Jihoon Gong
Building pragmatic information security frameworks in Cloud Native environments
About
Experienced information security professional across specialized firms, government agencies, financial institutions, e-commerce, and startups. Committed to building pragmatic security frameworks that consider service, operations, and development holistically.
Continuously researching AWS and Kubernetes security, aiming to become a leading Security Compliance Engineer.
As the sole security officer at a Series B startup with 300 employees operating an e-commerce platform in a Cloud Native environment, I prepared and achieved ISMS/27001/27701 initial audits from scratch without consulting — with particular strengths in building information security management systems tailored for AWS and Kubernetes.
Experience
Rapo Labs
Security Engineer
- Built and operated information security management system
- Implemented personal data protection regulatory measures
- Prepared and achieved ISMS initial audit certification
- AWS / EC2 vulnerability assessment
- Introduced and operated security solutions
Greenlabs
Security Engineer
- Built and operated information security management system
- Implemented personal data protection regulatory measures
- Prepared ISMS initial audit
KakaoBank
Manager
- Established big data utilization standards
- Third-party deployment verification
- Ledger change management
Financial Security Institute
Assistant Manager
- Open banking fintech security inspection
- Robo-advisor system security assessment
- Fintech new technology security evaluation
KISA
Researcher
- Security monitoring and malicious traffic detection for private enterprises
- Organized security operations council
- Dark web analysis
SK Infosec
Engineer
- Firewall (Cisco, Juniper) and IPS (IBM) deployment
- Incident troubleshooting
Portfolio
Overview
I have experience building an entire enterprise security framework from scratch — from achieving security certifications (ISMS/27001/27701) to establishing policies, compliance response, security solution deployment, and automation — and embedding it as organizational culture. Through a pragmatic approach and communication-based collaboration, I designed security to be a foundation for growth rather than an obstacle.
Key Achievements
ISMS / 27001 / 27701 Initial Audit Preparation & Certification
- Achieved ISMS initial certification within 15 months as sole security officer
- Passed with only 6 minor findings; received MSIT Information Security Commendation
- All certifications obtained independently without external consulting
Information Security Policy Development & Operations
- Established and applied 17 information security policies and guidelines company-wide
- Built AWS IAM permission matrix and management framework
- Enhanced security posture and employee satisfaction through pragmatic policy design
Compliance Response
- Met legal requirements while maintaining service conversion funnels
- Resolved ICT Network Act violation with zero penalties and built prevention systems
- Derived practical improvements through regulatory authority consultations
Service Security Review Systematization
- Established pre-deployment security review process for features and infrastructure changes
- Cultivated a culture where POs and engineers proactively consult the security team
- Built security checklists based on compliance standards, CIS benchmarks, and CSP best practices
Security Compliance Engineering
- Built zero-trust architecture using GWS and Keycloak
- Built automated system access block/unblock for non-compliant endpoints
- Automated onboarding/offboarding security workflows using Python
Cloud & Infrastructure Vulnerability Management
- Managed AWS vulnerabilities via Prowler and Security Hub
- Automated vulnerability scanning and remediation across hundreds of EC2 instances using SSM Run Command
- Built cloud security monitoring system using Cloud Custodian
Security Tool Development with Open Source & Vibe Coding
- Managed GitHub secret leaks using TruffleHog
- Self-developed compliance tools leveraging AI
- AWS Security Group Review Dashboard
- GWS Spam Email Cleanup Tool
- AWS Security Vulnerability Scanner for ISMS Compliance
- GitHub Org & Member Public Repo Scanner
- Google Sheets Sharing & Access Permission Scanner/Remediation Tool
Core Competencies
Speaking & Community
Talks & Lectures
How a Solo Startup Security Officer Builds ISMS with Minimal Cost & Maximum Efficiency
Security Compliance Engineer: Real-World Startup Security Certification
How to Successfully Achieve ISMS Certification Using Open Source in Cloud Native Environments
Web Hacking Theory & Hands-on Lecture
Challenge Design & Competition Management
Network Security Theory Lecture
Packet Analysis Know-How Presentation
Community
AWSKRUG Security Meetup
Organizer
KITRI White Hat School
Mentor
Certified
Certifications
ISMS-P Auditor
KISA
Information Security Engineer
HRD Korea
IT Security Product Evaluator
KISA
CPPG (Certified Privacy Protection General)
Korea CPO Forum
CISSP Associate
(ISC)²
Kubestronaut
CNCF
Kubernetes and Cloud Native Security Associate
CNCF
Kubernetes and Cloud Native Associate
CNCF
Certified Kubernetes Security Specialist
CNCF
Certified Kubernetes Application Developer
CNCF
Certified Kubernetes Administrator
CNCF
AWS Certified Solutions Architect Associate
Amazon Web Services
Information Processing Engineer
HRD Korea
CCNA
Cisco
Awards
Information Security Merit Award
Ministry of Science and ICT
White Hat School Appreciation Award
KITRI
Army Cyber Defense Competition Excellence Award
ROK Army HQ
Best of the Best 3rd Cohort — Top 30
KITRI