Twenty-five years of asking who can reach what

In 2006, during an IT audit at an insurer's Singapore office, I asked for a list of the people who could approve a claim payment above the branch limit. The business believed there were five. The system returned sixty-three, most of them added during a busy quarter years earlier and never removed. As far as we could find, nobody had misused the permission. But the company's picture of who could act on its behalf was wrong by a factor of twelve, and I have spent most of my career since closing that kind of distance.

I grew up in a public-housing flat in Toa Payoh. My mother kept the accounts for a hardware wholesaler and my father drove a taxi, and between them they taught me that a record is only as honest as the person allowed to change it. I studied information systems at Straitsmoor University, graduating in 2001, and joined Kirivane Systems, a Singapore outsourcing company, as a systems engineer. For three years I ran directory services and desktops for clients that included two hospitals and a polytechnic. The lesson of that job was simple and has never left me: accounts outlive the people they were created for, unless someone is paid to notice.

In 2004 I moved to Thornquay Risk Advisory, a technology-risk and IT audit practice, because I wanted to understand why controls fail rather than only reset them. Over seven years I tested access, change management and disaster recovery for banks, insurers and listed companies, completed a part-time master's degree in information security at Pelangra Institute of Technology in 2007, and became a senior manager leading a team of twelve. I learnt how audit committees read technology findings, and how often a finding rated high stays open for three years because nobody with a budget owns it. I decided I wanted to be the person who owned it.

That opportunity came in 2011 from Cendravale Data Centres, a colocation operator in Kuala Lumpur owned by an infrastructure fund. As head of IT and information security, I was responsible for the systems that ran three facilities and for the line where physical and logical security meet. We joined the badge system to the change-ticket system, so that a customer's engineer could not enter a hall without an approved request, and certified all three sites to the international information-security standard. I also learnt to think in kilowatts. In a data centre, power allocated to a rack is a contract, and capacity that looks free on a floor plan may already be promised.

I returned to Singapore in 2016 to lead enterprise technology at Sunvarda Journeys, a venture-backed company selling hotel stays and tours across Southeast Asia. It grew from 600 to 2,100 people in four years, and every new team brought its own software. I found 140 applications, most bought on company cards, and put them behind one sign-in. When the company was sold to a larger travel group in 2019, I ran the handover of its enterprise systems and left once it was complete.

I joined Amarisca in January 2020 as head of enterprise technology, reporting to the chief financial officer, and became chief information officer in April 2022, reporting to the chief executive, after Jantaris Growth Partners invested and the company began buying businesses in other countries. Since then we have acquired payroll and HR companies in Ho Chi Minh City, Jakarta and Bangkok, brought them onto one identity platform and rebuilt the controls on the workbench our specialists use. The defining event was a payroll diversion in 2023, which showed me that a quarterly access review can confirm that a person holds exactly the permissions their role grants and still miss the fact that the role itself is unsafe.

Today I lead 172 employees and 38 contractors through seven direct reports, among them our chief information security officer, with an operating budget of S$43 million and capital spending of S$8 million in 2026. I report quarterly to our Audit and Risk Committee and present to the board on technology and cyber risk. I ask my teams for three habits: write down who can reach what, make every exception quick and visible, and bring me a failed test before it is rerun.

Inside our industry I am probably known for three positions that cost something in the short run: that access should expire by default, that IT due diligence should change the price of an acquisition rather than its integration budget, and that a software register should be organised by the personal data each tool holds. I hold them because I have watched the alternatives produce findings that stayed open for years. I am now preparing to serve as an independent director, so that I can ask those questions from the other side of the table.

Open to Board appointments · Speaking invitations

Languages / English · Malay · Bahasa Indonesia (working)