Senior Security Specialist  •  ASML Taiwan

1. Risk Assessment and Management: Conduct risk assessments on systems, processes, and services within a specific scope to identify potential risks, likelihoods, and impacts, and develop and implement corresponding risk management strategies based on the company's risk preferences.
2. Security Event Monitoring and Response: Monitor the security event reporting platform, detect and respond to security incidents, and develop and implement threat response plans.
3. Research and Analysis: Focus on security trends and vulnerabilities, analyze threat intelligence, and develop corresponding protection measures and recommendations based on the organization's internal situation.
4. Security Awareness Training: Develop and implement security awareness training activities to increase employee security awareness and reduce internal risks.
5. Internal Process Improvement: Provide optimization suggestions for existing processes, develop plans, and gradually improve communication and operational efficiency.

Nov. 2022 - Present (5 mos)

IT Manager  •  New Green Power Co. Ltd.

(A BlackRock portfolio  company specializing in solar and battery development)

Security Related

1. Initiate, plan, implement and monitor security strategies and controls to ensure the cybersecurity risk level is appropriate and always aligned with company objectives. (Conduct ISO 27001 security framework, 27002 security controls, 27005 risk assessment, IEC 62443 ICS security framework). Responsible for conducting ISMS containing it’s  controls, self-assessment and providing  3rd party certification assists.
2. Assess IT change request ticket impact and risk assessment, and assist/execute related changes and tasks.
3. Implement  a record logging system (ELK stack) which are logs generated from Microsoft 365 management activity API, infra-equipment, and services events to monitor, analyze, discover and notify potential risk events and prevent exploits. (Technical Stack: Elasticsearch, Logstash, Kibana, Winlogbeat)
4. Publish IT/cybersecurity-related articles internally, develop training materials and conduct security awareness training for colleagues.
5. Track security-related news (Equipment provider, TWCERT/CC, Cybersecurity community, social media), laws, and regulations (Cyber Security Management Act, Personal Data Protection Act). Develop solution proposals for the implementation of compliance and operational requirements, as well as optimization measures.
6. Maintain information system confidentiality, integrity and availability as follows
   • Network： Cisco SW、Fortinet & Palo Alto FW、VPN
   • Communication： Cisco Unified Communications Server Farm、Webex、Microsoft Teams
   • Server： ERP systems(Digiwin Workflow、Aras OpenPLM) , Windows AD/Azure AD Hybrid deployment、DNS、DHCP、NAC/NAS(Network Access Server)、Anti-Virus Console、Gitlab、Crestron Fusion、ELK Stack、OpenAudIT、WAF、IPS、DLP、RootCA
   • Web server： IIS、Tomcat、Nginx(Reverse Proxy)
   • SaaS： Microsoft 365 Global Admin、Elastic Cloud

IT Related

1. Manage and collaborate on a digital transformation program with SI to introduce and develop an advanced ERP system. (System Module: Contract payment, procurement cycle and project management related)
2. Develop ISMS forms and reporting service on ERP system to expedite e-approval and communication efficiency. (Technical Stack: C#, SQL, PowerShell)
3. Manage IT assets, lead infrastructure, hardware, software, IT service, license, etc. requirements assessment, procurement, and asset inventory.
4. Coordinate information systems stockholders' needs and evaluate the appropriate solution to achieve most requirements.
5. Manage and maintain IT facilities such as databases, web servers, network/communication equipment, and office equipment. Provide guides and troubleshooting for any stakeholder.

Feb. 2019 - Nov. 2022  (3 yrs 7 mos)

Software Engineer  •  Stantec Consulting Inc.

(An international professional services company in the design and consulting industry.)

1. Formed local IT infrastructure,  performed daily system health checks, addressed issues, and documented results, including maintaining systems performance and troubleshooting outages aligned with Stantec procedures.
2. Execute government information bids from EPA/BOE/IDB, develop large information management systems,  supervise schedules, and focus on performance and cybersecurity to review codes from other engineers. (Technical Stack: C#, Vue.js, SQL, Reporting service, PowerBI, IIS, Windows Server, Gitlab CI/CD, OWASP)
3. Manage and maintain IT facilities such as video conference equipment, IP phone, printers, and projectors. Provide guides and troubleshooting for any meetings & users.
4. Providing guidance and training to software development teams on secure coding practices and security best practices.

Apr. 2014 - Oct. 2019 (5 yrs 6 mos)

Corporal Squad Leader  •  R.O.C. Army 564th Armored Brigade 

1. Maintaining equipment and weapons, ensuring they are clean and operational.
2. Assisting with administrative tasks, such as maintaining records and completing reports.
3. Serve as a sentry to maintain a watchful and alert presence to detect and deter potential threats to the area or facility being guarded.

Sep. 2012 - Aug. 2013 (11 mos)