Looking for a job

Joe Lam

@joelam

Information security governance and risk professional in banking, leading technology controls and second-line assurance.

United Kingdom

Message

At Mizuho Bank, I led the global rollout of the EMEA Technology Control Framework, produced the Risk Appetite Statement, and reported KRI and KPI monitoring. I also mapped controls to identify compliance gaps and reviewed SOC 2 Type reports for third-party suppliers.

At Vanquis Banking Group, I built and led the Security Consultancy, Architecture and Assurance teams and developed a security strategy and operating model aligned to business objectives. Across banking and financial services, I’ve provided second-line oversight and challenge, owned security policies and standards, and supported regulatory assurance including PRA CQuest, DORA, SOX, PCI DSS, CHAPS and LINK.

Experience

Work history, roles, and key accomplishments

Information Security Consultant

Mizuho Bank

Mar 2026 - Aug 2026 (5 months)

Led the global rollout of the EMEA Technology Control Framework and produced the Risk Appetite Statement. Acted as Security Risk SME, maintaining cyber security policies and mapping controls for SOX and NIST compliance.

Technology Controls Risk Appetite Statements KPIs GRC SOX NIST SOC2 Cybersecurity Policy

Information Security Consultant, Assurance

Handelsbanken

Jul 2024 - Jul 2025 (1 year)

Led assurance activities for information security risk, including DLP and CQUEST framework development. Delivered successful attestations for PRA CQuest, LINK, LSISS, and CHAPS, and supported SOX and DORA compliance.

Assurance DLP ClearQuest PRA Link LSISS CHAPS SOX DORA RCSA SOC2

Senior Security Consultancy, Architecture & Assurance Manager

Vanquis Banking Group

Jun 2019 - Dec 2023 (4 years 6 months)

Built and led the Security Consultancy, Architecture and Assurance teams, and acted as Interim Senior Manager for the GRC team. Developed security strategy, owned policies and standards, and managed security testing providers.

Security Strategy GRC Policy Management Assurance PRA ISO 27001 NIST Azure Penetration Testing SOC2

Senior Security Analyst

Bank of England

Aug 2018 - Apr 2019 (8 months)

Lead senior security analyst for risk, compliance and governance on a major programme. Built and drove security risk assurance and provided security advisory as second line of defence.

Risk Assurance Security Advisory Second Line Of Defence Governance

Technology Risk Management Senior Specialist

BNY Mellon

Mar 2016 - Aug 2018 (2 years 5 months)

Lead assessor in a second-line service providing oversight and challenge of first-line risk management. Managed exception process and service delivery assurance, and reviewed SOC 2 reports for third-party suppliers.

Technology Risk Second Line Of Defence Exception Management SOC2 Risk Mitigation

Information Security Analyst

Department for Environment, Food and Rural Affairs (Defra)

Dec 2013 - Feb 2016 (2 years 2 months)

Managed security policy and documentation, set policies and standards aligned to the security control framework. Created the CAP Delivery information security model and acted as security adviser to the programme.

Security Policy Risk Assessment Penetration Testing Security Advisory

National Accreditor for the Police System

Home Office, British Government

Nov 2011 - Nov 2013 (2 years)

Maintained, managed and accredited National Police Systems across the UK, applying HMG Information Risk Management and ISO 27001 controls. Reviewed vulnerability assessments, penetration tests and security audits.

Accreditation HMG Information Risk Management ISO 27001 Vulnerability Assessment Penetration Testing Security Architecture

Security Accreditor

Her Majesty’s Passport Office, British Government

Feb 2010 - Nov 2011 (1 year 9 months)

Provided and maintained formal accreditation for national and local information systems, applying HMG IA standards. Managed information security assurance change control and delivered security training and awareness programmes.

Accreditation HMG IA Standards Change Control Security Training Awareness

Information Security Auditor

British Standards Institution (BSI)

Mar 2009 - Jul 2009 (4 months)

Conducted ISO 9001 and ISO 27001 assessments as auditor and documented assessment reports for clients.

ISO 9001 ISO 27001 Audit Evaluation Reports

Compliance Security Analyst

Betfair Ltd (Paddy Power Betfair)

Feb 2008 - Feb 2009 (1 year)

Achieved PCI DSS compliance and maintained ISO 27001 certification for Betfair. Conducted ISMS reviews to maintain good practice across business continuity, equipment security and incident management.

PCI DSS ISO 27001 ISMS Business Continuity Incident Management