John Wan

* Establish IT controls taxonomy based on International standard and industry best practice as 1.5 line of defenses * Establish IS controls taxonomy based on enterprise risk framework, International standard and industry best practice as 2 line of defenses * Contribute to the enhancement and evolution of the TRM program and framework, including execution of targeted risk assessments on holistic technology risk and enhance current practices to mitigate cyber risks and the establishment of a risk framework. * Research and submit cybersecurity insurance questionnaire with interviewing different BUs and related stakeholders * Work with enterprise risk management team to define the technology risk areas and priority * Build and lead the team on establishing control assurance program to assess the control design effectiveness and operating defectiveness based on defined control taxonomy * Reporting to senior management on the current security posture and provide recommendation on risk remediation action.

- CTRO in China legal entity * Oversee key aspects of technology risk management activities as an independent risk advisor by enforcing the Firm-wide IT Risk Management Framework (ITRMF) and Legal Entity (LE) specific regulatory requirements * Enhanced the technology risk management and promote the bank IT grade * Monitor and act as the independent advisory role to assist CEO on the responses to regulatory inquiries/inspections/audits * Work on supporting global technology risk assessment programs and help define local requirements * Jointly work with functional risk officers on assessment of IT risk exposures, conducting self-assessment and data analysis to help identify technology related risks and exceptions, and subsequently monitoring, tracking and managing them. Areas and examples for these analyses include vendor and supplier related risks, stability and incidents etc. * Support the implementation and maintenance of technology policies and standard. Enforcing compliance with Firm-standard technology risk posture in MSBIC * Develop 3 years plan with CIO and as B role of CIO * Direct report to CEO, functional report to regional head of Tech Risk * Manage and work with the teams virtually from SH tech center and teams from Japan/HK/Singapore/US/India, for example vulnerability team, IAM, infrastructure, etc. * Provide technology risk update to senior management and the board

- Head of Information Security * Handled IT security issue, including local, US and Europe Government requirement * Outsourcing committee member in order to setup the new framework for the bank which taking care of SA-2 and TM-G-1 and MAS and GDPR * Setting up Data Protection Committee, developing data governance and monitoring the data protection related issue including PCPD and MAS and GDPR requirement * Primary point of contact to represent the bank for external regulatory engagements and for local business, technology and business risk stakeholders * Chairman on incident management and BCM process for HK Protest and COVID-19 pandemic * Responsible to build, record, maintain and improve the country risk posture in line with global standards, business continuity management and technology including physical security * Member of the regional security team part of the 2nd line of defense * Manage a team of 2 people for daily cyber security issue and regular tasks, for example clean desk policy check, etc. * C-RAF handling - Head of Organization * Responsible on governance topic for the branch * Manage a team of 6 people for daily operation, including event management * Head of procurement, serving all business units in bank * Pushing Know Your Business partner (KYB) policy and tools for vendor management * Cut 15% cost of the department by reviewing the existing contract and cancel some unnecessary contract * Outsourcing Topic handling * Head of administration, serving all business units in bank * Handling insurance for the branch * Head of facility management, including fire prevention measures * Office leasing project * Data Center management on both server room in HK

- Head of Information Security Management * Handling request from Regulatory Authority, for example HKMA, SFC and CBRC * Coordinate with audit firm on C-RAF and iCAST * Managing internal and external IT audit * Participate in IT security awareness activities and make presentations to IT peers and senior management. * SIEM – monitor the IT security systems and respond to threats and incidents appropriately - Deputy Head of IT Infrastructure & Management * Setup production and DR Data center for the bank within half year * Design and implement the first production and DR IT core infrastructure for the bank in HK and China * Migrate the email system from BOCHK to new email system * IT Blueprint design and Core Banking System Design * 2018 IT Budget * Planning, architecting and implementing enterprise-class IT solutions and services to ensure the underlying IT architecture delivers the capabilities that address current and future business needs and achieve the Company’s business goals. * External vendor system design, for example SWIFT, Faster Payment System, etc.

•Vendor Management on security system and IT system •Implementing ITIL process with US Team and provide user training •IT Asset Management •Implementing the new IT infrastructure on a new manufacturing site at China and finished it in 3 years which 2 years earlier than original plan with US IT team and vendor, including networking, AVAYA phone/conference, server, security system, and VDI infrastructure •Setup a new server room with monitoring system •Planning and pushing the project of installing FM200 at server room in order to improve the standard within the organization and reduce the risk of service down •Travel to Shanghai for reviewing and providing suggestion on the IT operation and security standard at the office and factory •Working on setting up and improve the Intellectual Property Protection policy, IT security standard and policy development with US IT Security team and provide user training •Working with Custom, CIQ, US IT team, and procurement team in order to import the equipment from USA and resolve some issues related law and regulation requirement, for example The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Good and Technologies, Import and Export Ordinance, Chapter 60 of the Laws of Hong Kong •Cooperation any IT related issue and project with different teams from India, Shanghai, Philippians, and USA • Migrate and decommission the IT infrastructure of the downtown office to the factory office • Develop SOP according to the IT procedure and IT security policy and provide user training

- Data Center Operation Manager •Managing the team on data center operation and meet the Service Level Agreement(SLA) •Scripting •HKICL FTS Operation Management - Platform Support Analyst •IT Asset Management - ITAM implementation •HKMA ICLNET secure email implementation with ICLNET and PCCW •Implment an IT Audit Tools to montior the critical IT resource •Wintel Server Administration which providing 2nd , 3rd level support and handling incident •NetBackup 7.1 Administration which providing 2nd , 3rd level support and handling incident •AIX and Database Administration (MS SQL & Oracle) which providing 1st level support and handling incident on request base •Working as a Project Manager Role in Country Operation Enhancement Project and provide consulting service for other project from ITCS Group •Infrastructure Management, providing infrastructure solution for different project on networking and system setup, for example HP ArcSight •Working on behalf of Platform Team Manager if he is on leave •Working with internal IT audit team in order to meet the security standard on the infrastructure and operation process •Providing consulting service to other ITCS project on request base •Perform disaster recovery with the BCP / DR manager in ANZ HK and develop the DR & BCP plans •EMC/Net app storage refresh (1.3 million AU)

•Providing the IT Network Administration and Wintel Sever Management for CEI-HK Asia Pacific Offices, including SZ & SH & TW office (Active Directory, AV-System, Lotus Notes, FTP, Backup Exec, System Security- Kerio) •End-user support (MAC and Windows) and training and IT system monitoring/troubleshooting •Procurement of IT Network Equipment & Services, including preparing budget of IT Dept. •Working in a team of international IT specialists within a dynamic business environment •Recommending & Implementing IT system in order to improve the business process •Managing and updating the Avira Professional Security and the MDaemon email server (Implemented Greylisting which reduce the spam rate more than 50%) •Scripting •Relocation Shenzhen office and IT infrastructure design, implment, testing for the new office •Relocation the data center to other vendor

•Handling Small and Medium Enterprises (SME) Loan. •Preparing ATM card and pin for the clients.

•Working at Asia Pacific firewall team which managing and configuring the firewall rules of Asia Pacific Network in order to maintain the high level of information security •Leading and training a new team from Guangzhou to perform the firewall configuration and the routing of the Asia Pacific Network •Assisting on system migration and relocation of the data center •Monitoring network traffic and reports any abnormal behavior to the management