Omar El Hachimi / Projects / Security command center
Project 05 · LCL · Crédit Agricole group · 2023 – this yearOmar El Hachimi proposed, designed and built LCL's security command center: it gathers the findings of every security scanner, ranks them by real risk and tracks remediation team by team. It became the bank's enterprise security standard.
What I publish: the architecture, the design choices and rounded figures. Never code, internal documents or people's names.
LCL ran several security scanners, each covering a layer: code, dependencies, containers, artefacts. Each produced its own list of findings, in its own format, with its own idea of severity. Nobody could answer three simple questions: which vulnerabilities matter most, who has to fix them, and how fast are they being fixed? Meanwhile, the regulator was asking for proof of remediation.
One model of the bank's vulnerabilities, and a reason to fix them. I proposed a security command center and built it: connectors to every scanner feed ETL pipelines that consolidate, normalise and de-duplicate findings into a single model, by application and by team.
Each finding is scored by the severity of the vulnerability multiplied by the criticality of the application, so a critical flaw in a customer-facing system rises to the top and the same flaw in a minor internal tool does not. Every team sees its own ranked list; security managers see the whole bank. A gamified mode and leaderboards on remediation speed turned fixing into something teams compete on. The history of fixes is kept.
The command center covers 700+ applications and 100+ teams and was adopted as the bank's enterprise security standard, the reference tool for security managers and compliance. The fix history gives the bank auditable evidence of remediation under DORA.
The same flaw matters more in a customer-facing application than in a minor internal tool. Scoring severity times application criticality puts the right work at the top of each list.
Leaderboards on remediation speed turn fixing into something teams can see and compare, rather than a backlog nobody looks at.
Bring every scanner's findings into one model, score each finding by severity multiplied by the criticality of the application, and show each team its own ranked list. The security command center Omar El Hachimi built at LCL does this for 700+ applications.
I take on freelance missions and consider permanent roles. Send me a short description of the need.
How I work on this kind of mission: Generative AI for banks and insurers, under control.