Edmond Song

AI & Automation

• Architected and developed a proof-of-concept AI audit assistant using local LLM and RAG architecture, enabling secure, on-device document analysis to reduce manual review time.
• Engineered intelligent AI agents to automate structured information extraction from unstructured documents, optimizing accuracy and processing speed for high-volume datasets.
• Developping RiskAssistant AI, an AI-driven tool for Risk, Compliance, and Audit professionals to enhance operational efficiency.

Strategic Advisory & GRC

• Advised as a strategic consultant on Cybersecurity, Risk Management, and IT Audit, guiding initiatives to automate and optimize existing business processes.

Management & Operational Excellence

• Managed and mentored three cross-border teams (32 members in France and Portugal) to promote operational efficiency and collaboration.
• Directed operational risk management for the 1LoD, ensuring robust threat identification and mitigation.
• Streamlined IT Service Management (ITSM) processes and optimized tool configurations to improve service delivery.

Risk Management & Governance

• Designed and deployed a group-wide risk management framework and taxonomy, establishing a standardized risk language.
• Led the development of an automated operational risk dashboard, leveraging quantitative analysis for real-time C-level insights.
• Cultivated a proactive risk-aware culture across the organization.

Internal Control, Audit & Reporting

• Engineered an Internal Control framework covering IT and cyber risks to systematically close control gaps.
• Reported critical risk metrics to C-level executives and the Managing Board.
• Managed high-stakes external audits as primary liaison with regulators and statutory auditors.

Audit Governance & Methodology

• Developed the annual IT audit plan based on risk assessment and mapping (risk-based approach).
• Authored comprehensive audit reports and advised as SME on follow-up of open issues and remediation plans.

Technical Audits & Risk Assessment

• Conducted technical audits in Cybersecurity, Cloud security, identity and access management (IAM), and incident/problem management.
• Assessed design and operating effectiveness of controls; identified and mapped IT-related risks for key stakeholders.

Risk & Internal Audit Governance

• Established and scaled Risk Management and Internal Audit departments, defining governance structures and methodologies (IIA standards).

Information Systems Security (ISS) Audit

• Executed high-impact IT security engagements globally: cyber risk assessment (ISO 27005, NIST 800-37), control environment audits (ISO 27001/27002), DLP reviews, ISSP alignment, CIS benchmark configuration analysis, and Red Team exercise supervision.

Third-Party Compliance (SOC)

• Led SOC 1 and SOC 2 (Type I & II) engagements for major banks and cloud providers.

Internal Controls & ITGC

• Reviewed IT General Controls (ITGC) and Entity Level Controls (ELC) for financial reporting compliance (SOX / LSF).

Forensic Investigation & OFAC Compliance

• Designed a scalable Big Data architecture to process hundreds of millions of SWIFT messages (dozens of terabytes), achieving 100% data coverage.
• Developed complex fuzzy-matching algorithms against OFAC sanctions lists with high precision, plus SWIFT parsing and transaction reconstruction modules.
• Implemented transaction linking and clustering, reducing manual case review time; built automated reporting protecting audit trail integrity.

Other Engagements

• Validated asset data quality for regulatory stress tests (ECB / EBA — Asset Quality Review).
• Analyzed IT business plans for M&A due diligence; designed and deployed an accounting information system (General Ledger and Reporting).

SOX Compliance & Internal Control

• Designed and tested the operating effectiveness of IT General Controls (ITGC) and application controls to ensure SOX compliance.
• Contributed to IT committees as SME for information security, risk management, and governance topics.