An index of the systems I have been answerable for

Mandate

Build enterprise technology and security fit for a company about to buy businesses in other countries, and give the board a clear view of who can reach client payroll data.

Outcomes

• Brought three acquired businesses onto one identity platform within ninety days of each closing; median removal of a leaver's access now under two hours.
• Redesigned payroll-operations access after a 2023 diversion; standing access paths fell about 96 per cent, with no diversion since.
• Cut software subscriptions from 430 to 214 and annual spend from S$11.6 million to S$8.1 million, with every personal-data tool under agreement.
• Negotiated a S$2.7 million IT holdback in the Siravanna purchase, released in full after four milestones were met in eleven months.
• Split hosting between Johor and a Singapore cloud region at S$1.3 million a year below the all-cloud option.

Decisions in context

I joined Amarisca in January 2020 to run enterprise technology for a company of 1,600 people that was about to grow quickly. Revenue was S$124 million and nearly all of it came from Singapore and Malaysia. In April 2022, after Jantaris Growth Partners invested, I became CIO and began reporting to the chief executive, with a mandate that now included acquisitions. The order of work was set by events: identity first, then the software register, then the payroll-operations controls rebuilt after the 2023 diversion, then the hosting split. I lead 172 employees and 38 contractors through seven direct reports, one of them our chief information security officer. My boundary with the chief technology officer is written into our operating charter: he owns the product and its production cloud, and I own everything our own people use to reach client data. By 2025 revenue was S$318 million and the company employed 3,400 people in six countries.

Reason for the move

Current role. Not seeking an executive move; considering one independent directorship with the Amarisca board's consent.

Mandate

Give a company growing by more than 500 people a year a single sign-in, managed devices and a controlled set of corporate systems.

Outcomes

• Placed 140 applications behind one sign-in with multi-factor authentication for every employee.
• Replaced three email systems with one and brought 2,100 laptops under central management.
• Built the company's first software register and reduced enterprise technology cost per employee by 22 per cent.
• Ran the transfer of enterprise systems to the acquiring group within five months of the sale.

Decisions in context

Sunvarda sold hotel stays and tours across Southeast Asia and grew from 600 to 2,100 people while I was there. Every new market and every new team arrived with its own software, often bought on a company card on the day it was needed. I reported to the chief financial officer and led a team of thirty-four. We put 140 applications behind one sign-in, replaced three email systems with one and brought every laptop under central management, which mattered in a company whose staff travelled constantly and lost devices in airports. I also built the first software register, a modest version of the one I later rebuilt at Amarisca around personal data. When the company was sold to a larger travel group in 2019, the acquirer planned to absorb enterprise technology. I ran the transfer over five months and left in December 2019, once the last system had moved.

Reason for the move

Enterprise technology was absorbed by the acquirer after the 2019 sale; I left once the handover was complete.

Mandate

Run the company's own IT and secure the line between customers' physical access to the halls and their logical access to systems.

Outcomes

• Linked the badge system to change tickets, so customers' engineers could enter a hall only against an approved request.
• Certified all three facilities to the international information-security management standard.
• Rebuilt metering and billing of customers' power use per rack.
• Cut the time to approve a customer's escorted access request from three days to four hours.

Decisions in context

I moved to Kuala Lumpur in June 2011 to run IT and information security for a colocation operator with two facilities in Cyberjaya and a third that opened in Johor during my time there. I reported to the chief operating officer and led twenty-six people. The work sat where physical and logical security meet. Our customers' engineers needed access to their own racks at short notice, and our customers' auditors needed proof that nobody else could reach them. We linked the badge system to the change-ticket system and certified all three sites to the international information-security standard. I also rebuilt the metering and billing of customers' power, which taught me that capacity in a data centre is measured in kilowatts allocated, not in empty floor. I returned to Singapore in early 2016, when my father's health required me to be closer to home.

Reason for the move

Returned to Singapore for family reasons and to work in a fast-growing digital company.

Mandate

Lead technology-risk reviews and IT audit support for financial institutions and listed companies.

Outcomes

• Led around eighteen engagements a year on access, change management and disaster recovery.
• Built a method for testing segregation of duties in payments and claims systems, adopted across the practice.
• Presented findings to the audit committees of six clients.

Decisions in context

Promoted to manager in April 2008, I led technology-risk reviews for banks, insurers and listed companies, and by 2011 ran a team of twelve as a senior manager. Most engagements tested access, change management and disaster recovery, and a growing number tested how payments and claims systems separated the people who could set up a payment from those who could approve it. I built a method for that testing which the practice adopted. I also presented to the audit committees of six clients and learnt how members read technology findings: what made them ask a second question, and what made them move on. Too often, a high-rated finding stayed open for years because no executive with a budget owned it. I left in 2011 because I wanted to be that executive.

Reason for the move

Wanted to own the controls I had been testing, inside a company that would fund them.

Mandate

Plan and run fieldwork on IT general controls and access reviews.

Outcomes

• Ran fieldwork on about fifteen engagements a year for banks, insurers and listed companies.
• Introduced data-led access testing, comparing system permissions with HR records instead of sampling.
• Completed a part-time master's degree in information security in 2007.

Decisions in context

I joined Thornquay in September 2004 as a senior consultant, after three years running systems for outsourced clients. My work was fieldwork on IT general controls: who could change a system, who could reach its data and whether its backups would restore. In 2006, at an insurer's Singapore office, I found that sixty-three people could approve claim payments above the branch limit when the business believed five could. That finding changed how I tested. Instead of sampling a few users, I began comparing every system permission with the HR record and the job description, which the practice later made standard. I studied part-time for a master's degree in information security at Pelangra Institute of Technology and completed it in November 2007. I was promoted to manager in April 2008.

Reason for the move

Promoted to manager.

Mandate

Run directory services and desktop support for outsourced clients.

Outcomes

• Administered directories covering about 9,000 users across two hospitals and a polytechnic.
• Wrote the scripts that reconciled directory accounts with clients' HR leaver lists each week.
• Disabled about 1,400 accounts belonging to people who had left.

Decisions in context

I joined Kirivane Systems in July 2001, a month after graduating, as a systems engineer on contracts that ran directories and desktops for two hospitals and a polytechnic. The work was practical and often urgent: password resets, new starters, departmental moves and the occasional outage at the worst possible hour. My most useful contribution was a set of scripts that compared directory accounts each week with the leaver lists our clients' HR teams sent us. In the first run we found about 1,400 accounts belonging to people who had left, some of them years earlier. Nobody had been negligent; disabling accounts was simply nobody's job. That discovery made me curious about why controls fail in organisations full of careful people, and in 2004 I moved into technology audit to find out.

Reason for the move

Wanted to understand why controls failed, not only reset them.