Vanja Miletic

PROFILE

Information risk and cybersecurity professional with broad experience across crypto, fintech, retail, and banking. Track record of building and running risk, security, and AI governance programs that align with DORA, BaFin, and ISO 27001 expectations, while staying close to the realities of the business. Comfortable shaping policies and at ease with engineers, executives, and regulators.

Looking for a leading role to drive the strengthening of security posture, secure AI adoption, and the harmonization of technical security controls with regulatory and legislative requirements.

SPECIALTY & CREDENTIALS

Specialty: Leading information security and information risk projects. Consulting. Mentoring. Identifying problems and root causes. Defining policies, processes, and procedures. Prioritizing. Simplifying. Increasing awareness. Cultivating cross-functional buy-in to accelerate critical initiatives. Reporting.

Education: BASc in E-Business Certifications: Open FAIR Foundation, CISSP, SSCP, CCSK, ITIL Foundation

KEY ACHIEVEMENTS

• Built Finoa’s information risk governance according to DORA and BaFin regulation.

• Established Finoa’s AI controls, aligning business adoption with compliance boundaries.

• Directed the DORA compliance assessment and rebuilt third-party risk and ISMS frameworks against BaFin ZAIT and ISO 27001 at Zalando Payments.

• Led adidas cloud security adoption - rolled out two cloud-native solutions, authored the global cloud infrastructure standard, and consolidated the security vendor portfolio.

• Hardened the security architecture at Societe Generale Bank, aligning with PCI DSS.

PROFESSIONAL EXPERIENCE

Finoa · Berlin, Germany · Startup - crypto-assets service provider

Chief Information Security Officer Jan 2025 - July 2026

Reporting to the Chief Legal and Compliance Officer - Managing Director. Responsible for the governance and control of IT risk management and cybersecurity, executing 2nd line duties.

• Designed and implemented the information risk governance

• Defined a realistic and compliant target measures catalog

• Introduced the AI security and governance framework: drafted foundational policies, conducted vendor evaluations, mapped inventory and data in scope, and deployed technical access controls

• Defined and executed cybersecurity tests and information risk reporting

Zalando Payments GmbH · Berlin, Germany · FinTech

Principal InfoSec Risk Manager Sep 2021 - Dec 2024

Deputy CISO. Responsible for 2nd line duties, leading the improvements in information security and information risk management. Owned the company's “policy desk” and drove the alignment of internal regulation with regulatory and legislative requirements.

• Directed the DORA compliance assessment and alignment initiative

• Led compliance assessments against BaFin ZAIT requirements and the ISO 27001 control framework

• Created and implemented the risk vocabulary, policy, guidelines, procedures, and roles and responsibilities for managing information risks

• Established security assessment processes and segregation-of-duties protocol

• Improved 3rd-party risk assessments by introducing standard information security requirements, risk-scoring criteria, and assurance levels

• Reported to executive management and the advisory board; supported regulatory audits

Senior InfoSec Risk Manager Feb 2021 - Aug 2021

Reporting to the Chief Information Security Officer. Responsible for 2nd line duties, launching the initiatives to strengthen information security and information risk management.

adidas AG · Herzogenaurach, Germany

Senior Manager - Corporate Internal Audit IT Jan 2019 - Jan 2021

Reporting to the Chief Audit Officer. Responsible for 3rd line duties - analyzing the risk universe and enhancing audit methodology and processes. Led multicultural teams across audit and advisory engagements, collaborating with senior directors of Corporate Compliance, Information Security, Enterprise Architecture, Risk, Internal Controls, Procurement, and Legal teams.

• Identified key risk areas and developed audit scope and work programs

• Identified control issues and improvement opportunities across audit projects: Big Data, IT asset management, Active Directory, Information Security, Identity & Access Management

• Provided consultancy on improvements in information security controls and worked with senior IT stakeholders to determine remediation actions

• Risk-scored IT programs, applications, and entities; leveraged analytics and identity governance teams to lift data accuracy and speed

Senior Information Security Architect Mar 2017 - Dec 2018

Embedded information security into the technical design across waterfall and agile project teams. Reviewed policies and procedures aligning with Corporate Governance, Enterprise Architecture, Risk, Compliance, Legal, Procurement, and Data Privacy teams.

• Rolled out two cloud-native security solutions and drove the initiative that increased the protection of the company's intellectual property

• Authored and enforced the global cloud infrastructure standard

• Negotiated MSAs, SLAs, and financial deals with data security vendors; delivered the operations blueprint for the cloud security solution to the SOC team

• Delivered requirements across cloud-based information security, payment providers, distribution centers, contract management, digital asset management, and retail networks - on budget and on time

Societe Generale Bank · Belgrade, Serbia · French multinational investment bank

IT Security Engineer Jan 2016 - Dec 2016

Discovered security gaps and implemented missing security layers. Led testing and solutions integration. Collaborated with system integrators and major vendors. Identified and labeled sensitive data, and specified encrypted data in transit in preparation for PCI DSS certification.

Senior Network and Telecommunications Engineer Dec 2008 - Dec 2015

Responsible for leading a team of network engineers. Designed a highly available and secure network of more than 1500 endpoints. Collaborated with vendors and system integrators. Introduced secure authentication, authorization, and accounting for administrative access, and rolled out role-based access for network devices and firewall clusters.

Education: BASc in E-Business

Certifications: Open FAIR Foundation, CISSP, SSCP, CCSK, ITIL Foundation