Dustin Dehez-Regulatory Risk Executive | Risk Governance & 2nd LoD in Banking | EU AI Act, DORA, MaRisk, NFR | CEO Secori Advisors GmbH

3rd LoD/Run the Bank (RtB)

• External consultant for short-term validation of artifacts from remediated findings of the ECB's Joint Supervisory Team (JST) in third-party management
• Design and implementation effectiveness validation, test design, execution, and documentation, and preparation of validation reports.

1st LoD/Change the Bank (CtB)

• External consultant in a CtB project to redesign the third-party risk management of the group
• From January 2023 onwards: Workstream Lead (4 FTE) for the re-design and implementation of the future state of the third-party risk assessment. Responsible for the design of the new core process and various sub-processes, the new control set for third-party risk assessments, alignment of the control set with internal requirements, drafting of strategies and concepts and corresponding stakeholder reporting.
• July 2022 to December 2022: Workstream Lead (3 FTE) for the re-design of the third-party information security requirements. Development of the contractual amendment covering information security requirements for third parties. Alignment of the conceptual approach and the appendix with the relevant departments in the organisation (legal, 2nd and 3rd LoDs), and corresponding stakeholder reporting
• Drafting and aligning the documentation to close the corresponding findings with the regulatory authorities and alignment with the stakeholders to report finding closure
• Drafting and aligning of the cloud strategy and the cloud service provider assessment strategy
• Drafting and aligning of the group's supplier security guideline
• Drafting and aligning the new process landscape with stakeholders within the group and assuring approval from stakeholders and 3rd LoD.
• Ensuring that the future state meets regulatory requirements as stipulated in EBA-guidelines (ICT and outsourcing), MaRisk, BAIT, DORA

1st LoD/Run the Bank (RtB)

• External consultant for information risk management in the bank's vendor/third-party risk management department
• Project lead in the development and implementation of the major change in the key operating procedure on information security requirements in third-party relationships, supporting the shift to the cloud-based landscape and aligning the information security requirements for vendors with applicable regulatory requirements (MaRisk AT9, BAIT, GDPR, EBA Guidelines on outsourcing, HKMA, MAS, FED, PRA) and relevant industry standards (ISO 27001, CCM, SOC2)
• Auditing of the bank's risk exposure in numerous third-party/outsourcing relationships, auditing of evidence submitted by third-parties and their compliance with the bank's information security requirements
• Tracking and assessing risk mitigation plans for third parties, including the coordination of finding closures
• Coordination with stakeholders in different business units across the bank
• Reporting and documentation of the bank's risk exposure based on the Cyber-, IT-, and non-IT-risk appetite based on relevant ISO 27001 and ISO 27005 criteria

• External Data Protection Officer
• Introduction of a software tool to run the data privacy management system
• Implementation and maintenance of a record of processing activities
• Data protection impact assessments and transfer impact assessments and corresponding risk management

• Due diligence for the German part of a larger British due diligence
• Open-Source Intelligence and assessment of collected evidence
• Strategic consulting for project continuation

Founder (since 10/2014) and Chief Executive Officer (since 09/2025), with 5 direct reports and 20 indirect reports. Built a company from scratch without seed funding and grew it into a risk consultancy with ~ EUR 3 million in annual turnover, now certified as a Great Place to Work, with extremely low employee turnover. Drove change in the firm, from scaling to people management and establishing internal governance for the adoption of AI in the firm.

• SAP SE: Designed and delivered an enterprise-wide AI Governance & Control Framework, translating regulatory and industry requirements into a unified, auditable control model for AI-enabled processes and applications. Defined a control library of 200–250 measures, established audit evidence requirements, and aligned cross-functional stakeholders to strengthen AI governance, assurance, and regulatory compliance.
• Deutsche Leasing: Led BaFin remediation workstream following a special BaFin IT audit, redesigning guidelines for the IT landscape ("information network"), structural analysis, and protection requirements classification, delivered new end-to-end processes and tool integration, positioning 2nd LoD for BaFin closure and DORA compliance.
• Deutsche Bank: Validated finding closure as Internal Audit (3rd LoD) to close JST (ECB) findings in outsourcing management.
• Hessische Landesbank: Ran IT risk management for Hessische Landesbank (1st LoD): annual IT risk assessments, stress tests, and cross-LoD coordination. Redesigned the core information risk process to resolve ECB findings, introduced a deviation-tracking model, and embedded the new framework into the bank-wide risk exercise—accepted by the ECB and operationalised across non-financial risk governance.
• Deutsche Börse: Redesigned third-party risk management from the ground up; delivered DORA-ready processes, closed regulatory findings, and implemented new vendor security requirements across the cloud and supplier landscape. New framework aligned to EBA guidelines, MaRisk, BAIT, and approved by Internal Audit and regulators.
• Deutsche Bank: Redesigned vendor information security framework: delivered cloud-ready procedures compliant with MaRisk, BAIT, EBA, HKMA, MAS, FED, PRA, ISO 27001, and SOC2. Audited third-party risk exposure, coordinated finding closures.

• Preparation of lectures and presentations
• Preparation of briefs
• Coordination of events