Max Couling

Ernst & Young (EY) | Cybersecurity Consultant — Client Secondment, Cyber Risk & Compliance

Mar 2025 - Present

• Client commendation: Perfect 10/10 client satisfaction score (ASQ) from Fonterra, alongside a Partner-level commendation for contribution, professionalism and responsiveness.
• Risk assessment authoring: Authored formal cybersecurity assessments reviewed by the Head of GRC and approved by the CISO — covering SAP vulnerability management, EOL/IAM servers, guest identity lifecycles, F5 BIG-IP patching, domain/DNS security, and LIMS laboratory environments.
• Identity governance: Led a Microsoft Entra ID guest-account risk assessment; identified a critical control gap across ~57,000 guest accounts and designed RBAC-aligned lifecycle remediation with a pathway to ongoing access reviews.
• Exception governance overhaul: Identified 9 key deficiencies across process, tooling, ownership and architecture; authored new Exception Guidance with time-bound limits and mandatory escalation to formal risk acceptance when no remediation path exists.
• Firewall policy & exposure reduction: Managed and triaged ~30 firewall policy exemptions per month across QA/DEV/PROD; independently extracted and analysed the full historical dataset after the incoming CISO flagged volume as systemic, supporting a complete policy rewrite to reduce cross-domain exposure.
• AppSec operating model: Coordinated assessments triaging 50–1,000+ SAST/DAST/SCA findings per engagement; authored a Key Decision Document presented to the CISO recommending a phased shift from a hand-off-heavy managed service (2–5 week turnaround) to centralised scan execution, and led a multi-vendor AppSec evaluation.
• GRC automation: Designed and spearheaded a Microsoft Copilot Studio agent that validation-checks exception submissions against governance criteria (time-bound duration, named controls, mitigation availability) before human review.
• Audits & frameworks: Drove a zero-finding SWIFT CSP audit across 25 mandatory controls (verified through Dec 2026); processed 10+ concurrent NIST 800-53 risk assessments across IT, OT and third-party environments; delivered an RBNZ Cyber Resilience baseline engagement (NIST CSF 2.0) for an insurance client, with a gap assessment, remediation roadmap and C-suite workshops that secured increased security investment.

Ernst & Young (EY) | Intern Cybersecurity Consultant

Nov 2023 - Feb 2024

• Covered the Technical Business Analyst role for an enterprise SailPoint IdentityNow rollout.
• Executed UAT, validated least-privilege access controls, and coordinated deployment tracking across 22,000+ identities.

Exzel IT Consulting | Part-Time IT Specialist

Sep 2022 - Jun 2023

• On-site and remote support for small businesses and education centres: network troubleshooting, hardware repair, system configuration, secure data destruction.