Anthony Bugaoan

I’m a cybersecurity professional specializing in Governance, Risk & Compliance (GRC) within banking and financial services. At Metrobank, I led information security risk assessments across business processes, system enhancements, and third-party engagements.

I produce formal risk reports with disposition recommendations—approve, approve with conditions, or reject—grounded in BSP regulations, PCI DSS, and ISO frameworks. I also identify and escalate critical security design flaws, including exposed cardholder data, inadequate data retention policies, and insecure RPA credential handling, so fixes happen before production deployment.

I perform granular process mapping analysis to uncover step-level security risks across complex workflows, especially for RPA automations, operational process improvements, and system enhancements. I recommend penetration testing engagements for high-risk changes in coordination with the bank’s internal PT team, and I manage daily intake of ~12 infosec review requests by assessing complexity, prioritizing work, and communicating dispositions to business owners.

Before Metrobank, I supported audit readiness by developing ACL scripts to transform and validate client financial data for PwC’s Halo audit platform. I’m actively pursuing CGRC (ISC2) and I’m open to GRC and Information Security roles where security governance directly strengthens business outcomes.