Kom O.

Cybersecurity operations leader with 15+ years progressive experience in IT/Security GRC, Information Risk Management across financial services, FinTech, Telecommunications, Insurance sectors. Proven ability to conduct comprehensive technology risk assessments, identify control gaps, define and implement BAU security controls, and track remediation across cloud and on-prem infrastructure. Experienced integrating security requirements into DevOps pipelines and software development lifecycles, and collaborating with business, engineering, and architecture teams to embed security-by-design.

Deep expertise in Microsoft security tools (Sentinel, Defender, Entra ID), SIEM/SOAR/EDR platforms, and IAM/PAM governance, vulnerability management, and vendor risk management, adept at translating technical risk into business-aligned controls and communicating findings across a organizational levels.

Experience History

Security Operations & Identity Manager | Gore Insurance – Canada | 06/2025 to Current

• Serve as the primary escalation point for high-severity security incidents in a hybrid environment, leading end-to-end investigation, containment, and response across Entra ID, Microsoft Defender.
• Implement RBAC, and BeyondTrust PAM solutions, automate access management lifecycle, ensuring purposeful stakeholder engagement and vendor management.
• Drive detection engineering and alert tuning to improve fidelity, reduce false positives, ensuring detection coverage aligns with MITRE ATT&CK framework and emerging threat landscape.
• Lead organization-wide awareness sessions, phishing simulations, tabletop exercises, workshops aimed at increasing employee overall security readiness and threat detection proficiency
• Design metrics to lead and mentor SOC analysts, establish structured escalation paths, investigation workflows, and playbooks to ensure consistent, high-quality incident response outcomes across the team.
• Govern security logging and telemetry standards, assessing log onboarding sufficiency across endpoints, identity, and cloud workloads to support effective detection, investigation, and post-incident analysis.
• Lead post-incident reviews, translating lessons learned into actionable improvements to detection rules, response playbooks, and SOC operational processes to continuously strengthen security posture.

Information Security Manager | EXPEDIER INC. – Canada | 04/2023 to 06/2025

• Delivered ISO and PCI DSS certification support, advising interna and external stakeholders on control implementation and compliance evidence.
• Enhanced access provisioning, developing reference documentation to support secure practices.
• Built and refined cyber security monitoring and threat detection roadmap for digital financial transactions and financial entities, developing scalable security architecture solutions.
• Led security training initiatives, resulting in measurable improvements in user awareness and reduction of phishing susceptibility.

Manager, Information Security | MTN (MoMo Digital Bank) | 02/2022 to 09/2024

• Directed a comprehensive refresh of cybersecurity tools and protocols across muti-site operations, achieving 58% reduction in security incidents through advanced threat detection, root cause analysis, and staff training programs.
• Improved EDR/AV endpoint onboarding to reach 100% month-over-month (MoM) SOC coverage, strengthening detection telemetry and monitoring completeness.
• Achieved a 68% reduction in security breaches over 18 months across 15+ international locations by deploying encryption, endpoint security, and continuous monitoring strategies.
• Drove a 25% improvement in SaaS development security by partnering with DevOps teams to perform SAST, DAST, VAPT assessments within Agile pipelines.
• Established and enforced security operations playbooks, SOPs, and policies; oversaw threat and vulnerability management, penetration testing, patch management, and cloud security.
• Selected and implemented security technologies aligned to SABSA, NIST, OWASP, CIS, PCI DSS, and ISO 27001/22301/20000 frameworks.
• Prepared and delivered IT security threat, vulnerability, and risk briefings to the steering committee and Board of Directors.

Information Security GRC | FSDH MERCHANT BANK | 04/2021 to 01/2022

• Conducted periodic reviews of system security and firewall logs and performed access audits as part of governance and incident response routines.
• Automated daily business reviews using data warehousing technologies, improving turnaround time for business units by 25%
• Configured workflows for auto provisioning and scripted detection and removal of stale, orphaned and duplicate accounts.
• Designed KPIs and SLA/SLO metrics for IT and Security vendors, enforcing accountability through contractual performance standards.
• Conducted user acceptance tests/assessments with stakeholders to ensure that SaaS applications deliver business specifications, providing risk/impact-based observation.
• Enhanced system functionality for increased efficiency through detailed analysis of user needs and software capabilities.
• Facilitated seamless technology integration, minimizing operational disruption while strengthening the security control environment.

Information Security Engineer | FIDELITY BANK PLC | 07/2015 to 12/2020

• Led the Privileged Access Management (PAM) project (Thycotic), improving Admin user access control across all Bank endpoints.
• Directed integration of advanced threat detection systems across 300+ branches and 8,000+ users, reducing system exposures by 33%.
• Managed full user lifecycle for Entrust MFA, including application integrations and enforcement of non-repudiation requirements.
• Led vulnerability management, achieving 100% MoM compliance with patching KPIs across servers and endpoints, substantially reducing cyber risk exposure.
• Conducted on-site assessments of user access logs for privilege creep and escalation, remediated findings with cross-functional teams.
• Performed technical security assessments of applications and infrastructure, identifying vulnerabilities and recommending mitigation strategies to senior management.

Bachelor of Engineering Technology: Computer Engineering

Master of Information Technology: Information Technology Engineering

PECB ISO 31000 Senior Lead Risk Manager – 2023

(ISACA-CISM) Certified Information Security Manager – 2026

(PSM I) Professional Scrum Master – 2024