Lap Ki Lui Email & Phone Number

Toronto, Ontario, Canada

Manages team of 3 people (full time & contractor) to provide the following services utilizing Archer GRC Solution1) Project Risk Oversight (budget > $1 Million, 50+ projects per year)• Provide advice and guidance to project team to manage and mitigate operational and informational Risks• Regular meeting to review Risk Register and Information Risk Assessment2) Issues and Remediation Closure Review (120+ Issues per year)• Review closed Issues to ensure the non-compliance/gaps are completely remediated with appropriated evidence• Follow up with Business and IT with closed Issues that the remediation may not be effective or incomplete3) Vendor Risk Oversight (Contract cost > $3 Millions)• Provide advice, guidance, and concurrence on contract negotiation from Information Security perspective to ensure the Third Party has robust IT/Security control and governance for data resilience/protection/recovery, cyberattack prevention, and regulatory compliance (Financial and Privacy)4) Exception Request Review• Review Exception Request (Technical or Third Party Contract related) with relevant documents and corresponding compensation controls for preparation for CRO/CIRO approval5) Acted as Subject Matter Expert for Information Security and Third Party Standards Revision

Toronto, Canada Area

1) Performs Second Line of Defense information risk assurance and oversight activities on Enterprise IT Governance and Compliance processes.2) Performs vendor information risk review on significant contracts (up to $3.5 billion) to ensure vendors have comprehensive Information Risk Management control design and operational effectiveness (SOC 1/2 Type 1/2 reports, ISO 27001/27017/27018 certifications, PCI-DSS), effective information security program, satisfactory vulnerability management, regularly tested BCP/DR plan, and contractual obligation to protect company and customer data (PII, PHI, financial data).3) Oversees significant projects (over $3 million with global deployment) that involve highly confidential data and performs technology information risk assessment review to ensure information risk exposure is within company risk tolerance and appropriate risk mitigation actions are being implemented.4) Performs sampling assurance reviews on ITGC (First Line) vendor risk assessments to identify gaps and execution deficiencies and provide recommendations to continuously improve procurement and vendor governance program.5) Assists on root cause analysis review on severity 1/2 incidents to identify the underlying root causes and other contributing factors with recommendation of improvement on ITGC processes. (e.g., change management, incident management, capacity monitoring, etc.)6) Assists on issue and exception review to identify gaps and deficiencies with recommendation of corrective actions.7) Global Information Risk Management Policies and Standards Reviewer (e.g., Vulnerability management, IAM, Application security, Third Party Information Risk Management, IRM Methodology, etc.).

Waterloo/Toronto

1) • Performed Information Risk Assessment and Management on critical IT projects (over $2 million) on global scale (US, Canada, Asia).e.g., SIEM (ArcSight), Windows 10 Migration, HashiCorp Vault/Terraform, Chef, IBM Security Key Lifecycle Manager, Bitlocker (MBAM), FileVault (JAMF Pro).2) • Performed Vendor Risk Assessment (SaaS, PaaS, IaaS) by reviewing Contract, SOW, SOC 1/2 Type 1/2 reports, ISO 27001/27017/27018 certifications, PCI-DSS, BCP/DR Plan, Vulnerability Management and Penetration Test reports, Information Security and Risk Policy, etc.3) Provided security and risk advice and guidance to Enterprise IT projects and operation (Cloud and on-premises).4) Technical Hardening Standard Reviewer (e.g., Windows 10, iOS, Chef, Bitlocker, SUDO, SSH, etc.).

Toronto, Canada Area

1) Security Compliance focal (HIPAA/ISO 27001) on 4 public (Toronto, Sydney, Dallas/San Jose, Amsterdam) and 2 private clouds (bank/insurance) consist of 1000+ Linux servers (CentOS/RHEL/Ubuntu) hosted by Bluemix (former SoftLayer) and monitored 7/24 by New Relic and Pingdom.2) Key contributor to 1 public (Sydney) and 2 private (bank/insurance) clouds deployment (270+ systems) which included network design, LDAP, DataPower, QRadar, Nessus scanner, Vyatta and IEM Relay severs provisioning and configuration using Chef and Jenkins.3) Performed OS and application provisioning, upgrade and configuration (DB2, BigInsight, MongoDB, Nameserver, LDAP, DataPower, Catalyst Servers, Analytics Servers, etc) using Chef and Jenkins.4) Responsible for QRadar client configuration and incident investigation and remediation, IBM Endpoint Manager/Bigfix (IEM) agent install and configuration, network vulnerability monitoring and remediation, patch management, etc.5) Established and documented new security compliance processes (QRadar, IEM, network vulnerability, etc.).

Toronto, Canada Area

1) • Architected, implemented, and oversaw Security/IT infrastructure on 2500+ UNIX (AIX, Linux, Solaris, HP-UX) and 1000+ Windows systems which included access control, userid management, patch management, network vulnerability remediation, network isolation (non-compliant systems), VLAN configuration, Symantec Endpoint Protection, Windows Server Update Services, etc..2) Remediated network vulnerability such as TLS 1.2, Heartbleed (OpenSSL), Poodle (SSL), Shellshock (Bash Bug), within a tight schedule (~4 weeks) on 2500+ UNIX systems3) Performed business impact analysis on vendor security advisory and provided remediation or mitigation plan.4) Utilized Perl scripts and Windows Domains and OUs to automate administration, compliance and monitoring processes by which significantly improved security compliance posture and considerably reduced administrative cost.5) Standardized and documented all roles and responsibilities, procedures, guidelines and processes of the aforementioned infrastructure for departmental use and IT Audit review.6) Oversaw and provided guidance, advice and assistance to newly acquired companies on IT infrastructure migration and security compliance7) Guest auditor in Corporate IT Audit and Threat and Risk Analysis as auditor in IBM USA and Brazil offices.8) Coordinated corporate audit activities such as Threat and Risk Analysis, Corporate Audit, Business Control Review, Compliance test, etc. for IT and DB2 development community.

Toronto, Canada Area

1) Team leader of 6 people who provided OS and HW support to 1400+ systems (AIX, Linux, Windows, HP-UX and Solaris) on different hardware platforms (Micro Channel, PCI, Intel, Xeon, EMT, PowerPC, Itanium, AMD, z/OS390, PA-RISC, SPARC, etc.).2) Redesigned and renovated power and network infrastructure of a data center (700+ systems, 450kW, 6 Class C Vlans) which significantly reduced operating cost and doubled the server center capacity (standardized to L6-30 receptacles, added 1000+ network ports, eliminated power overloaded issue).3) Extended Linux, Windows and HP-UX support to Itanium, AMD and PowerPC platforms.

Master Of Science (Msc), Mathematics

Bachelor Of Science (Bsc), Mathematics