I was the second engineer at a virtual insurer in Hong Kong. That number sounds more impressive than it was — it mostly meant I owned everything nobody else had time for. The first few years were the unglamorous half of a startup: CI/CD, zero-trust networking, device management, the on-call rotation, the SSO integration that breaks at 2am. None of it demos well. All of it is why the company still runs.

Today I lead the security and IT function, and I spend most of my time on the internal AI platform — the MCP servers, connectors, and guardrails that let an agent reach our data warehouse, our ticketing system, and our internal APIs without also being able to drop a table or deploy to production. The framing I keep coming back to is not “how do we adopt AI.” It’s: make the safe path the fastest path, then watch where people actually go. Usage tells you more than any policy document.

A few things I believe more strongly than I did three years ago

Domain experts build better internal tools than engineers do

They know exactly which twenty seconds of the workflow hurt, because they live in it. Engineers guess. Give a non-engineer a platform, a guardrail, and permission to make something ugly, and they’ll out-ship the backlog on the problems that actually annoy people. My favourite outcomes at work aren’t things I built. They’re the tools someone else built after I stopped explaining and started unblocking.

The constraint is ownership, not speed

Most things that stall in an organisation aren’t technically hard. They’re just unowned. Two teams each assume it’s the other’s, and it sits there for a quarter. So the default move is to pick it up — claim it, ship something, and hand it off once it has a shape someone can inherit. Waiting for a mandate is how work dies quietly.

Guardrails beat gates

Security that blocks work gets routed around, usually into a personal account where you can’t see it at all. I’d rather build the paved road: the sanctioned thing that is also the convenient thing. In a regulated business this is the whole game — the answer is rarely “no,” it’s “yes, through here, and here’s why the fence is where it is.”

Taste transfers; syntax doesn’t

Hard skills have never been cheaper. What’s scarce is knowing which problem is worth solving, when a prototype is good enough, and when a shortcut is the kind you’ll pay for later. So when I work with people, I try to think out loud — not to teach a tool, but to make my reasoning inspectable enough that they can disagree with it.

Make the reasoning public

Internal bots that answer in public channels teach the whole room, not one person. Same reason I’d rather be challenged in the open than agreed with privately. The audit trail is a side benefit; the real value is everyone getting to see how a decision got made.

Still hands-on

I still merge PRs. I don’t trust an opinion I can’t reproduce, and I’ve found that leaders who stop touching the system slowly start optimising for the version of it that lived in their head three years ago.

Currently interested in: agent harnesses, why every company rebuilds the same Slack bot, and how long “human in the loop” survives contact with volume.

Most of what I’ve built is invisible when it’s working. That’s the point.

Before this

I read Actuarial Science at HKU (BSc, 1st class honours) and did interest rate modelling for my final year project, then spent the early years at a small startup turning into a data scientist by necessity — scraping, dashboards in d3.js, weekly machine learning tournaments on Numer.ai, and a rule-based horse racing model built off my own HKJC scraper that made just enough money to be suspicious of itself. The maths came first, the infrastructure came later, and the AI work is where both finally pay off.

Four AWS certifications from that transition, all still on the wall:

  • Developer – Associate (Apr 2018)
  • SysOps Administrator – Associate (Apr 2018)
  • DevOps Engineer – Professional (Feb 2019)
  • Security – Specialty (May 2019)

I also build in the open when I can — for example bedrock-access-gateway-function-url, an OpenAI-compatible gateway for Amazon Bedrock.

For the job history proper, see my LinkedIn. I don’t like to mix my personal stuff with companies’ stuff.

AWS Community Builder

I’ve given a few talks at AWS events, and in 2022 I joined the AWS Community Builders programme. These days I contribute to the AWS community in Hong Kong and write on https://dev.to.

Personal

Based in Hong Kong. Cantonese and English, usually in the same sentence. Outside work I break my own hardware, run more compute at home than is defensible, and read release notes for fun.

I know Japanese though I only took JLPT N4… After that I studied in Sophia University (Tokyo) for two months for Japanese Language & Culture courses. And then, I travelled around Japan’s coasts for 5 weeks, with a pair of 21 days + 14 days JR Passes. Do approach me if you got your crazy plan on travelling in Japan with JR, I might help you!

Seichimeguri (聖地巡礼)

I have a habit of visiting real-world locations that appear in anime — what Japanese fans call seichimeguri (聖地巡礼). This has taken me to Fukui (Glasslip, 2014), Numazu (Love Live Sunshine), Uji (Hibike! Euphonium), Takayama (Hyouka), London (K-on! Movie), and Italy (Love Live Sunshine!! Over the Rainbow).

Aqours (2016–2020)

From 2016 to 2020, most of my non-work passion went into Aqours — the second-generation group from Love Live! Sunshine!!. I attended every major live concert, made multiple pilgrimages to their fictional hometown in Numazu, Shizuoka, and even flew to New York for an event. The chapter ended in February 2020 — CYaRon!’s first live in Fukuoka was my last in-person concert before COVID.

The two quotes I live by both trace back to this era: 日々精進 (daily improvement) from voice actress Inami Anju, and 一期一会 (once-in-a-lifetime encounter) from Aida Rikako. They stuck.

How I got here

My security-first mindset traces back to 18 years as an altar server — liturgical precision means every step matters. My builder instinct comes from LEGO and origami since childhood. My actuarial training gave me the math. Somehow all of this converged into a DevSecOps engineer at an insurtech company.

Favourite Quotes

  • 日々精進
  • 一期一会
  • Get the shit done. If you got OCD and want to do things better, do it on your own but please do not make others suffer with you just because of your OCD.