Alberto Cardenas

• Define and govern the Group enterprise security and digital architecture across multiple business units (Proximity & Health), ensuring alignment with corporate strategy and target state architectures.
• Establish enterprise architecture principles, standards, and guardrails embedding security, scalability, and resilience by design across applications, platforms, and infrastructure.
• Shape multi-year enterprise roadmaps and reference architectures guiding platform adoption, technology rationalization, and investment prioritization.
• Chair and influence architecture review processes to ensure compliance with target architecture, regulatory requirements, and defined risk appetite.
• Lead the evolution of the Secure Software Development Life Cycle into a Group-wide DevSecOps operating model, balancing speed, governance, and compliance.
• Own the enterprise security assurance strategy (penetration testing and continuous validation), optimizing risk coverage and vendor investment.
• Evaluate emerging technologies and lead Proofs of Concept (PoCs) to inform executive-level decisions on adoption, integration, and decommissioning.
• Serve as trusted advisor to executive stakeholders on cyber risk, architectural trade-offs, resilience strategy, and regulatory exposure.
• Mentor and influence architects, engineering leaders, and security domains across the organization.

M&A / Due Diligence Architecture Support (2024 – Germany)

• Supported Group M&A activities through on-site architecture due diligence at a manufacturing facility in Mainz, Germany.
• Assessed current-state technology landscape, security posture, architectural maturity, and integration risks.
• Provided executive-level insights to support post-merger integration planning.

• Led enterprise security domains including Application Security, Data Protection, Cryptography, and Identity & Access Management.
• Defined and governed data protection and cryptographic architectures (DLP, PKI, encryption, TDE, DBFW) aligned with business risk and regulatory requirements.
• Established secure development governance practices reducing vulnerability exposure and increasing software delivery maturity.
• Directed security awareness and incident response readiness programs, strengthening organizational resilience.
• Partnered with executive leadership during PCI, SOX, and ISO 27001 audits, translating technical findings into business impact assessments and prioritized remediation roadmaps.

• Designed enterprise incident response frameworks and forensic investigation methodologies.
• Acted as senior advisor and first responder for complex security incidents.

• Developed and coordinated undergraduate and graduate programs in Information Security and Engineering.
• Educated future cybersecurity professionals in Enterprise Security Architecture, Incident Response, and Digital Forensics.