Payments · 2009 – 2016
Security Governance and Resilience Across an APAC Payments Region
Seven years as regional security officer for a global payments company, owning security strategy, governance, incident response and disaster recovery across India, China, the Middle East and Southeast Asia.
The Challenge
Payment infrastructure is one of the most attacked and most regulated environments there is. As segment security officer for the APAC region of a global payments company, I was responsible for security across India, China, the Middle East and Southeast Asia, including Pakistan and Indonesia. Each country brought its own regulators, its own IT teams and its own risks, and all of them had to meet the same global standards.
What I Did
- One governance model for many countries: defined and ran the information security strategy and governance model across the region, aligned to global security standards.
- Architecture standards: set security architecture standards for critical systems and payment infrastructure, and defined security architecture, design, operational planning, policies and risk remediation for the region’s IT infrastructure.
- Detection and response: led incident response planning, vulnerability management and malware reverse engineering with SOC teams, and coordinated third-party vulnerability testing.
- Risk and resilience: ran periodic risk assessments and business impact analyses for critical applications, documented recovery priorities, and built disaster recovery and continuity of operations (COOP) strategies, testing DR readiness across countries.
- Regulation and audit: supported certification, accreditation and audits against PCI-DSS, SOX, RBI, MAS-TRM and ITIL.
- Alignment and reporting: worked with regional IT teams, global security leadership and third-party vendors to align local implementations with global standards, and presented risk summaries and security roadmaps to senior management and global stakeholders.
Why It Matters
Running security for a multi-country payments region for seven years is the same job a CISO does: setting strategy, keeping regulators and auditors satisfied in several jurisdictions at once, staying ready for incidents and outages, and reporting risk in terms senior leaders can act on.