Sophy H.F. C. Email & Phone Number

Taiwan

Taipei City, Taiwan

Taipei City, Taiwan

(Formerly Cigna employee from Feb 2022 to Dec 2022 before the acquisition by Chubb in the APAC)Monitor and review the implementation of information security and data protection policies and standards to ensure compliance with Group requirements and local regulations.Collaborate with stakeholders to gain a clear understanding of their businesses to initiate the associated information security risk-based discussions and provide guidance on information security and data protection, while at the same time supporting the execution of Group information security or data protection initiatives within business units.Responsible for managing third-party cyber risk by coaching businesses and vendors through completing the third-party cyber risk assessment. Identify, track and manage issues and control deficiencies relating to third parties, including liaising with business relationship owners to support remediation activities.Liaise between IT, internal and external auditors to facilitate the IT audit process.

Taipei City, Taiwan

Designed audit plans and undertook audit engagements with specialisms in technology, BCM, outsourcing, AML and transaction banking.Oversaw the risk and control over institutional banking regarding end-to-end process, potential risks and mitigating controls associated with the aforementioned areas. Ensured that key risks are properly identified with adequate controls in place.Advised and apprised timely to Group Internal Audit of system and major enhancement with significant risk impact, controls and regulatory issues raised, if any, during the audit.Planed, executed and completed audits according to regulatory requirements or Group policies. Supported Head of Internal Audit to ensure audit assignments are timely executed with quality.Validated and followed up audit issues with stakeholders to ensure action plans are executed and risks are properly mitigated. Maintained and developed key relationships with top management and stakeholders through raising potential risks and control issues for continuous monitoring and improvement.

Taipei City, Taiwan

Performed ASRA (Application Security Risk Assessment), ESPQ (External Service Provider Questionnaire) and vendor assessment within information security and privacy domains.Reinforced IT internal control through reviewing, revising, and restructuring security related processes, procedures, and policies in accordance with Group risk control framework, regulatory requirements, and ISMS standard.Managed the Privacy Management Programme by advising business units on the review and update of PII inventories, PII data flows, privacy risk assessment, awareness training, and tracking the remediation progress of audit issues. Ensured the alignment of PIMS standard with Group privacy requirements.Developed and arranged information security and privacy awareness training in cooperation with HR and external consultants.Collaborated with PFI ISO and PII BISO to fulfill Corporate information security requirements and expectations. Analysed vulnerability updates from PFI ISO and proposed solution for risk mitigation. Supported BISO to meet the delivery schedules of major IT engagements below - New product go-live for Banks and LP channel - Claim imaging - Quick hit enhancement for UW / Claim case assignment - RAP (Robot Automation Process)

Taipei City, Taiwan

In charge of the Cybersecurity Programme 2020 initiated by Group. Identified risks or deficiencies within IT controls, processes, procedures, and policies against NIST Cybersecurity Framework; developed risk mitigation plans with multiple IT functions, business units, and CIB APAC; implemented the solutions in accordance with the plans and schedules.Managed the ISMS project to ensure the validity of ISO 27001 certification.

Taipei City, Taiwan

Worked as part of APAC Cigna Information Protection team to align corporate information security policy, procedures and processes with local regulatory requirements.Implemented, maintained and reviewed the IT controls, procedures and policy in response to regulatory updates or the regional/head office's requirements.Responsible for ISMS (ISO 27001) and PCI DSS projects to ensure information risks are effectively mitigated. Conducted security assessment for the vendor selection process. Periodically reviewed the vendors’ IT controls against the regulations and contract clauses prior to contracts renewed.Performed control self-assessment for the enhancement of IT controls or procedures.Liaised between the IT department with internal and external auditors to facilitate the IT auditing process.Coordinated access reviews activity to ensure access provision is strictly based on RBAC approach.

Taipei City, Taiwan

Responsible for ISMS (ISO 27001) project to ensure information risks are mitigated. Performed control self-assessment for the enhancement of IT controls or procedures.Analysed DLP report and identified suspicious behaviors to prevent data leakage. Reviewed and tracked the progress of risk mitigation plans for vulnerability scan and penetration test reports. Coordinated access reviews activity to ensure access provision is strictly based on RBAC approach.

Taipei, Taiwan

Advised banks on IT operations outsourcing to obtain the approval of outsourcing arrangements from the monetary authorities, such as Monetary Authority of Singapore and Hong Kong Monetary Authority.Performed independent audits / assessments of outsourcing activities and IT operations for offshore banking unit (OBU) to ensure the regulatory compliance of both the home and host countries.Coordinated the implementation and maintenance of Information Security Management Systems (ISO 27001), Personal Information Management System (BS10012), and IT Service Management (ISO 20000) for financial services, manufacturing, and multi-level marketing companies.

Msc Information Science

Bsc (Hons) Information Technology Management For Business