Monica Zhu

from Women In Security Magazine Issue 10

Lessons from the AWSN Leader Forums

Cyber Security Incident Responder & Threat Intel Manager at Qantas Always follow your heart, your passions and do not let anyone define who you are and tell you what you can or cannot achieve. Always take on challenges, overcome obstacles, intimidations, fears and hold fast. To dream and to dream big. We are all on the journey, and I found this journey to be most satisfying and it’s a life worth living.

Cloud computing today is ubiquitous. According to one recent report 94 percent of enterprises use cloud services, 67 percent of enterprise infrastructure is cloud-based and 92 percent of businesses have a multi-cloud strategy in place or in the works.

And of course, security concerns are paramount: much of this data is business critical and highly sensitive. There is a global body, the Cloud Security Alliance “dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.”

So rapid has been the rise of cloud it is difficult to realise just how recent all these developments are, but it’s something Monica Zhu knows only too well. She was in the last year of a master’s degree in Forensics Information Technology at Auckland University of Technology (AUT) and needing to complete a substantial research project.

“Cloud computing was a new technology back in 2010 and due to privacy concerns most people held negative views with only a few people seeing its potential. My supervisor was a visionary man and he supported me to complete a research paper on cloud computing,” she recalls.

“He was a great mentor and a very inspiring gentleman [but] I could only find two papers in the entire portals of reputable academic literacy on the topic at the time, so my entire thesis had to be built on industrial papers.”

RISKY RESEARCH

She was warned against embarking on a research venture into such unexplored territory. “Before I started researching this topic, I was told about its risks and the likelihood of not being able to finish my master’s by the majority of my classmates, lecturers and even my thesis supervisor due to the challenges and complexities it presented.

However, Zhu was not to be deterred. “I like to challenge myself, so I picked a hard and exciting road and chose mobile cloud computing forensics. I knew if I was able to complete this, it would be ground-breaking research that would serve as a cornerstone for anyone wanting to extend their research later.

“I remember sitting my parents down and telling them I would pursue this topic, but that there was a possibility I may fail miserably and not even get my degree.”

Her gamble paid off. “Everything fell into place. I was able to find and meet like-minded people in the industry who were willing to help me.” I ended up graduating with first-class honours and my research helped me land my first cybersecurity job in Sydney as a forensic analyst with Deloitte. Because I did well in all my course work, I proved to myself and anyone who had discouraged me that with diligence and the desire to learn, I had what it took to succeed.”

It was not the first time others had tried to divert Zhu from her chosen field of study. She transitioned to her AUT master’s course from a University of Auckland Bachelor of Science Computer and Information Sciences course, where her professor poured cold water on her plans to enrol in a master’s course. “I thought he would be very excited and would encourage me. He thought I was too young, and that a master’s degree was designed for people who already had years of experience in the security industry. So, he discouraged me from enrolling. I felt shaken and heartbroken, but although I was discouraged and intimidated, I did not let it hold me back.

HER BEST DECISION

“I knew this was what I always wanted and something I had been waiting for, so in the end my passion overcame my fear, and I went ahead and applied for the degree. I was able to enrol for the upcoming semester before finishing my bachelor’s degree. I was the youngest student and the only female in my class. Upon reflection, this is probably one of the best decisions I have ever made in my life: following my heart and passion.” And she certainly confounded those who had discouraged her. “The Master’s degree was a two-year course; the first year we needed to take eight courses to fulfil the credits. Through these courses, I was able to learn the aspects of cybersecurity and forensics.

That was the start of Zhu’s journey into cybersecurity, a journey that has taken her to her current position as Incident Response and Threat Intelligence Manager with Qantas. “People who spoke words of discouragement and said I did not have what it takes, for me, created moments to grow resilience, to be rooted in self‑worth, overcome obstacles and achieve breakthroughs.” “I would really like to thank Qantas and my manager for offering me the role. They believed in me and gave me the opportunity to learn and grow, even when I had no prior background in incident response. Since then I have led a team to resolve cyber issues, designed and implemented security protection during incidents to contain the situation and help the business to remediate the root cause so it operates seamlessly and delivers for our customers. “Today I am the first point of escalation within the Group Security Operations Centre where I perform analysis and configure various security platforms, create, review, approve and publish customer-facing reports on threat intelligence, operational metrics, and/or service performance, manage high-profile security incidents and investigations across the enterprise and supplier landscape and assess and take action based on intelligence relating to Qantas’ IT landscape.

“My role is very broad, and no two days are the same. One day I’ll be responding to a potential incident, the next I will be leading a forensic investigation across different business functions, performing a threat hunting exercise or reversing malware to derive threat intelligence. This role has a very high demand on my technical knowledge, interpersonal skills, co-ordination skills and the ability to communicate effectively to a broad audience ranging from developers to senior management.”

TALENTED TEAM MEMBERS WANTED

She has also recently taken responsibility for the cyber testing function within Qantas, shaping and managing all penetration testing engagements, ensuring secure code development across the group and looking for staff. “I’d like to hire passionate and like-minded individuals and build a talented team to help achieve the best business outcomes and improve the application security posture for Qantas.”

Zhu developed her interest in cybersecurity following an early encounter with its dark side. “I was very fortunate to be able to find my passion at an early age and make a career of it,” she says. “When I was 14 years old, my first laptop was infected by malware. I was so devastated that I swore I was going to catch all the cyber criminals.

“Today, even though I am not physically catching cyber criminals, I am still helping the business to resist cyber-attacks by quickly identifying an attack, minimising its effects, containing damage, and remediating the cause to reduce the risk of future incidents.”

That teenage passion led Zhu to her bachelor’s degree course in computer science at the University of Auckland. “At that time, there were only a limited number of security courses to pick from, so I did them all. However, it did not take long for me to realise that university is not the place where they teach you how to hack. (Things are very different now).” She recommends such a degree as a foundation for anyone contemplating a career in cybersecurity because it provides training in the fundamentals of computer systems and programming languages, and more. “It teaches you about problem solving, teamwork and critical thinking skills. With a good foundation, it’s a lot easier to branch into specialised areas such as digital forensics, incident response, penetration testing and application security.”

While studying for her bachelor’s Zhu was selected to gain real-world work experience in an industry placement program, developing commercial software, but realised software development was not for her. With, she says, her “dream of catching cybercriminals still burning fiercely within me,” she found the master’s degree in Forensics Information Technology.

POSITIVE EFFECTS OF NEGATIVE FEEDBACK

She says she could never have got to where she is without the “help, mentorship, protection, and encouragement of many influential people throughout my career journey.”

Paradoxically, in a list that embraces managers past and present, colleagues, mentors and parents, she includes the naysayers, “People who speak words of discouragement and say that you do not have what it takes.” For Zhu these were “moments to grow resilience and be rooted in self-worth, and opportunities to overcome obstacles and achieve breakthroughs.”

www.linkedin.com/in/monica-zhu-a320432a