IT products together with agile development teams in a CI/CD-based delivery environment.
• Conducted risk analyses, threat modeling and security assessments; modeled systems and processes against the required controls and identified gaps.
• Created security policies, concepts and documentation and advised developers and product teams in programme-wide events and workshops.

Cyber Security Consulting (Intern, then Working Student) at KPMG AG Wirtschaftsprüfungsgesellschaft (2022-07 – 2023-06)

• Built a Python-based reporting automation for a German automotive manufacturer, publishing visual reports automatically to Confluence.
• Developed a Power BI security dashboard for C2M2 (Cybersecurity Capability Maturity Model) assessment results.

IT Systems Administration & Product Development (Working Student) at Secusmart GmbH, a BlackBerry company (2020-09 – 2022-06)

• Administered Windows and Linux servers, Active Directory, DNS, DHCP, Exchange, the internal network, user rights and backups for a provider of secure mobile communication for governments.
• Supported product development with test automation for iOS and Android.

IT Systems Administration (Working Student) at Midoco GmbH (2019-05 – 2020-04)

• Configured Linux and Windows workstations, wrote Bash scripts for test systems and supported the OpenVPN migration.

M.Sc. in Computer Science, focus IT Security – FernUniversität in Hagen, Germany (2024)

B.Sc. in Computer Science – Hochschule Niederrhein, Germany (2023)