Vanja Miletic

PROFILE

Information risk and cybersecurity professional with broad experience across crypto, fintech, retail, and banking. Track record of building and running risk, security, and AI governance programs that align with business goals, including with DORA, BaFin, and ISO 27001 expectations.

Has worked all three lines of defense: security engineering and architecture, internal audit, and risk. At ease with peer functions, engineers, executives, and regulators. Hands-on as well as strategic: designs the controls, tests them, and builds the tooling when none exists. Uses AI in that work, and checks what it produces. Looking for a leading role to drive the strengthening of security posture, secure AI adoption, and the harmonization of technical security controls with regulatory and legislative requirements.

SPECIALTY & CREDENTIALS

Specialty: Leading information security and information risk projects. Applying practical and compliant solutions. Delivering on-time in-full. Consulting. Mentoring. Identifying problems and root causes.

Defining frameworks. Prioritizing. Simplifying. Increasing awareness. Cultivating cross-functional buy-in to accelerate critical initiatives. Reporting. Running own AI tooling for security research and control work: self-hosted RAG over MITRE ATT&CK, MITRE ATLAS, SOC 2 TSC, and the EU AI Act.

Governing it to the same standard as any AI the business adopts.

Education: Information Technology School, Belgrade, BASc in E-Business

Certifications: CISSP, Open FAIR Foundation, CCSK, ISACA Advanced in AI Security Management (exam passed, certification application submitted)

Languages: English (fluent), Serbian (native)

KEY ACHIEVEMENTS

• Established Finoa's AI controls ahead of the August 2026 EU AI Act obligations: AI inventory, vendor evaluations, technical boundaries, and access control. Assessed over ten AI use cases and enabled adoption within defined limits.

• Built Finoa's information risk governance according to DORA and BaFin regulation, then drove its verification: risk-assessed major changes to scope the pen-testing, and tracked findings to remediation with Security Engineering.

• Directed the DORA compliance assessment and rebuilt third-party risk and ISMS frameworks against BaFin ZAIT and ISO 27001 at Zalando Payments.

• Rolled out two cloud-native security solutions at adidas and authored the global cloud infrastructure security standard.

• Hardened the security architecture at Societe Generale Bank, contributing to the bank's PCI DSS certification.

PROFESSIONAL EXPERIENCE

Finoa · Berlin, Germany · Startup - regulated crypto-assets service provider

Head of ICT Risk Office & Chief Information Security Officer Jan 2025 - July 2026

Reporting to the Chief Legal and Compliance Officer (MD). Led a two-person information security and risk team. Built the IT risk and cybersecurity control environment from a low base.

• Designed and implemented the information risk governance, the target measures catalog, and the risk reporting

• Introduced the AI security and governance framework: policies, vendor evaluations, inventory and data mapping, technical boundaries, access control

• Designed the incident response playbook with the CTO, and the classification template that decides Major status; filed the resulting reports to BaFin

• Joined the war room on high and major incidents; chaired the biweekly incident review with MD, business continuity, and risk: drove documentation and root cause analysis to completion, mitigations to assigned owners, and tracked remaining work against engineering capacity

• Steered Security Engineering and SOC priorities, and reviewed their output for quality and coverage

Zalando Payments GmbH · Berlin, Germany · FinTech

Principal InfoSec Risk Manager Sep 2021 - Dec 2024

Deputy CISO. Owned the company's "policy desk" and drove the alignment of the internal framework with regulatory and legislative requirements.

• Reported to executive management and the advisory board; supported regulatory audits

• Directed the DORA compliance assessment, and the assessments against BaFin ZAIT and ISO 27001

• Overhauled the ISMS framework: risk vocabulary, policies, guidelines, procedures, and roles and responsibilities for managing information risk

• Brought policies, standards, and procedures from all functions onto one central platform, and set the requirements criteria for the group's policy management tool selection

• Rebuilt third-party risk with standardized requirements, risk-scoring criteria, and assurance levels

Senior InfoSec Risk Manager Feb 2021 - Aug 2021

Reporting to the Chief Information Security Officer. Launched the initiatives that shaped the information risk agenda; promoted to Principal after seven months.

• Documented the intra-group services delivered to Zalando Payments and aligned stakeholders on accountabilities, boundaries, and SLAs, closing an intra-group outsourcing gap under BaFin ZAIT

• Assessed segregation of duties within and across critical business processes; built the SoD matrix of privilege combinations to avoid, signed off by process owners

• Designed the workflow for Rapid and Standard security assessments: participants, tasks, inputs, outputs, and interfaces

adidas AG · Herzogenaurach, Germany

Senior Manager - Corporate Internal Audit IT Jan 2019 - Jan 2021

Reporting to the Chief Audit Officer. Third-line assurance over IT and information security. Updated the risk universe, improved the audit methodology, and led international teams across audit and advisory engagements.

• Scoped audits and developed work programs against identified key risk areas

• Raised control issues and improvement opportunities across Big Data, IT asset management, Active Directory, Information Security, and Identity & Access Management

• Advised senior IT stakeholders on information security control improvements and remediation actions

• Risk-scored IT programs, applications, and entities

Senior Information Security Architect Mar 2017 - Dec 2018

Embedded information security into technical design across waterfall and agile projects.

• Rolled out two cloud-native security solutions and drove the initiative protecting the company's intellectual property

• Authored and enforced the global cloud infrastructure security standard

• Negotiated MSAs, SLAs, and commercial terms with data security vendors; delivered the cloud security operations blueprint to the SOC team

• Delivered security requirements across payment providers, distribution centers, contract management, and retail networks

Societe Generale Bank · Belgrade, Serbia · French multinational investment bank

IT Security Engineer Jan 2016 - Dec 2016

Security engineering on the bank's PCI DSS certification program, achieved during the engagement. Assessed control gaps and implemented the missing security layers. Classified sensitive data and specified encryption in transit for in-scope flows. Led security testing and solution integration with system integrators and major vendors.

Senior Network and Telecommunications Engineer Dec 2008 - Dec 2015

Led a team of network engineers. Designed a highly available and secure network of more than 1500 endpoints. Introduced authentication, authorization, and accounting for administrative access, and role-based access control for network devices and firewall clusters.

Education: Information Technology School, Belgrade, BASc in E-Business

Certifications: CISSP, Open FAIR Foundation, CCSK, ISACA Advanced in AI Security Management (exam passed, certification application submitted)