Vanja Miletic

PROFILE

Information risk and cybersecurity professional with broad experience across crypto, fintech, retail, and banking. Track record of building and running risk, security, and AI governance programs that align with business goals, including with DORA, BaFin, and ISO 27001 expectations.

Has worked all three lines of defense: security engineering and architecture, internal audit, and risk. At ease with peer functions, engineers, executives, and regulators. Hands-on as well as strategic: designs the controls, tests them, and builds the tooling when none exists. Uses AI in that work, and checks what it produces. Looking for a leading role to drive the strengthening of security posture, secure AI adoption, and the harmonization of technical security controls with regulatory and legislative requirements.

SPECIALTY & CREDENTIALS

Specialty: Leading information security and information risk projects. Applying practical and compliant solutions. Delivering on-time in-full. Consulting. Mentoring. Identifying problems and root causes.

Defining frameworks. Prioritizing. Simplifying. Increasing awareness. Cultivating cross-functional buy-in to accelerate critical initiatives. Reporting. Running own AI tooling for security research and control work: self-hosted RAG over MITRE ATT&CK, MITRE ATLAS, SOC 2 TSC, and the EU AI Act.

Governing it to the same standard as any AI the business adopts.

Education: Information Technology School, Belgrade, BASc in E-Business

Certifications: CISSP, Open FAIR Foundation, CCSK, ISACA Advanced in AI Security Management (exam passed, certification application submitted)

Languages: English (fluent), Serbian (native)

KEY ACHIEVEMENTS

• Established Finoa's AI controls ahead of the August 2026 EU AI Act obligations, assessing over ten AI use cases and enabling adoption within defined limits.

• Owned the operational and information risk assessments across all assets at Zalando Payments.

• Built Finoa's information risk governance and target measures catalog to DORA and BaFin regulation.

• Ran Finoa's data discovery and classification, and defined the IT data retention and archiving.

• Directed the DORA compliance assessment; rebuilt third-party risk and the ISMS to audit readiness.

• Rolled out two cloud-native security solutions at adidas and authored the global cloud infrastructure security standard.

• Hardened the security architecture at Societe Generale Bank, contributing to the bank's PCI DSS certification.

PROFESSIONAL EXPERIENCE

Finoa · Berlin, Germany · Startup - regulated crypto-assets service provider

Head of ICT Risk Office & Chief Information Security Officer Jan 2025 - July 2026

Reporting to the Chief Legal and Compliance Officer (MD). Led a two-person information security and risk team. Built the IT risk and cybersecurity control environment from a low base.

• Designed and implemented the information risk governance, the target measures catalog that set control expectations against regulatory requirements, and the risk reporting

• Ran the ICT risk committee across the first and second line, with updates to internal audit: key risk factors, risk assessments, control effectiveness, and regulatory change

• Challenged the adequacy of controls in place and their root causes, advised on new initiatives and major changes, and oversaw implementation with first-line owners through action planning, milestones, and validation

• Coordinated audit and regulatory examinations end to end; tracked resulting actions to closure against the risk register, with named owners, defined evidence criteria, and exception management

• Ran data discovery and criticality determination; defined IT data retention and archiving

• Introduced the AI security and governance framework: policies, vendor evaluations, inventory and data mapping, technical boundaries, access control

• Designed the incident response playbook with the CTO, filed the resulting reports to BaFin, and chaired the reviews that closed root cause analysis with mitigations on named owners

• Steered Security Engineering and SOC priorities, and reviewed their output for quality and coverage

Zalando Payments GmbH · Berlin, Germany · FinTech

Principal InfoSec Risk Manager Sep 2021 - Dec 2024

Deputy CISO. Owned the company's "policy desk" and drove the alignment of the internal framework with regulatory and legislative requirements.

• Owned the operational and information risk assessments across processes, data, and infrastructure assets

• Set control expectations with the target measures catalog against regulatory requirements, challenged the controls in place, and advised on new initiatives and major changes

• Ran the information security working group to discover threats and weaknesses, review the control design, monitor KPIs, adjust performance thresholds, advise on control enhancements

• Coordinated regulatory audits end to end with the other lines of defense; tracked actions to closure against the risk register, with named owners, evidence criteria, and exception management

• Directed and executed the DORA compliance assessment, and the assessments against BaFin ZAIT and ISO 27001

• Overhauled the ISMS framework: risk vocabulary, policies, procedures, roles and responsibilities

• Rebuilt third-party risk with standardized requirements, risk-scoring criteria, and assurance levels

Senior InfoSec Risk Manager Feb 2021 - Aug 2021

Reporting to the Chief Information Security Officer. Launched the initiatives that shaped the information risk agenda; promoted to Principal after seven months.

• Documented the intra-group services delivered to Zalando Payments and aligned stakeholders on accountabilities, boundaries, and SLAs, closing an intra-group outsourcing gap under BaFin ZAIT

• Assessed segregation of duties within and across critical business processes; built the SoD matrix of privilege combinations to avoid, signed off by process owners

• Designed the workflow for Rapid and Standard security assessments: participants, tasks, inputs, outputs, and interfaces

adidas AG · Herzogenaurach, Germany

Senior Manager - Corporate Internal Audit IT Jan 2019 - Jan 2021

Reporting to the Chief Audit Officer. Third-line assurance over IT and information security. Updated the risk universe, improved the audit methodology, and led international teams across audit and advisory engagements.

• Scoped audits and developed work programs against identified key risk areas

• Raised control issues and improvement opportunities across Big Data, IT asset management, Active Directory, Information Security, and Identity & Access Management

• Advised senior IT stakeholders on information security control improvements and remediation actions

• Risk-scored IT programs, applications, and entities

Senior Information Security Architect Mar 2017 - Dec 2018

Embedded information security into technical design across waterfall and agile projects.

• Rolled out two cloud-native security solutions and drove the initiative protecting the company's intellectual property

• Authored and enforced the global cloud infrastructure security standard

• Negotiated MSAs, SLAs, and commercial terms with data security vendors; delivered the cloud security operations blueprint to the SOC team

• Delivered security requirements across payment providers, distribution centers, contract management, and retail networks

Societe Generale Bank · Belgrade, Serbia · French multinational investment bank

IT Security Engineer Jan 2016 - Dec 2016

Security engineering on the bank's PCI DSS certification program, achieved during the engagement. Assessed control gaps and implemented the missing security layers. Classified sensitive data and specified encryption in transit for in-scope flows. Led security testing and solution integration with system integrators and major vendors.

Senior Network and Telecommunications Engineer Dec 2008 - Dec 2015

Led a team of network engineers. Designed a highly available and secure network of more than 1500 endpoints. Introduced authentication, authorization, and accounting for administrative access, and role-based access control for network devices and firewall clusters.

Education: Information Technology School, Belgrade, BASc in E-Business

Certifications: CISSP, Open FAIR Foundation, CCSK, ISACA Advanced in AI Security Management (exam passed, certification application submitted)