Todd Yu

Background

About Todd Yu

With a decade of experience in global business operations and over five years in cybersecurity, played a pivotal role in designing and implementing Information Security Management Systems (ISMS) to address global business requirements. Expertise lies in leadership and management, fostering the development of robust teams, streamlining processes, and incorporating technology across multiple domains. Key areas of expertise include: • Strategic Leadership and Team Management: Demonstrated success in driving strategy, innovation, and continual improvements within the cybersecurity landscape, ensuring comprehensive security solutions and contributing to the organization‘s business needs with assigned resources. • Cloud Security: Ensuring security and compliance within hybrid IT environments utilizing Microsoft Azure and Office 365 platforms. • ISMS Implementation and Maintenance: Developing and maintaining ISO 27001-certified ISMS, focusing on risk management, incident response, security awareness programs, vulnerability assessments and penetrating testing, third-party evaluations, legal compliance, business continuity planning, disaster recovery, and independent audits. • Project Management: Proficient in managing global projects using both agile and waterfall methodologies. Key projects include SSAE 18 SOC 1 Type II, Cloud Security Enhancement, New Product Risk Assessments, In-house SOC Onboarding, ISO 27001 Certification Audits, External & Internal VAPT, and Privacy Compliance. • Data Privacy and Security Regulation Compliance: Ensuring adherence to GDPR, PCI DSS, GLBA, HIPAA, HITECH Act, U.S. data security regulations (NYDFS Cybersecurity Regulation, the S.H.I.E.L.D Act), U.S. data privacy regulations (CCPA & CPRA), U.S. state data breach notification laws, and Chinese cybersecurity laws (encryption law, data security law, MLPS 2.0, PIPL). • Security Operations Center (SOC) Design and Operation: Expertise in designing, onboarding, and operating SOCs, including event triage and analysis, initial incident investigation and response, use case development and implementation, metrics dashboard design, and threat intelligence monitoring and response.