EY’s Maez de Guzman explores her career modernising the global cybersecurity space.

Maez de Guzman, a distinguished technologist and global cybersecurity managed services emerging markets leader at EY, has always had a deep curiosity about how things work, how they can be improved and how they are made more secure. 

With a background in business law and an appreciation for governance, risk and accountability, de Guzman found that a career in cybersecurity blended together all of those interests in what she referred to as a “meaningful way”. 

She explained to SiliconRepublic.com, “What first attracted me to cybersecurity was technology, but what kept me here was purpose.”

She said, “There were few formal learning paths in cybersecurity when I started, so much of my journey was self-driven. I would wake up at 3am to study before work and spend weekends teaching myself new technologies and security concepts. 

“That journey taught me that cybersecurity is ultimately a profession built on trust. The opportunity to protect organisations, people and critical systems continues to inspire me every day.”

Reportedly the Philippines’ first female certified CISO, a promoter of STEM education via university partnerships, and an author of children’s literature on cybersecurity and phishing, de Guzman is highly motivated by technology’s ability to “multiply human potential”. 

She explained, “Throughout my career, I have been drawn to technologies that remove complexity, accelerate decision-making and allow talented people to focus on higher-value work. 

“From being one of the early architects of security automation in APAC, I saw first-hand how automation could transform security operations – not by replacing people, but by empowering them to be faster, more effective and more impactful.”

She finds that AI is representative of the next stage of evolution within technology, which is bringing much excitement. She explained that society is entering an era in which machines have the power to process vast amounts of information, uncover patterns that are typically missed and respond to threats at unprecedented speeds.

“In cybersecurity, that is not just an advantage. It is a necessity. What makes this field endlessly fascinating is that it never stands still. Cybersecurity is an endless race between innovation and adversity,” De Guzman explained. 

“As attackers become more sophisticated, we are challenged to think differently, learn continuously and push the boundaries of what is possible. The combination of purpose, constant learning and the opportunity to make a real impact is what continues to motivate me every day.” 

Currently, de Guzman is leading the modernisation of EY’s global cybersecurity managed services platform, where much of her work involves re-inventing cyber operational decision-making. 

Her overall goal is to create a unified cyber operations ‘fabric’ that combines telemetry, identity, exposure, threat intelligence, attack-path analysis, case management and response orchestration into a “common decisioning layer”, all as a means of making security operations “increasingly predictive, adaptive and autonomous”. 

She said, “We have spent years engineering architectures optimised to collect, normalise and correlate ever-increasing volumes of security telemetry. Yet the critical relationships between an identity, an asset, a vulnerability, a control weakness, an active threat, and its business consequences often remain fragmented across different systems. 

“That’s why analysts are often solving a context-assembly problem before they can solve the security problem.” 

AI, she believes, can change this, but only if professionals learn to rethink the underlying architecture. 

“Adding AI on top of fragmented data and workflows simply makes the existing model faster. The bigger opportunity is to engineer a contextual intelligence layer that can reason across those relationships, continuously reassess risk as conditions change and determine the next best action, with appropriate human governance.”

De Guzman is of the opinion that the defining challenge of the next 10 years will not focus solely on detecting threats quickly – rather, it will be a commitment to scaling security decisions at a speed similar to the pace at which threats are evolving. 

“It requires a fundamental shift from detection-centric security to decision-centric security, where the measure of a cyber platform is no longer how much telemetry it can ingest or how many alerts it can generate, but how effectively it can transform context into decisions, and decisions into measurable risk reduction.”

The global cybersecurity landscape is at an inflection point, she finds – particularly as AI accelerates innovation and adversarial capabilities, in a space where interconnected technology ecosystems, third parties and rapidly changing attacks are creating non-traditional vulnerabilities.

As a result, professionals have to change how they think about resilience, which is no longer just about protection or how quickly you can recover after a breach or incident.

“We need to continuously understand where risk is accumulating across identities, assets and dependencies, validate whether controls remain effective, and respond at a speed much closer to that of the threat,” she said. 

“That becomes increasingly important as AI experimentation, third-party ecosystems and AI-enabled adversaries expand and accelerate the attack surface. 

“The differentiator will increasingly be an organisation’s ability to connect fragmented security signals, understand risk in context, and translate that understanding into trusted decisions and action at machine speed, while preserving human accountability.” 

Ultimately, de Guzman explained, cybersecurity has traditionally been built around protecting organisational boundaries, but those boundaries are no longer reflective of how technology, data and even risk are evolving in the modern era. 

“The next frontier is therefore not just better enterprise security, but engineering resilience across the ecosystem itself. As leaders, we have a shared responsibility to improve cybersecurity beyond the boundaries of our own organisations. Cyber resilience is increasingly an ecosystem challenge,” she said. 

“Addressing this requires greater collaboration across enterprises, technology providers, governments, academia and the broader security community. 

“We need to share knowledge more effectively, build security into emerging technologies, strengthen visibility across ecosystem dependencies and develop the talent capable of securing technologies that are evolving faster than traditional operating models.” 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.