K. L.

Some project highlights on helping enterprises to protect their Information against insiders / external threats and fulfill compliance mandates: Vulnerability and threat management – - Defense in depths APT prevention solution cover email/web gateway, NGFW, sandbox, least privilege enforcement, identity & authentication to endpoint (HIPS/UEBA). - Cloud security big data platform architecture design, management and threat modeling. - Web application and int/ext. network security assessment and penetration testing. - Design security incident management framework and Investigate security incidents (attacks) by forensic analysis to detect & remediate security breaches by target attack (APT). IS Compliance & Audit engagement – - Design and execute a new comprehensive risk assessments and audit program for a China IT giant with 50,000+ staffs to discover any weaknesses in cyber threat protection. - Global compliance audit on privacy laws and standards for IT services provided in sensitive countries. - Perform data analysis for a large HK mutual fund management institute to discover any discrepancies in the fund contribution to avoid regulatory penalties - Assuring accuracy of accounting system generated financial reports by auditing transaction processing automated controls - Help organization comply with PCI and ISO 27001 etc by reviewing existing controls and provide solution to control gaps Data loss prevention, integrity and governance – - Data Loss Prevention implementation: solution design and business consultation: business workflow review, user interviews, workshops, risk assessment, data classification, incident response and remediation for banks, manufacturer and entertainment etc. Identity, privilege and authentication management – - Government Departmental Portal deployment with identity Access Manager and enable SSO for multiple web applications - E-banking website identity fraud prevention and privacy data protection by 2-factors authentication.

At both top cyber threat and risk management firms Symantec [2013-2015] and global risk consultation firm PwC [2011-2012] and China technology giant (2015 - ), I've guided major financial institutes and enterprises to cope with their information security risks by conducting full cycle of enterprise risk management including: risk identification, assessment, control development, mitigation with latest IT security defends and monitoring of on-going security incidents while manage their IT compliance and regulation needs. Roles - Security advisory, IT audit, IT security solution architecture, raising client IS awareness, project coordination (Hong Kong, China & Macau) Serviced industries: Financial institutes (banks, information providers, exchanges), China state-owned (国企) and global enterprises.

My main duty is to act as the key point of contact for the customer enterprise security team. I help my assigned customer accounts to achieve their security control initiatives from requirement gathering, solution design, solution presentation and demo, POC, UAT, managing deployment to documentation and troubleshooting etc. I’d perform security assurance when rolling out new systems. I also draft security policies (networks, user account, access control, computer usage etc), perform security assessment, network architecture review, BCP and change management review etc.

After graduated from Canada, in order to build up my foundational IT skills and business know-how, I’ve taken various short term engagements including freelance in broad IT domains such as application & database development, infrastructure, systems, IT services and security management in various industries (Banking/Telecommunication/Government/Logistics/Electronics). - Enterprise risk management on strategy, policies and procedures, IT governance, and compliance (ISO 27001). - Develop and deploy wide range of infrastructure, security systems and application projects for finance, electronics, government, logistic, trading and telecommunication on business processes: transaction & procurement processing, invoicing and supply chain etc.