Looking for a job

Xiaowen Yang

@xiaowenyang

Message

Cybersecurity Project Manager at GUCCI, coordinating China compliance projects and security reviews across 23 projects.

China

Message

At GUCCI, I coordinated cybersecurity and compliance work in China, including security reviews of 23 projects that embedded China-specific requirements with global requirements.

I supported Gucci China’s cross-border data transfer declaration by coordinating stakeholders and vendors, and working with an external consultant on data inventory and mapping across 3 scenarios and 30+ systems. I also supported preparation and testing for 2 MLPS filings.

Previously, at H&M, I worked on vendor security assessments, privacy and cross-border data transfer compliance, and China implementation of global security policy. Earlier at EY Advisory, I led IT audit and SOC reporting projects; I also supported PingCAP’s first SOC 2 Type 2 report and first year of ISO 27001 certification.

Experience

Work history, roles, and key accomplishments

GUCCI CyberSecurity Project Manager

Kering

Dec 2023 - Jun 2026 (2 years 6 months)

Managed vendor risk assessments and compliance projects including cross-border data transfer declarations, MLPS, and mini program filings. Coordinated security reviews and vulnerability remediation for Gucci China.

Vendor Management Risk Assessment Compliance Cross Border Data Transfer MLP Security Review Vulnerability Remediation Stakeholder Management

Cyber Security Customer & Privacy Analyst

H&M

Aug 2021 - Dec 2023 (2 years 4 months)

Supervised vendor security assessments and supported compliance projects including MLPS, PIPL assessments, and cross-border data transfer declarations. Implemented global security policies in local product teams.

Vendor Management Data Privacy PIPL Cross Border Data Transfer MLP Policy Implementation Risk Assessment

Security Compliance Auditor

PingCAP

Dec 2020 - Aug 2021 (8 months)

Established the company's information security system and supported compliance projects including SOC 2 Type 2 and ISO 27001 certification. Produced security awareness training materials and newsletters.

Infosec SOC2 ISO 27001 Compliance Security Awareness Data Flow Analysis

Manager, Technology Risk

EY Advisory

Jul 2015 - Dec 2020 (5 years 5 months)

Led IT audit and SOC reporting projects across various industries. Performed special audits and agreed-upon procedures, including SQL review and data verification.

IT Audit SOX 404 SOC Reporting Risk Assessment SQL Data Analysis Internal Controls