Sub S

Senior cybersecurity professional with 20+ years of banking and consulting experience, seeking roles in Cybersecurity, Tech Risk Management, and regulatory compliance where deep hands-on technical expertise in cyber security, IT/AI risk, and MAS regulatory compliance can drive organizational cyber security resilience and governance maturity. Most recently served as Head of Technology & Cyber Security Risk Management across 3 MAS-regulated entities — including a Critical Information Infrastructure (CII) — leading second-line risk through multiple MAS Technology Audits. Cross-functional risk background spanning all lines of defense (1st, 1.5th, 2nd and 3rd line), with deep technical hands-on expertise in Cyber Security, IT Risk, IT Audit, Governance, and Information Security.

Proven track record in risk-based audits covering banking infrastructure, business applications, branch operations, vendor relationships, SDLC, and third-party risk — across Investment Banking, Capital Markets, Private Banking, and Asset Management. Familiar with AI governance frameworks including ISO 42001 and actively developing expertise in AI risk management — covering model risk, algorithmic accountability, and evolving MAS/regulatory expectations around AI adoption in financial services.

Experience in industry/regulatory standards: MAS TRM, Cyber Hygiene (FSM-N06), FSM-N13/14, ISO 27001, ISO 42001, ITIL, COBIT and SOX.

Former

Big 4 consultant with Fortune 100 exposure across IT Audit, ERM, VAPT, network and infrastructure security, BCP/DR, and access control. Consistent record of delivering quality engagements on time and translating complex risk findings into actionable business recommendations.

Head of Cyber Security/Tech Risk Management — 3 Entities, including a Critical Information Infrastructure (CII) at NETS SINGAPORE (2022-09 – 2024-12)

Led the Cyber/Tech Risk function across all three NETS entities — a highly MAS-regulated environment — with accountability spanning Cyber/Tech risk identification, governance, regulatory engagement, and crisis response.

• Appointed Head of Cyber Security/Technology Risk for three entities simultaneously, including a CII, reflecting seniority and complexity of mandate.
• Handpicked by senior leadership to step in as Head IT Governance for the CII entity on an interim basis — reporting directly to the Group CEO, in recognition of consistent high performance and leadership capability.
• Chaired the monthly Cyber Security/Technology Risk Committee (ITRC) across all three entities, bringing together all Technology & Security Heads for risk accountability, with the technical depth to comprehend and challenge teams on hands-on technical matters.
• Represented Technology Risk at RMC (CEO & Board members), Management EXCO, Enterprise Risk Committee (all N-1 Heads), and ITRC — ensuring visibility at every leadership tier.
• Successfully led and represented Cyber Security/Technology Risk through three MAS Technology Audits, serving as primary coordinator across all MAS IT audit engagements.
• Managed end-to-end closure of MAS RFCs and policy compliance reviews (TRM, FSM-N13/14), liaising with IT and Compliance on MAS audit findings.
• Served as the key Technology Regulatory Compliance resource for the Compliance team, bridging technology risk and regulatory obligations.
• Represented NETS at ABS monthly industry forums on Technology Risk matters.
• Oversaw the full Cyber Security/Technology Risk lifecycle — RCSA reviews, exception and RFI management, KRI establishment, and management risk reporting.
• Served as a member of the Crisis Management Team, coordinating response during significant technology incidents.
• Maintained strong stakeholder relationships across Cyber Security/Technology, Risk & Compliance, Senior Management, and MAS.

Vice President – Cyber Security at BNP PARIBAS (2018-03 – 2021-12)

Spearheaded security policy, control design and reviews, combining strategic advisory with hands-on technical support for SOC, CSIRT, and Security Engineering teams.

• Coordinated internal, external, and regulatory audit engagements for the BNP Security Team, supporting 18+ audits annually across North and South America.
• Drove timely closure of audit findings, managing 12+ audit points annually, each typically run as a standalone remediation project.
• Supported the team's wider GRC function, ensuring GRC-related projects, tasks, and controls were delivered on schedule.

Assistant Vice President (AVP) – Cyber Security at BNP PARIBAS (2012-11 – 2018-02)

Delivered Cyber Security engagements across multiple business units.

• Served as Competency Lead for Cyber Security Risk Assessment and APAC Policy Champion, reporting directly to the Head of Cyber Security Management, APAC.
• Acted as Single Point of Contact (SPOC) and Business Account Manager (BAM) for the Global Markets & IT Infrastructure business unit, owning all security matters for both divisions.
• Performed risk assessments across banking business applications (including global deployments), third-party business applications, SDLC projects, internet/broadband/third-party network connectivity to the exchange and branch offices, BAU changes (e.g., NAS storage, VPN client solutions), and policy exceptions.
• Led on-site external audits of third-party vendors end-to-end — planning, fieldwork, findings, reporting, and closure/sign-off — while designing and refining audit methodology and reporting templates.
• Provided assurance to business units and management by auditing business processes, technical infrastructure, applications, and SDLC projects, confirming risks were mitigated to an acceptable level through effective, efficient, and reliable controls; reviewed audit reports across engagements to ensure consistent quality and timely delivery.
• Served as APAC Policy Champion: formulated the APAC Risk Management Framework, conducted annual and peer policy reviews, created and updated policies, aligned APAC standards with global policy teams, and administered the APAC policy repository.
• Provided regulatory and audit support to the business; maintained the risk register and developed risk assessment tools covering banking applications, infrastructure, SDLC, third-party connectivity, and external site audits.
• Performed change management reviews and approvals for firewall rule-base changes, including annual firewall rule-base reviews.
• Led team building, knowledge transfer, and capability development for the India centre.
• Represented APAC IT Risk on global calls for initiatives spanning risk management, security projects, Global CERT, SOC, and architecture committees.

Assistant Vice President (AVP) – IT Audit Manager at OCBC BANK (2011-08 – 2012-11)

Served as IT Audit Manager at OCBC, leading and participating in infrastructure and application audits.

• Led or supported audits of a major American bank's outsourced services, information security, and network infrastructure.
• Conducted audits of internet banking applications (consumer and corporate banking), computer operations and support, data centre operations, change and problem management, and technology infrastructure and services.

Senior Consultant – IT Audit & Compliance, Capital Markets at DEUTSCHE BANK (2009-03 – 2011-08)

Engaged as a consultant through HCL Technologies, Singapore, serving as an IT Audit & Compliance professional within Deutsche Bank's Capital Markets division, performing internal IT audits and compliance activities.

• Performed pre-audit Risk & Control Self-Assessments (RCSAs) across production access, security monitoring, release and deployment, data security, penetration testing, change/incident/availability management, disaster recovery, KOP process compliance, and audit/regulatory compliance.
• Provided audit coordination and support for regulatory MAS audits; liaised with IT management to follow up on and close audit points, and represented the team in external audits of individual applications.
• Delivered monthly management reporting on risk and control metrics; maintained documented risk profiles in the global risk register and briefed technology partners on technology risk matters.

Bachelors of Commerce