Lester Chng

Cyber CEOs Brand Strategist. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

You head a leading cybersecurity firm.
But your online presence doesn't reflect it.

In fact, being invisible is damaging. 

You understand the power of thought leadership.
You know LinkedIn shapes deal flow and adds credibility in the industry.
You just don’t have the cycles (or the copy) to share your expertise and experience.

You have stories worth telling.

The insights from being in the trenches.
The deep conversations with your ace teams.
The hard discussions with your clients. 

Don’t let this wisdom go to waste.

That’s where I come in.

--------------------------------------------------------------------------------------------

How we work together.

Profile & Positioning
=> Rebuild your LinkedIn profile so visitors see industry authority, not “another vendor.”

Content engine
=> Ghostwritten posts that leverage your insights and expertise into engaging LinkedIn posts. 

Outreach campaign
=> Targeted DM campaigns and audience-building strategies that build your authority and land you on podcasts and conference stages.

--------------------------------------------------------------------------------------------

You focus on growing your firm and protecting your clients.
And we will ensure the industry, clients, prospects, and investors can’t ignore it.

Let’s build the personal brand that commands the cybersecurity conversation and drives business.


Worked with global client portfolio 
- MSPs
- MSSPs
- Agentic AI SOC
- AI-powered GRC 
- Operational Resilience 

Senior Advisor, Financial Crimes Unit Exercises. BMO Fusion Centre

Execution of Financial Crimes Unit Exercise and Drill Program
• Design and execution of exercises and drills to operationalize the Financial Crimes Unit Fusion Centre
• Scenario creation and exercise execution for Information Security, Enterprise Fraud Management, Physical Security, and Global Crisis and Continuity Management teams 
• Providing effective challenge of incident response readiness through exercise observation
• Execution of enterprise-wide Purple Team Exercise


Cybersecurity Exercises: Purple Team, Ransomware, DDoS, Malware, Data Corruption, Data Breach, 3rd Party Incidents
Fraud Exercises: ATOs, Attack on Payment systems, Business Email Compromise, PII Breach
Physical Security Exercise: Active Assailant, Civil Unrest, Bomb Threats
Crisis Exercises: Disaster Recovery, Business Continuity, Operational Resilience, Fire Incidents, Natural Disasters, Utilities Disruption

Welcome to yr cyber flight simulator. 

I promise I won’t make u cry. 

The Cyber Range has been a faithful workhorse of Rogers Cybersecure Catalyst, Toronto Metropolitan University. 

Incident response professionals, IT teams, municipal leaders, law enforcement officers, veterans, and foreign partners have gone through their paces at the range. 

Has yr team seen what a cyber incident looks like?

Have they been in the hot seat, trying to make sense of what’s happening and needing to coordinate and prioritise actions?

Have they been given the rigor of training to sharpen their instinct, rehearsal their articulation, and coordinate competitions priorities?

This is your cyber flight simulator. 

Step in and see what happens when the rubber hits the road. 

Or are you going to take the risk and wait for a real incident to find out?

Good luck. 
Godspeed. 


P.S 
Please follow Rogers Cybersecure Catalyst, Toronto Metropolitan University. 

We have been delivering exciting programs to individuals and organizations for years and have shaped Canadian’s Cyber Ecosystem. 

It’s going to be an eventful year. 

Follow + try to keep up w the Catalyst.

No alternative text description for this image

I once received AAR feedback from an executive that changed how I view these "mundane" reports.

After-action reports are very important to the success of an exercise program. Without it, there is no chance of leadership buy-in, and soon the program will fizzle out.

These are typical uses/benefits of an AAR.

• capture lessons learned
• provide recap of proceedings
• serve as evidence for risk/auditors
• feeds into enterprise-wide action item register

On this occasion, I drafted the AAR for a fraud-related exercise. It involved many operational teams including executive involvement. The AAR was signed and sent.

One feedback from an executive stood out.

"It had alot of detail, but I don't know if it was a success".

That struck me. We just missed an opportunity.

An opportunity to highlight:
• the alignment with the overall security program
• the collaboration involved to run the exercise
• the advancement in teamwork 
• the reduction of risk

Include a clear story and highlight the win in your AAR.

Don't take these exercises and artefacts for granted.
Each event builds confidence, familiarity, and resilience.
Don't let it go unnoticed; give it its due credit.

P.S Have you seen AARs put to good use?

Most cyber CEOs think LinkedIn is about “posting more.”

It’s about posting with a positioning equation:
Authority + Trust + Leads

Don't start without a clear content strategy.

Here’s the simple way to build your content calendar.

𝗔𝘂𝘁𝗵𝗼𝗿𝗶𝘁𝘆
1. Build authority so you become the obvious expert.
Authority is when your audience says,
“This person knows the space.”

Teach one niche concept per post (one takeaway).

Share your lived experienced not conceptual ones.

Break down “why this fails” in real environments.

Add proof when possible:
Lessons, patterns, results, before/after.
Authority posts go deep in your niche.
More “results, insights, wisdom.” Less "frameworks"

𝗧𝗿𝘂𝘀𝘁
2. Build trust so people believe in what you stand for.
Trust is when your audience says,
“I’d take a meeting with them.”
It comes from clarity and consistency, not hype.

Show how you think, how you communicate risk, and how you make tradeoffs under constraints. Use stories, principles, and honest calls on what you will and won’t do. When people understand how you deal with situations, they start to trust your delivery.

𝗟𝗲𝗮𝗱𝘀
3. Generate leads without sounding salesy.

Direct: a clear CTA after you have earned it.

Indirect: a walkthrough of what it is like working w you.

Remove friction:
scope, timeline, roles involved, what success looks like.

Make it obvious you solve this specific problem for this specific buyer. Lead posts can be direct or indirect, and “walk-through” posts remove buying friction fast.

If you want a repeatable content calendar, stop brainstorming topics.

P.S Do you start writing without a plan?

Thanks Timothy Martens for prompt inspiration.

And Gerald Auger, Ph.D. + Mike Miller
for the reminder to include an image =)

How was your first full week at work?

This will happen if you don't intervene.

The Rule of the First 5 Days is a stock market indicator that states that if the market performs positively in the first 5 trading days of the year, there is a high probability that the markets will end the year positively.

Historical probabilities are between 69 - 84%.

Some of the reasons are:
Early Positioning
Investor Sentiment
Self-Fulfilling Prophecy


Bringing it back to how was your first week back at work?

Busy?
Stressed?
Juggling priorities?

Chances are if you don't make any changes, this will be how your year pans out.


If you had a great week, keep at it!

If not, time to review:
- the triggers
- the pain points
- the larger picture
- the longer term goals

Good luck for week 2!

P.S Dow has best 5-day start to year since 2006!

undefined undefined

bootcamp

Sign up here:
https://catalystcorporatetraining.classe365.com/form/view/AutoBootCamp?_gl=1*9rfqtg*_ga*MTQ4NTczNDM0MC4xNjk4MjQxODM1*_ga_YYXBQS6S5Q*MTcwNzgzMzEyNi4xODEuMS4xNzA3ODMzMTYwLjI2LjAuMA

Time is flying by. Jan is almost over. 

This is 1 thing I miss from 10 years ago. 


My lucious hair that would give me a chance at K-pop auditions. 

Just kidding. I stand no chance. 



What do u miss from 10 years ago?




Thanks sir Chris Chia for taking this pic and sending it again to me recently!

Leader, Coach, Facilitator

If your cyber exercise doesn't make you sweat,

why do you call it an exercise?

Too many teams are taking a stroll during tabletop exercises. They don't prepare in advance, they talk in circles, and frankly take it too lightly.

I have seen teams prepare extensively for exercises.

They relook their process and hold internal preparation meetings to validate if it still makes sense. They ask tough questions internally and the leaders confirm if their assumptions about alternatives, recovery times, capabilities, and priorities are still accurate.

The best teams go in well-prepared and respond confidently. This is not just for show. This is an opportunity where leadership teams have recognized the importance of readiness and set aside protected time to be intentional about preparation. 

This only happens if the exercise program is well-socialized.
When the experience and outputs are understood.
And the leadership is serious about training.

Otherwise, what's the point?
Check a box? It's 2026, do better.

Your next Cyber TTX will be miles better with this small tweak. 

Don’t rush the start of the exercise. 

I know you have been planning it for months. Your adrenaline is pumping and you assume the participants are chomping at the bit to begin. 

But don’t neglect the pre ex brief. 

Here’s why it matters. 

1. Not everyone is familiar w exercises

Some have never participated in one. 
Others can’t remember what it’s like. 
1 or 2 even have weird assumptions. 

2. Remind everyone of the Why

The stakeholders are not equally invested in the exercise or outcome. Half are wondering why they are there. 

3. A good start is important

Some exercises that start poorly can result in minutes of waffling, rabbit holes or just straight up disengagement. 

4. Questions forces a buy-in

Facilitate a short quiz or discussion. 
This makes participants feel involved and helps them warm up as well. 

5. Simple introductions helps

You will be surprised how often teams don’t know each other or what role they play in an incident. 
Take time to do a roundtable intro. 

6. Sponsor emphasis 

Allow the exercise sponsor to speak. 
This reiterates the investment, focus, and important of the exercise. 

7. Calms your nerves

Address concerns before an exercise can help mitigate against difficult scenarios such as wrong expectations and challenging stakeholders. 
There will also be disruption but touching on some issues early helps. 

The next time you plan yr exercise. 
Spend abit more time on the start. 
It will be worth it. 

P.S any other exercise faux pax?

What most Cyber CEOs post on LinkedIn 
 
- repost their company's post 
- post about the latest hack 
- random AI blog 
 
What should Cyber CEOs post on LinkedIn 
 
- customer success stories 
- lessons learned about your business 
- strong opinion about industry issues 
 
You are the leader. 
 
Lead by example. 
 
Here are more post ideas. 

Subject Matter Expertise
- insights
- pain-points
- transformation
- trends + opinion
- counter-trends
- mistakes you have seen others made

Trust
- client success stories
- decision-making dilemmas
- framework for decision-making 
- social proof
- results

Character
- guiding principles
- values
- client examples
- stories of resilience
- leadership

Authenticity
- challenges that excite you
- lessons learned
- challenges that you overcame
- best advice that you received

Majority of my bosses in Cybersecurity have been female.

Yet female only make up 21% of the cyber workforce.

I interviewed Sarah to get her insights on Women in Cyber.

Sarah is a certified coach, facilitator, and founder of the Human Skills Leadership Lab, a unique and customizable program that helps professionals develop the human skills (or ‘soft skills’) required for effective leadership in the modern workplace. 


𝗪𝗼𝗺𝗲𝗻 𝗶𝗻 𝗖𝘆𝗯𝗲𝗿 𝗟𝗲𝗮𝗱𝗲𝗿𝘀𝗵𝗶𝗽 𝗣𝗿𝗼𝗴𝗿𝗮𝗺

1. When you think about women leading in cybersecurity, what have you noticed most often in how they lead, communicate, or navigate their roles?

They’re brilliant and discerning. They carry a full plate - navigating complex decisions and significant risk - and still, they lead with calm authority, thoughtfulness and integrity. They think deeply about their teams, their organizations, their families, and the broader systems. They’re the kind of leaders the world needs more of.


2. As you look ahead to the Women in Cyber Leadership Program in Malaysia with the Catalyst, what aspects of the program are you most curious or energized about?
   
After 4 years collaborating with the Catalyst to support cyber leaders from across Canada, I’m incredibly excited to connect with cyber leaders from 7 countries across ASEAN. It will be thrilling to be part of the conversation as these women come together to learn from and with each other.

 

If you enjoyed this interview series, please follow Sarah Lang (MA, PCC, CPCC). She is a human skills expert, a Leadership in Communication Skills Coach, and has trained leaders from leading corporations and brands.

P.S. How are companies promoting diversity?

Soft Skills Expert • Certified Leadership & Public Speaking Coach & Facilitator • Program Design and Instruction @ U Toronto, KPMG, ESRI, Rogers • I help leaders transform confidence into connection and influence.

I trained Principle Warfare Officers. 

We assessed them on 3 attributes. 

The Principle Warfare Officer (PWO) was responsible for fighting the ship. 

This included the deployment of weapons, manoeuvres, and in many cases the control of multiple ships and aircraft to fulfil a mission. 

These are the 3 attributes. 

Knowledge 
- know the procedures 
- know the asset capabilities
- know the adversary’s capabilities 
- know the ever changing situation 

Command and control
- clarity of situation  
- clarity of instruction 
- clarity of orchestration

Creativity 
- demonstrates intuition 
- demonstrates flexibility 
- demonstrates adaptability 


In cybersecurity operations,

We assess
.
.
.
.
.

Hope you get my point. 

Happy training.

Most cyber CEOs aren’t afraid to post.
They’re afraid to be misunderstood.

And 19 other myths of writing on LinkedIn. 

 1. “I’ll get DMs from random people and waste time.”
 2. “If I post about a niche topic, it’ll limit my market.”
 3. “I should wait until my messaging is perfect.”
 4. “I’ll get fact-checked and embarrassed.”
 5. “I’ll be judged by peers in the industry.”
 6. “Clients will think I’m wasting time.”
 7. “I’m not a ‘social media' person.’”
 8. “I need a hot take every time.”
 9. “I’ll look like I’m bragging.”
10. “My team will cringe.”
11. “I need perfect writing.”
12. “People will think I’m selling.”
13. “I’ll attract trolls or get dragged.”
14. “I’ll upset a partner/vendor/client.”
15. “My competitors will copy my ideas.
16. “I’m not ‘big enough’ to have opinions.”
17. “If I post, I’m giving away the secret sauce.”
18. “Need to sound super technical to be credible.”
19. “If engagement is low, it means I’m bad at this.” 

P.S which is your fav? Mine is #8  🔥

I reviewed the LinkedIn headlines of 23 Cyber CEOs.

Not 1 mentioned these important aspects.

LinkedIn headlines are your first impression.
More precisely, the first 57 characters matter.

They are seen:
• on your profile
• during connection requests
• on the main feed via your posts
• in the comments with every response


I help [buyer] achieve [outcome] without [pain].

None of the CEOs mentioned buyer, outcome, or pain.

How would you write your headline?



[9]
CEO at [Company]
CEO at [Company]
CEO at [Company]
Founder/CEO at [Company]
Founder and CEO of [Company]
Founder and CEO at [Company]
Co-Founder & CEO at [Company]
Co-Founder & CEO at [Company]
CEO & Co-founder at [Company] - We are hiring!

[7]
CEO at [Company]| Autonomous SOC
CEO @ [Company]- Enterprise Hyper-Automation
Co-founder & CEO at [Company]| AI for Security Operations
Co-founder and CEO @ [Company] | Security Operations, at scale
Co-Founder/CEO at [Company]| Outpace attackers with agentic AI SOC Analysts
CEO @ [Company]| Executive | Entrepreneur | Revolutionizing the SOC with AI
Founder, CEO @ [Company] Autonomous SecOps & Investigation Platform with Hyperautomation.


[7]
Hiring misfits to solve security!
Tech Entrepreneur, investor and board member.
CEO at [Company] and Author of [Book] available now!
Building Your AI Knowledge Engine for Security Operations. Hiring!
Building great teams to execute on very difficult engineering problems
Tech Founder & Executive. Defender. Nation-state Hacker. Medal of Honor Recipient. Public speaker.
Empowering businesses: ChatGPT training, strategizing AI implementation, and offering tailored LLM and AI solutions for process automation.

AI tools are being used in yr org. 
Have your IR plans kept up?
Here are 4 changes to make. 

Implementing AI tools have left security team scrambling over the last couple of years to ensure it is securely deployed and monitored. 

Your incident response plans may have be neglected in the process. 

Consider these updates. 

1. Include AI related incidents 

- sensitive data exposure
- supply chain vulnerabilities 
- unauthorised model changes 

Don’t assume your plan is a catchall. 
AI asset owners don’t fully understand the security risks. 

2. Validate asset + contact list

- AI asset owners 
- data architects r crucial
- most of these folks r probably new

These AI gurus have been heads down focused on speed on implementation. They probably can’t spell cyber if u meet them for the first time on an incident call. 

3. AI specific containment

- understand the impacts 
- ask if traditional options will work

It’s going to get more complex as AI tools integrate across enterprise. It may soon become so entrenched that disabling it is a non option. 

4. Logs and investigation 

- review if current threshold is valid
- check on logs before/after go-live

You will learn to love “black boxes” and need to navigate round them. 


P.S what other areas to add?

2.

Incident response plans only play a small part in cyber resilience. 

“Do you have an IR plan?”

Is probably one of the most common question that consultants and experts use to gauge a company’s resilience. 

Many teams are happy to tick yes. 

But having a plan is merely the start. 

Here’s why:
- high turnover of staff
- fast pace of tech change
- lots of assumptions remain  
- plans get outdated due to new tech 
- teams don’t use the playbooks/plans
- primary teams hardly get trained
- secondary teams ignored 
- random cyber exercises 
- no training plan

There is barely any focus on training. 

7 men squads in the military get more training time and resources than multi-million dollar cyber defence teams protecting our financial ecosystem. 

Will having a plan alone save you?

And how long are you going to assumed your team is ready?

P.S the world is still a vulnerable place

Human skills training will unlock your career potential.

These are your advantages against AI... for now.

I interviewed Sarah to get her insights on human skills.

Sarah is a certified coach, facilitator, and founder of the Human Skills Leadership Lab, a unique and customizable program that helps professionals develop the human skills (or ‘soft skills’) required for effective leadership in the modern workplace. 


𝗛𝘂𝗺𝗮𝗻 𝗦𝗸𝗶𝗹𝗹𝘀 𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴

1. What are some of the key human skills that will unlock an individual’s potential in the workplace?
   
First: self-awareness, because awareness always precedes change. From there, the skills of emotional intelligence, listening and clear communication. These will help you improve your relationships and increase your influence and impact.


2. Were there pivotal moments from your own experience or from those that you coached that reaffirm that Human Skills Training is a vital part of career development?

I’m reminded of this everyday, given how easy it is to outsource one’s thinking, ideas, and voice to AI. We’re constantly pitched the benefits of efficiency, when really it’s our unique essence as a human that makes us compelling. Human skills will always be vital to professional and personal development.  


If you enjoyed this interview series, please follow Sarah Lang (MA, PCC, CPCC). She is a human skills expert, a Leadership in Communication Skills Coach, and has trained leaders from leading corporations and brands.

P.S. Are you worried about AI impacting yr career?

5 LinkedIn posts that should be part of your pre-RSAC marketing plan. 

If your Head of Marketing is not bugging you to start posting on LinkedIn before RSAC, ask them why?

Even better if they tell u what to post. 

Here’s 5 posts that I will write. 

“Heading to RSAC next week. Here’s the one question I’m asking every CISO I meet.”

“One year ago, [Client Type] was struggling with [Specific Problem]. Here’s what changed.”

“Everyone’s talking about [Trending Topic] at RSA. Here’s what they’re missing.”

“We’re bringing [Specific Thing] to RSA. Here’s why we built it.”

“I have 8 meeting slots open during RSA. Here’s who I wld love to talk to.”

_____________

Here’s 3 reasons why you shld post. 


REASON 1: 
Conferences are chaotic. 

This gives you a chance to cut through the noise.  

REASON 2: 
Post-Conference follow-up success is built upon pre-conference interaction.  

Unless you are a magician and can engage random folks on the floor. 

REASON 3: 
Yr competitors are already doing so. 

Silence = Falling Behind

You don’t want to waste all that $$$$

———————

No time to write?
Overwhelmed by the preparation?
Rather spend time on client demos?

Let’s work together and take that off your plate.

LinkedIn posts can be complicated.  

I simplify it by 3-2-1 method. 

3 types of posts 
- authority 
- leads 
- trust

Cycle this through the week. 

2 content pillars
- cybersecurity exercises
- LinkedIn copywriting 

Alternate pillars per day. 

1 target audience per post

Focus on 1 reader. 


What’s your 3-2-1?
⬇️

People judge within 7 seconds of opening yr mouth.

That's why I still get nervous before every presentation.

I interviewed Sarah Lang to get her insights on public speaking and establishing leadership presence.

Sarah is a certified coach, facilitator, and founder of the Human Skills Leadership Lab, a unique and customizable program that helps professionals develop the human skills (or ‘soft skills’) required for effective leadership in the modern workplace. 


𝗔𝗰𝘁𝗶𝗼𝗻𝗮𝗯𝗹𝗲 𝘁𝗶𝗽𝘀 𝗳𝗼𝗿 𝗹𝗲𝗮𝗱𝗲𝗿𝘀𝗵𝗶𝗽 𝗽𝗿𝗲𝘀𝗲𝗻𝗰𝗲

1. How would you explain what leadership presence is for those looking to grow in their career?
   
Leadership presence is your ability to stay grounded and intentional in all moments - including when you’re under pressure. In a society driven by distraction and dopamine hits, leaders who embody this type of presence, steadiness and self-trust stand out.  


2. What are some ways to practice being more grounded and present?

• Spend time on analogue hobbies that anchor you to the physical world - art, books, gardening, cooking, etc.
• Practice mono-tasking on purpose.
• Try slowing down your communication - listening, speaking, pausing, saying less.
• Regulate your nervous system with breathwork, yoga or grounding activities.
• Carve out daily moments to pause and transition between meetings and events


3. Presenting to an audience is a real fear for many professionals. Do you have a couple of tips that you usually teach?
   
First, get crystal-clear on what you’re trying to say and why it matters to your audience. Then, practice your vocal and non-verbal delivery to make sure you sound like you care about what you’re saying! I also teach simple ways to work with nerves rather than fight them so speakers can stay connected to themselves and their audience.
 

If you enjoyed this interview series, please follow Sarah Lang (MA, PCC, CPCC). She is a human skills expert, a Leadership in Communication Skills Coach, and has trained leaders from leading corporations and brands.

P.S. What's the best advice u received on public speaking?

Most Cyber CEOs post randomly and wonder why LinkedIn isn't working.
They write when inspiration strikes.
They share whatever feels right in the moment.
They post about the latest breach one day, their product the next, then go silent for weeks.

The result? Confusion. Zero traction. Wasted effort.

Here's what you should be doing instead:
Plan your content around 3 post types.

1. Authority posts
This is where you demonstrate expertise.
Share insights from client engagements. Dive deep into problems you're solving. Break down complex security concepts.

Examples:
"5 issues all enterprises face with AI governance"
"How we helped Company X reduce risk by 40%"
"The biggest misconception about Zero Trust"

These posts establish you as the expert in your niche.

2. Trust posts
This is where you build relationships.
Share your founder journey. Talk about team culture. Reveal the challenges you've overcome.

Examples:
"Why we started this company in 2019"
"The toughest decision I made as CEO"
"What our clients don't see behind the scenes"

These posts show the human behind the solution.

3. Lead posts
This is where you attract prospects.
Address pain points directly. Show transformation. Make your solution crystal clear.

Examples:
"Overwhelmed with compliance requirements?"
"How we saved a client 2000 hours per year"
"Is your board asking about AI risks?"

These posts turn readers into conversations.

Now here's the system:

Mon: Authority post
Wed: Trust post
Fri: Lead post

Repeat this for 6 months minimum.
Map out topics under each category. 
Populate your calendar. 

Never start from a blank page again.

Most cyber CEOs will read this and do nothing.

They'll keep posting randomly.
They'll keep getting zero results.
Don't be most CEOs.

Plan your content. Execute consistently. 
P.S. What type of post do you struggle with most?

Worried about the removal of your role?
Don't be a deer in headlights.
Do this immediately.

2025/2026 is the new 2020.

The trigger is different.
Lockdown vs AI.
The outcome is becoming the same.

And we shouldn't really be surprised...
If you are, stop living under a rock.

What did you think would happen?

Just look around the wider workforce, companies, tasks, processes, meetings, discussions, emails.....

Bots will be much better at most of that.

Thanks Sherlock, so is that the end for the human worker?

Maybe.... but not yet.

So, until we start serving robotic overloads, let's prepare and control what we can.

These are 5 things I'll immediately do to mitigate job risk.

1. Get better at your work

Thanks, Captain Obvious.
You are welcome, but I made Major.

The people who are most worried are probably the ones with the most areas to improve...so if there was a time to buck up, its now.

Say yes more than no.
Spend that extra hour.
Put in that additional effort.
Put yr hand up for that project.
Capture your achievements.
Socialize the wins w teams.
Help other teams win.


2. Restart your network

Your Rolodex is creaky, I know, but it is time to revisit.

It will be awkward at the start, but keep at it.
Better now than when you "need" a job.

Pro Tip: Be genuinely interested in them

Your older connections are easier to rekindle than establishing new ones. 


3. Build your profile

Refresh and improve your LinkedIn profile + professional portfolio.

It's 2026, we go to your profile and website if we want to get a good sense of who you are.

How are you showing up?
• old dated profile pic
• high school quality about section
• boring as f experience description

Or are you invisible?
Makes sense if you are James Bond.


4. Grow your network

Do some research. 

Who are your peers?
Who is in your dream role?
Which are the interesting companies?

Some of the folks who reported to you may now be execs.

Don't wait till your need a network to build one.

The earlier you start the better.

What are you waiting for? The HR Call?



5. Think like an owner

This is the future of the worker.
Gone are the days of 40 year old career.
My mom celebrates 45 years at 1 company soon!

If you think like an owner, you stop waiting for permission.

You start taking action, owning the risks, and keep going.

What is one thing you think will change when there is this mindset shift from employee to "owner worker"?

🔹Data Privacy Consultant | Fractional Chief Privacy Officer | General Counsel 🔹Executive Coach 🔸Founder of Live on Purpose (non-profit)

MNC Experience | Data Privacy Leadership | Executive Coaching | Entrepreneurial Mindset

As the Founder and Principal Consultant at NorthStar Data Privacy, my focus is on steering organizations through the complex landscape of data privacy. 

During my tenure as Chief Privacy Officer at International SOS, I built the Global Privacy Team and helmed the implementation of robust privacy frameworks globally in 90 countries, including the EU, the US, Asia Pacific, Africa, the Middle East and China. 

I am passionate about helping my clients with practical, innovative solutions in data privacy matters.  

My background and strengths:

•	Dual Singapore and UK-qualified lawyer with 20+ years experience in MNCs  

•	Extensive Singapore top law firm and in-house experience: Wong Partnership, Rajah & Tann, Keppel Corporation, Hilton Hotels Corporation, and International SOS

•	Bilingual (English and Mandarin)

•	Founding member of Asia DPO, a group of data privacy officers - created by DPOs, for DPOs.

I love a good problem-solving challenge and am tenacious about delivering clear, practical solutions. Technology in the legal field is a big passion of mine, and I’m learning as much as I can about AI and the latest innovations.

Lorraine Lee, CIPP/E

"What if I get retrenched because my manager thinks I have too much free time (to post on LinkedIn)?"

Well, I know people who were retrenched - they were working weekends and up to 3 AM the night before. 

Yup, that's right. 
The Grim Reaper does not know (or care) about that. 

When your time is up, you don't get "time off in lieu".

On the other hand... 

What if you do get retrenched, and you haven't built a personal brand for yourself? 

💡 

You're right to be cautious. 

As an employee, posting on LinkedIn is not as "free" as an entrepreneur. 

I know because I've navigated MNCs for decades before stepping off to run my own ship.

There’s an artful way to do it. Would you like to find out?

✨ GOOD NEWS! I am partnering with the SCCA - Singapore Corporate Counsel Association to bring you a 3-part series:

𝐅𝐮𝐥𝐥 𝐏𝐫𝐨𝐠𝐫𝐚𝐦𝐦𝐞 𝐎𝐯𝐞𝐫𝐯𝐢𝐞𝐰:
📅 [Webinar] Personal Branding: Why Your Voice Matters - 23 January 2026

📅 [Webinar] Making LinkedIn Work for In-House Counsel - 30 January 2026

📅 [In-Person Workshop] Personal Branding & Networking in Action - 6 March 2026

JOIN ME: 
- I will share my own mistakes (so you don't make them too)
- I will share how to navigate your organisation 
- You don't have to post every day, I promise! 

Starting 23 January! Only a few seats left! 

Guess who’s the guest speaker for the Fireside Chat on 6 March?

(Click the link in comments to find out)

📢 FREE IAPP CONFERENCE PASS - CALLING ALL STUDENTS!

Are you interested in AI governance, privacy, cybersecurity law or digital responsibility?  

If you're looking to kickstart your future career in 2026, the IAPP wants you to attend one of their conferences and meet current professionals in these fields - for FREE.   

IAPP events offer the opportunity to hear from leaders in the field as you map out your future careers in digital responsibility. Apply for a complimentary pass to the first two IAPP conferences of the year below: 

🟩 IAPP UK Intensive in London (February 25-26):  https://bit.ly/3YC20Cd 

🟩 IAPP Global Summit in Washington, D.C. (March 30 31): https://bit.ly/45ciViv 

🟩 IAPP Canada Symposium in Toronto (May 4-6):  https://bit.ly/4qoi3jp   

The IAPP has also partnered with Airbnb, in memory of late Airbnb Chief Privacy Officer Brendon Lynch,  to offer a limited number of scholarships and travel stipends to attend the IAPP Global Summit in Washington.  

Apply for the Airbnb scholarship: https://bit.ly/3YIaDuZ  

Applications will be reviewed on a rolling basis beginning at the end of January – apply today! 

For more information, contact academic@iapp.org.  

#IAPP

What does geopolitics have to do with data privacy? 

When geopolitics escalate overnight, your cross-border data doesn’t get a grace period.

- We witnessed that over the weekend. 

- Imagine the oil in Venezuela is your data. Stuck. Gone.

- Now imagine that it happened in a country you transfer data to? Or from? Or through?

✳️ At NorthStar Data Privacy, this is exactly the lens we work from:

Helping organisations design cross-border data strategies that hold up when the world doesn’t.

👉 Is your data privacy strategy built for volatility?

***

In happier news, it was a pleasure to meet with the 2026 IAPP  KnowledgeNet co-chairs at Raffles Place: Mike Leow Sabrina Loi 雷欣棋 洁. Veronica T. Priyanka Sinha (see you next time, Puneet Matai, Dr. Hc). 

I'm looking forward to supporting data privacy conversations as IAPP Country Leader, Singapore 🇸🇬

Something magical happens when friendships last long enough for the kids to become friends too. 

I had my Uni besties over on New Year’s Day. 

The best part?

💠 They invited themselves

💠 All the spouses could make it

💠 All 7 kids (17-26) wanted to come AND they enjoyed yapping and hanging out with each other. 

One of the kids took an early morning shift at Starbucks (double pay on public holidays!) so she could come 🥹

Our hearts and stomachs were full.
Life is good. 

Then someone thought it would be funny to put our group photo through ChatGPT 🤦🏻‍♀️

PS. We were organised by height. Can you guess which one is Fabrice Desmarescaux?

Happy Sunday, folks!

taplio

The Battle

Lester Chng

Lorraine Lee, CIPP/E

Followers

Posts

Engagements

Likes

Performance ScoreLester Chng's LinkedIn Performance

Performance ScoreLorraine Lee, CIPP/E's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Lester Chng

Lorraine Lee, CIPP/E

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Lester Chng's LinkedIn Performance

Performance ScoreLorraine Lee, CIPP/E's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreLester Chng's LinkedIn Performance