Lochie Chok Email & Phone Number

Aligned to internal divisions responsible for end-user devices, collaboration platforms, HR and retail banking. In this role I performed multiple solution assessments and risk opinions weekly, outputting detailed reports on architecture, security controls, vulnerabilities and threats. I coordinated tracking all identified findings end-to-end until remediation.

Primary engagements I contributed to include:‣ CPS-234 TPV Alignment @ Investment Bank - Created processes and questionnaires to perform third party vendor assessments. This included enterprise-wide stakeholder education and upskilling a local and offshore team to perform this ongoing. Achieved CPS-234 compliance within 12 months.‣ BS11 Segregation @ Big 4 Bank - Identified and the planned segregation of all shared infrastructure across Australia and NZ for BS11 compliance. This infrastructure included: IAM, PAM, email, collaboration apps and security monitoring.

Primary engagements I contributed to include: ‣ Third party supplier assessments @ Westpac – Performed on-site audits of Westpac suppliers across Australia and India. This required wholistic knowledge in order to understand the provided solution and identify potential compliance gaps as well as confidence to work independently while on-site. ‣ IT audit risk reviews @ AUB Group – Assisted in creating a questionnaire and process to review AUB partners and later personally performed a number of reviews. This role involved eliciting requirements from AUB, writing reports with recommendations based on security threats and later communicating these to stakeholders in wrap-up meetings.‣ Australian Privacy Principles review @ McDonald’s Australia – Worked with a team to develop and execute a high-level review to obtain the current alignment status of all McDonald’s systems against the thirteen APPs. This engagement involved gathering information through meetings with system stakeholders and external vendors to form a report with the status of over fifty systems. ‣ PCI DSS pre-Audit @ McDonald’s Australia – Prepared McDonald’s for an upcoming PCI DSS audit by evaluating all requirements for potential compliance gaps and producing documentation or initiating changes to close them. In this role I utilised project management skills in order to allocate tasks to the relevant parties and ensure the strict timeline of the engagement was adhered to. ‣ Solution implementation @ McDonald’s Australia – Pre-sales and implementation work for CyberArk, Exabeam and Varonis spanning a year in entirety. These projects encompass monitoring and alerting of the corporate environment and securing and recording of privileged access and restaurant support.

The work I was involved with included:‣ End-user computing evaluation – Assisted in assessing, benchmarking and comparing proposals from various vendors for new employee laptops, desktops and VDI infrastructure.‣ ServiceNow demand management – Gathered requirements from projects seeking to integrate with ServiceNow to create stories and work with developers throughout the process.

Worked full time on-site completing a number of tasks, including:‣ Day-to-day network maintenance tasks - Business hours network monitoring and management of roughly one thousand stores and numerous corporate environments. Troubleshooting any problems that arise often through direct contact with restaurant employees.‣ NBN and firewall restaurant installation – Prepared up to five restaurants per day to cutover to NBN connection through liaising with Telstra onsite technicians. These installs included a fundamental change of existing restaurant network layout and the installation of new firewalls and wireless access points.‣ Meraki authentication onboarding - Personally owned the development and implementation of a suite of Python scripts to automate the provisioning of Meraki RADIUS accounts through collection of restaurant employee details from a database. The purpose of this was to enable the business to shift from using PSK for staff Wi-Fi authentication to individual accounts for greater access control.