anDREa's Roles and Responsibilities Matrix

	A	B	C	D	E	F	G	H	I	J	K	L
1	Version	2024-11-07	# people	13		12.6	FTE
2	Role	Director	Business Manager	Operations Manager	Security Officer	Customer Support Specialist	Sofware Engineer (development team)	Senior QA Engineer	Junior QA Engineer	Administrative Assistant	Secretary (to the Director)	Scrum master

3	Name (since)	Stefan van Aalst (2024-01-01)	Pascalle Broer (2023-04-01)	Johanna Hakonen (2023-04-01)	MT performs this role as of April 2025	Ardit Vani (2023-04-17 untill 2025-08-31) Irene Stenvers (2025-08-01)	Kunal K. (2024-01-12) Tinu O. (2024-04-02) Timo L. (2021-08-01) Ubaid I. (2022-02-21) Usman A. (2023-06-19)	Sayali Shitole (2023-11-20)	Alexandr Sincari (2025-05-05)	Mathieu Traas (2023-11-06) Joeri van Aalst (2025-07-01)	Danijela Djukic (2022-05-02; ext)	Sayali Shitole (2023-11-20)
4	Leadership	Sets overall strategic direction, vision, and goals for anDREa. Leads MT. Provides leadership, direction and if required fills in any gap that might arise.	Part of Management Team. Oversees and manages the day-to-day business side of anDREa	Part of Management Team. Oversees and manages the day-to-day operational side of anDREa.	Ensures the security and protection of company assets, data, and personnel	Informally manages the local Support Team members of the client	Works according to Agile framework: Development team, Product owner, Scrum master	Works according to Agile framework: Development team, Product owner, Scrum master	Works according to Agile framework: Development team, Product owner, Scrum master	Not applicable	Not applicable	Works according to Agile framework: Development team, Product owner, Scrum master
5	Strategic Planning	Develops and implements the company's strategic plan and goals	Assists in developing and implementing the overall business strategy	Implements and executes operational strategies aligned with overall business goals	Develops and implements security strategies, policies, and procedures	Provides input	Provides input	Provides input	Provides input	Provides input	Not applicable	Provides input
6	Financial Management	Oversees financial planning and budgeting, financial analysis, financial reporting, and configuration of the financial systems.	Assists in financial planning and budgeting for the business	Assists in managing operational expenses and budgets	Manages and monitors security-related budgeting and financial planning	Not applicable	Not applicable	Not applicable	Not applicable	Assisting Business Manager	Not applicable	Not applicable
7	Business Development	Identifies and pursues business growth opportunities, including partnerships, acquisitions, and market expansion. Is directly responsible for sales.	Assists in identifying and pursuing marketing awarness opportunities.	Provides input on technology-related business development opportunities, and identifies and pursues business growth opportunities with clients and collaboration parties.	Identifies and manages security-related business risks, including threat assessments and incident response	Provides input	Provides input	Provides input	Provides input	Provides input	Not applicable	Provides input
8	Operations Management	Provides oversight and guidance to all departments, ensures efficient operations, and monitors performance	Manages day-to-day business operations, including human resources, financial administration, procurement, reporting and events.	Oversees and manages the day-to-day operations of the operations department, including production, logistics, and quality control	Implements and manages security measures and protocols, including access control, surveillance, and incident management	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
9	Team Management	Builds and leads a high-performing executive team, provides guidance and support to employees	Manages and develops the business team, provides guidance and support to employees, HR confidant	Leads and manages the operations team, ensures optimal performance and productivity	Provides leadership and guidance to security personnel, conducts training and awareness programs	Not applicable	Works according to Agile framework: Developement team, Product owner, Scrum master	Works according to Agile framework: Developement team, Product owner, Scrum master	Works according to Agile framework: Developement team, Product owner, Scrum master	Not applicable	Not applicable	Works according to Agile framework: Developement team, Product owner, Scrum master
10	Stakeholder Management	Represents the company to external stakeholders, including investors, customers, suppliers, collaborators, and partners	Represents the business to external stakeholders, including customers, suppliers, and partners	Represents the business to external stakeholders, including customers, suppliers, collaborators, and partners	Acts as a liaison with external security officers, agencies, law enforcement, and regulatory bodies	Represents the company to end users and reports findings/observations stemming from users.	Manages together with Operations Manager the roadmap	Not applicable	Not applicable	Not applicable	Plans meetings for the company with external stakeholders, including investors, customers, suppliers, collaborators, and partners	Not applicable
11	Risk Management	Identifies and manages strategic and operational risks, develops risk mitigation strategies, including cybersecurity and data privacy.	Assists in identifying and managing business risks, develops and implements risk mitigation strategies	Identifies and manages operational risks, including production delays and quality issues, develps and implements risk mitigation strategies	Identifies and manages security risks, conducts risk assessments, implements security controls, and insures MT is informed at any given time.	Identifies and reports operational risks observed directly or from any user interaction.	Identifies and reports operational risks observed directly or from any user interaction. Ensures that best practices are applied on software development	Ensures that best practices are applied on software development by testing the software solution before publishing	Ensures that best practices are applied on software development by testing the software solution before publishing	Not applicable	Not applicable	Identify and remove obstacles that hinder team productivity and project progress, communicate identified risks further to management
12	Innovation and Technology	Drives innovation and technological advancements to stay ahead of the competition	Utilizes technology for business optimization and efficiency	Implements and manages technology solutions to support operational processes	Implements and manages security technologies, including firewalls, intrusion detection systems, and encryption tools	Contributes in trying out innovative or new applications of myDRE	Contributes in developing innovative or new applications for myDRE	Contributes in trying out innovative or new applications of myDRE	Contributes in trying out innovative or new applications of myDRE	Not applicable	Not applicable	Contributes in coordinating trying out innovative or new applications of myDRE
13	Reporting and Accountability	Reports to the Supervisory Board and other stakeholders on company performance	Reports to the Director.	Reports to the Director.	Reports to business manager on daily activities and advises senior management when necessary and / or upon request, to stakeholders on security performance	Reports to operations manager on ticket handling and user requests	Reports to operations manager development progress	Reports to operations manager on testing progress	Daily reports to Senior QA Engineer on testing progress and in reports general to operations manager	Reports to business manager	Reports to the Director	Reports to operations manager on team status
14	Financial Mandate (up to, and Entering Agreements applies)	Up to €50K. Up to €100K requires 2nd signature of one of the managers. Above €100K requires approval of the Supervisory Board.	Self up to €1.5K. Up to €50K 1st or 2nd signature. Up to €100K 2nd signature.	Self up to €1.5K. Up to €50K 1st or 2nd signature. Up to €100K 2nd signature.	Max +10% above value of same agreement the year before.	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
15	Entering Agreements	Any, non-standard after being counter read by at least one of the managers. Default digital signing of contracts is facilitated by the Business Manager.	Facilitates the digital signing of contracts. Can sign standard contracts.	Digitally sign standard contracts (loan agreements). Increase volume of existing contracts.	Repetition of previous contracts	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
16	Known toxic combinations & mitigations	Self-authorization. All agreements have to be minimally counter read by one of the (other) managers. Can only approve payments ready to be paid and pay the payments; all payment steps in the payment process are logged.	Self-authorization. All agreements have to be minimally counter read by one of the (other) managers. Can only approve payments ready to be paid and pay the payments together with Operations Manager; all payment steps in the payment process are logged.	Self-authorization. All agreements have to be minimally counter read by one of the (other) managers. Operations manager can only approve payments ready to be paid together with Business Manager. All steps in the payment process are logged.	While the Security Officer will be more and more tasked with internal audits, anDREa has engaged an external person to do the formal internal audits.	Unknown	Unknown	Unknown	Unkown	Unknown	Unknown	Unknown
17	Certifications mandatory*	NIS-2 board training when law is final	NIS-2 board training when law is final	NIS-2 board training when law is final	AZ-900 internal, S-ISF, S-ISP, NIS-2 board training when law is final	AZ-900 internal	AZ-900 (or: AZ-204 /AZ-104 + AZ-305)	AZ-900	AZ-900 internal	Not applicable	Not applicable	AZ-900
18	Certifications optional	AZ-900 internal	AZ-900 internal	AZ-900 internal		NIS-2 basics training when law is final	NIS-2 basics training when law is final	NIS-2 basics training when law is final	NIS-2 basics training when law is final	AZ-900 internal		NIS-2 basics training when law is final
19	VOG requirement	Yes, renew every 2 years	Yes, renew every 2 years	Yes, renew every 2 years	Yes, renew every 2 years						Yes, renew every 2 years
20
21		* On 10th April 2025 during the ISMB, it was decided that at least the offical AZ-900 certification needs to be obtained by most employees who are part of the development team and Support & Assurance. An internal AZ-900 exam will be developed before end of May 2025, which will be mandatory for the other employees in the development team and Support & Assurance. The internal AZ-900 exam will be optional for all other employees.
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57		#REF!			Robert Dumitrescu (2024-01-11) Last day 2025-05-30
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100