When 100 Organisations Adopt the Same Security Framework Without a Mandate

The global cybersecurity industry faces a paradox: while 5.5 million specialist positions remain unfilled according to the ISC2 Cybersecurity Workforce Study 2025 report, the bar for actual expertise keeps rising. Companies need not just defenders but architects—professionals who write standards, develop methodologies, and shape how the next generation thinks about security. This evolution explains why certifications like CISSP and active participation in professional communities have become critical differentiators.

Sergei Beliachkov exemplifies this new breed of cybersecurity leader. As an ISC2 member who volunteers in developing CISSP exam questions, an ISACA member, and a CSA participant, his credentials extend beyond certificates on a wall. They represent active involvement in defining what cybersecurity excellence means. His published research on AI assistants in security and digital transformation assessment doesn't just document solutions—it creates blueprints others follow.

The practical impact is measurable: his risk assessment methodologies spread across 100+ organisations from Gazprom subsidiaries to international branches, prevented ₽200 million in a large company, and reduced vulnerabilities by 30% in fintech cloud infrastructure managing 2,000+ servers. However, perhaps more telling is his role as a Glonary Awards jury member, where he evaluates the next generation's innovations.

This combination of certification, publication, and mentorship raises fundamental questions about professional development in critical industries. Why does someone managing enterprise-scale security systems volunteer to write exam questions? How does publishing academic research translate to preventing real-world fraud? The answers reveal a crucial truth about cybersecurity's evolution: the most valuable professionals aren't just those who solve today's problems, but those who ensure tomorrow's specialists can solve problems we haven't imagined yet.

How a New Approach Shapes Industry Standards

As you know, large companies are more likely to face cyber attacks due to the fact that they carry out multimillion-dollar transactions. And, unfortunately, it is possible for experienced hackers to compromise even the most secure systems. However, in order to build a solid system, it is first important to analyze the risks and assess the possibility of building an anti-hacker defense.

When Sergei worked at Gazprom, one of the largest energy companies in the world, he was faced with the task of building a unified system of approaches to cybersecurity in dozens of subsidiaries. It was then that he developed the author's methods for assessing information security risks and compliance with GDPR requirements. These documents were not left on paper: they were approved at the management level and implemented in more than a hundred organisations, including foreign branches. In fact, this meant that a unified standard for personal data protection and risk management appeared for the entire group of companies, taking into account both local legislation and European standards. Such a large-scale project allowed companies to avoid fragmentation, reduce the time to implement requirements from several years to several months, and significantly reduce the cost of building security systems.

"In fact, we were creating a culture of personal data protection in a company where this area did not exist before. It was necessary not only to write standards, but also to convince management and employees that data security is part of the business, and not unnecessary bureaucracy," Sergei Beliachkov shared.

This was especially difficult, as many of the group's companies had not previously had their own expertise in this area. These solutions have been officially approved and have been applied in all Gazprom Group companies. As a result, organizations not only accelerated the implementation of information security systems, but also were able to reduce project costs, as common standards allowed them to avoid duplication and errors in the design of protection.

"The methodology was developed on the basis of several international standards, but at the same time, I took into account the specifics of the gas industry, the protective equipment used and the requirements of regulators. The main difficulty was that it was necessary to create a unified approach for hundreds of organisations with different levels of maturity in the field of security and a transparent management system. We have achieved this goal," Sergei Beliachkov commented.

New Generation Business Protection

Along with the rapidly developing world, where there are more and more ways to hack systems, information security specialists need to constantly improve their skills and develop something new. It was this thought that helped Sergei Beliachkov secure another system of a large company. When Sergei became the head of the information security division at a multidisciplinary holding company that unites companies from different sectors of the economy, his tasks went beyond methods and acquired a pronounced business dimension.

Under his leadership, the company implemented an information security management system according to the international standard WLA-SCS:2016, which allowed it to meet the strict requirements of the global lottery industry. But the main challenge was mergers and integrations: the migration of more than 500 servers, the migration of dozens of information systems and 300 jobs.

"We can say that the system was highly vulnerable before the new development. To remedy the situation, we created an information security risk matrix for the entire holding, implemented DLP, a print protection system, and BrandProtection. These steps made it possible to close critical vulnerabilities that directly affected business processes," Sergei shared.

At the same time, Sergei's team identified fraudulent schemes with the company's products and prevented leaks worth over 200 million rubles. This case was significant: a competent security system protected not only the data, but also the real money of the company.

"Once I coordinated the efforts of multiple security providers, cybersecurity service providers, and associated companies, resulting in the successful removal of a foreign Advanced Persistent Threat (APT) group from the client's infrastructure. This was not a training attack, but a real espionage operation. We didn't just close vulnerabilities—we actually cleaned out the digital space from intruders," Sergei commented.

Beliachkov now heads a team at a large fintech company, where, in just four months, he deployed an OpenStack-based cloud region protection system from scratch, involving more than 2,000 servers. He implemented Secure Development Requirements (SSDLC) for 500+ components, which reduced the number of vulnerabilities and reduced production costs by 30%.

"As a Service manager, I deployed information security services for a valuable customer with more than 7000 users and more than 500 servers. We have built a complete protection circuit—from SOC to WAF and PAM. But the most important thing was not to implement the tools, but to teach the business to live in a new model where security is built into every action," Sergei shared.

In an era when cloud services are becoming the main target of attacks, such projects are critically important for businesses and the state. Only highly qualified specialists can cope with such loads and develop really working protection systems. Therefore, it is important for Sergei not only to put tasks into practice but also to improve his skills and confirm his knowledge. Sergei's practical experience is complemented by his active participation in the international professional community, where he is a member of ISC2, which is one of the largest international organisations of information security specialists. Membership implies professional growth, access to training materials, conferences, and networking events. Moreover, Sergei Beliachkov is a member of ISACA and CSA (professional associations for auditors and information systems management specialists), a volunteer for the development of the special exams, and a participant in cloud security working groups. Sergei is involved in the creation and testing of the CISSP exam as a volunteer. This means that he helps to develop questions, evaluates their correctness and relevance. This experience allows for a deeper understanding of the requirements for security professionals, industry standards, and best practices.

Transfer of Experience for New Personnel

There are fewer cybersecurity specialists, in part because of strict selection in the industry. To become a truly sought-after specialist, one must gain experience and as much additional knowledge as possible. Sergei often encounters young talents as a member of the jury of various competitions.

The Organising Committee of the International Glonary®Awards in the field of cybersecurity invited Sergei Beliachkov to become a member of the jury. He was selected from among highly competitive candidates for his outstanding professional achievements and full compliance with the principles of the award—professionalism, transparency and impartiality. A large number of talented developers participate in the competition, and the jury identifies the most interesting projects for the industry.

How else can people transfer experience to young professionals? Sergei did not stop at judging and published several scientific articles. For example, he has an article on 'Using AI Assistants to Enhance Information Security Efficiency.' The article explores the potential of introducing virtual AI assistants to enhance information security in the context of the rapid development of digital technologies and the increasing complexity of cyber threats. Special attention is paid to challenges and limitations such as technical vulnerabilities, false positives, ethical and legal aspects, as well as functional limitations in complex scenarios. In addition, an article published in the Asian Journal of Research in Computer Science on the assessment of information security practices in the context of digital transformation teaches young professionals to study the industry and assess how current controls, processes and culture correspond to emerging risks.

"For me, cybersecurity is not only about protecting against attacks. This is the foundation on which sustainable business growth is built. If a company ignores this aspect, it loses both data and the future," Sergei Beliachkov shared.

Such highly qualified specialists can influence not only their company, but also entire industries: build standards, protect millions, clean infrastructure from cyber spies, and build cloud security. In the context of a global shortage of personnel, experts determine the future of the industry. Their experience, methods and participation in professional communities are becoming a response to the growing wave of cyber threats that threaten every company today—from small businesses to multinational corporations.