Merged the security teams of the two largest tech companies in Indonesia : Gojek and Tokopedia.GoTo's security team protects 2% of Indonesia's GDP and 20m monthly active users.CISO for Gojek, Tokopedia and GoTo Financial.

APAC Head of CybersecurityGlobal Head of Attack Surface Management:* Vulnerability Management* Secure Configuration Management* Red TeamMAS/Association of Banks in Singapore - Standing Committee on Cyber Security

Built a global security practice for an e-commerce unicorn, in preparation for IPO: governance, architecture, operations. GFG: 34m orders/year, 13m active customers, €1.3bn revenue, 24 countries on 4 continents, 20 offices, 10 warehouses, 9000 employees.Security team: 21 FTE, with 6 direct reports.Launched and managed 6 private HackerOne bug-bounty programs.PCI/DSS compliance, GDPR compliance.Lead the security track during yearly global tech summits for regional CTOs & CPOs.GFG is the #1 fashion e-commerce in growth markets: ​Zalora​ (Southeast Asia), ​The Iconic​ (Australia, NZ), Dafiti​ (Latin America), ​Namshi​ (Middle East) and ​Lamoda​ (Russia, CIS).

Viadeo is a competitor to Linkedin, focusing on France (8m active users) with teams in Paris, San Francisco and New Delhi. I have built the security practice from scratch. We grew from grep-ing apache logs to operating a homemade SIEM using open-source tools.- My mandate was to build products and systems that keep Viadeo and its users safe.- Hired and managed the security team- Created a network of security champions within the product teams.- Launched and managed the private HackerOne bug-bounty program.- Created countermeasures against spam, fake users, crawlers and attackers.- When Viadeo moved to the cloud, I volunteered to lead DevOps efforts to migrate 500 serversand dozens of services & applications to AWS.- Answered to French data privacy regulatory agency CNIL.Tech: AWS, hackerone, nessus, mysql, elasticsearch, kibana, hadoop, python, java, nodejs, neo4j.

Implemented the Group Information Security Policy in France.Advising role to the General Manager regarding IT risks.IT Risk Analysis and Incident Response: animated risk committee, crisis committee.Point of contact for internal/external auditors and regulatory authorities: Commission Bancaire/Autorité de Contrôle Prudentiel.Logical Access Management: redesigned authorization process and controls, based on RBAC.Business Continuity Plan: built from scratch (Business impact analysis, RTO/RPO studies, continuity procedures, chose IBM BCRS as an infrastructure partner) and tested yearly with great results.Controlled IT DRP yearly.Themes: IT risks, infrastructure and data security, business continuity.

Joined when the Private Banking bank spun-off its Investor Services and bought FMS Hoche from Banque de Neuflize, and needed to build the new branch IT.Leadership of the technical team during the buyout of FMS Hoche: isolation from Banque de Neuflize IT then integration in RBC/Dexia IT.Designed then maintained mission-critical file gateway based on Axway CFT and IBM Datastage.Design and technical implementation of Disaster Recovery Plan.Lead monitoring team – 30 servers, 330 services.VoIP telephony migration – 250 phones.Buyer for IT services, hardware & software – 2006: 150k€ ; 2007: 240k€Tech: Datastage, Oracle, Axway CFT, Linux/AIX/OSX/Windows, nagios