Leading the Cybersecurity Defense strategy and operations, oversee the Threat Management and Identity & Access Management departments, focusing on protecting Lean digital landscape.

Plan, oversee, monitor and manage overall cybersecurity operations and respond to cyber security incident/threat in IT/OT environments in order to ensure the safety and security of SANS.

Leading the cybersecurity operations (SOC) and responsible for developing plans, procedures, guidelines, and playbooks to enable the technical team is equipped to identify, assess, quantify, report, communicate, escalate, monitor, and mitigate security events and incidents. I also develop dashboards and reports to identify potential threats, suspicious/anomalous activity, and malware. I assist in the design, evaluation, and implementation of new security technologies and work collaboratively within the cybersecurity team to perform event/incident analysis, prepare root cause analysis reports, and communicate with key stakeholders. I also provide expert analytic investigative support for large scale and complex security incidents, review queries and alerts to detect adversary actions, and support compliance with policies and procedures. I am committed to continuous improvement and actively participate in on-the-job training, mentoring, and coaching of subordinates. I also play a key role in developing the Cybersecurity Business Continuity Plan.

Responsible for managing the lifecycle of cybersecurity incident resolution, from activating the CSIRT team, containing the incident, mitigating the impact, and fully restoring equipment to conducting post-incident analysis. I lead coordination with asset owners, perform preliminary impact analysis, and triage incidents, and act as a subject matter expert to provide insight and guidance to my colleagues on prevention measures. I am proactive in coordinating with appropriate departments during security incident management, including legal, security, operations, and others. I maintain incident response documentation and reports and participate in table-top and drill exercises to improve our response effectiveness during actual incidents. I am committed to continuous improvement and contribute to the identification of opportunities to improve systems and processes.

Threat Management

Threat Management