Twelve-plus years across networking, security, wireless and systems infrastructure in Hong Kong — from hands-on engineering to leading engineering teams and owning delivery end to end for enterprise, financial-services and critical-facility clients. Current focus: securing OT / building-management networks, fault-tolerant server platforms, and regulatory compliance work (SFC cybersecurity, HKMA-regulated estates, ISO 27001) as an ISMS owner.
Technical Domains
Project Highlights
Langham Place — BMS Network Health Check
Intermittent BMS controller outages on a shared, undocumented network traced to a Layer-2 loop; emergency response plan and segmentation roadmap.
SFC-Licensed Securities Firms — Cyber Compliance
SFC Cybersecurity Guidelines gap analysis, Security Risk Assessment & Audit (SRAA) and roadmap; reference architecture with segmentation, SIEM, EDR, PAM, ZTNA and HKEX connectivity; managed-support SOW.
IA-Licensed Insurer — Ransomware Incident Response
Overnight incident response after a ransomware attack; business fully restored within a week with security gaps closed; retained since for ongoing operations, half-yearly DR drills and consolidation of departmental NAS into HCI.
Hong Kong St. John Ambulance — Security Risk Assessment & Audit
SRAA covering all internal network devices and public-facing websites; vulnerability scanning, prioritised remediation plan, patching and preventive controls with follow-up re-scan.
Enterprise Virtualisation & Firewall Programmes
Large-scale VMware to Sangfor HCI / Hyper-V migration proposal; zero-downtime FortiGate HA upgrade; SSL VPN to IPsec migration; OT/IT security kit for HKMA-regulated clients.
Hong Kong Eye Hospital — BMS Backbone Redundancy
Single core switch replaced with a redundant pair plus a fibre-fed floor switch over existing single-mode fibre; bilingual proposal, BOM and out-of-hours cutover.
Two-Site Server Redundancy — Stratus everRun
Legacy Stratus / NEC fault-tolerant servers migrated to everRun across a data centre and a bank site; Veeam-based migration with near real-time RPO preserved.
Pulsar — New Datacenter Build
FortiGate HA pair with cross-site VRRP over metro fibre; vCenter with vSphere Replication from the existing cluster; UniFi to Arista switch migration.
BACnet/IP Network Security — Metasys + Carrier
Application-layer BACnet enforcement vs IP/port control compared in a split SOW; segmentation design for BMS controllers on a shared OT network.
Xenus Technology — ISO 27001 ISMS
ISMS Owner: scope and control baselines for the production estate; configuration and SOP documents for ERP, service desk, PAM, SIEM/EDR and monitoring; Annex A audit evidence.
Johnson Controls International
Hardware fault-tolerance for critical VMs (service downtime under 50 ms); IoT sensor solution across an entire data-center building.
Kowloon Motor Bus (KMB)
High-availability IPsec VPN topology; CMHK 4G APN network solution; implementation & support across 150+ sites.
HK Air Cargo Terminals
Cross-building network revamp; ring topology for 300+ CCTV & AGV-robot devices; ERPS v2 ring-loop protection.
Dairy Farm — 7-Eleven
Mobile device management; SF Express app version control; mass deployment & support for 500+ sites.
New World Development — K11
Hyper-converged infrastructure; incident ticketing system; data protection & monitoring for 50+ VMs.
Bank of China (HK)
WiFi solution across 200+ branches; cloud-managed network hardware; disaster recovery & offsite DB backup.
Experience
- Sit on the top management meeting and help drive company direction: service portfolio, vendor and partner strategy, hiring plans and delivery priorities.
- Lead client engagements end to end — scoping, commercial proposals, delivery governance and executive reporting — as the single point of accountability for outcomes.
- Lead a 40-strong Tier-1 / Tier-2 engineering team across delivery, incident response and managed-service operations; set technical standards, review designs and own cutover / rollback decisions.
- Technical lead to a 30-person sales team: solution positioning, pre-sales enablement, demo and POC support, and deal-level risk review.
- Coordinate vendors, distributors and client stakeholders (IT, facilities, compliance) to keep multi-party programmes on schedule and within risk appetite.
- Advise regulated clients (SFC, HKMA, IA) and NGOs on cybersecurity governance: gap assessments, Security Risk Assessment & Audit (SRAA), control roadmaps and risk communication to management.
- ISMS Owner for the company's ISO 27001 programme: define scope and policy, own the control baseline and risk register, drive audit readiness and continual improvement across teams.
- Built and led the Tier-2 engineering team of a network and security distributor; owned project delivery, escalation handling and service quality across the reseller channel.
- Technical authority for the product portfolio: vendor escalations, structured feedback to R&D on product improvement, and evaluation of new product lines for the company roadmap.
- Ran technical enablement for resellers and internal sales — training, demos and POC support — and backed major bids with solution design and BOM review.
- Solution consultant for network and security projects across the full lifecycle — requirements, design, implementation, cutover and post-go-live support — for enterprise clients in transport, retail and banking.
- Produced infrastructure revamp proposals and kept resellers and clients current on network and security technology; supported pre-sales with demos and POCs.
- Server maintenance & migration; first-tier user technical support; introduced new technology.
- Frontend design, database management, HTML animation.
- Telephone deployment, network cabling, home router & modem setup.