Emma Fang Almost Left Tech. Instead, She Became a Champion for Women in Cybersecurity

Emma Fang Almost Left Tech. Instead, She Became a Champion for Women in Cybersecurity

Retaining women in cybersecurity is just as critical as recruiting them, and keeping that talent often comes down to finding the right mentorship. When Emma Fang landed her first cybersecurity job as a penetration tester, she nearly walked away from the field. “I struggled a lot,” she says. “There were moments I almost quit tech entirely. I felt out of place, I doubted my skills and I had no one to turn to for guidance. A mentor at that time could have made it so much easier.”

She didn’t leave. Instead, Emma built an exceptional career, joining EPAM nearly three years ago. On client projects, she’s a Senior Cloud Security Architect leading security design for a hybrid cloud program in financial services. Internally, she’s also the Security Delivery Lead for UK&I (Western Europe), growing and managing a team of security engineers and architects across the UK, Ireland, Germany and Switzerland. This year, that career earned her Security Woman of the Year at the 2026 Security Excellence Awards and a highly commended award for Cybersecurity Advocate of the Year.

Ask her why she got into cybersecurity in the first place, and the answer is refreshingly ordinary. “To be honest, it’s not because I wanted to change the world,” she says. “It wasn’t some big cause. I just really enjoyed cryptography, which is directly linked to a lot of the controls in cybersecurity. That’s how I got into the field.” She adds one more reason. “There were very few women in cyber at the time, and I felt like that could be a challenge for me. I’m an ambitious person, and I enjoy coming out of my comfort zone.”

From there, Emma earned her Bachelor of Computer Science and later a Master of Science in Information Security. Curiosity got her in the door. What kept her there was years of deliberate, sometimes uncomfortable work. She focused on building the community and confidence she wished she’d had at the start.

How to Build Community as a Woman in Cybersecurity?

Establishing a community as a woman in cybersecurity requires connection with peers over shared experiences and challenges, engaging with global diversity organizations and building networks that promote inclusive security cultures.

That commitment to community and professional networking is at the core of Emma's work outside the office. Since 2023, she has volunteered with Women in CyberSecurity (WiCyS) UK & Ireland, running member events, speaking engagements and training programs. For the past two years, she has also mentored nearly a dozen women through WiCyS’s global professional mentorship program.

“As I’ve grown more senior and spent several years as a security architect, I’ve felt an increasing responsibility to give back to the community,” Emma says. “I want to share my experience with younger generations and aspiring cybersecurity professionals, so being a role model and leading by example is important to me.”

One moment has stayed with her. “A mentee told me that I influenced her and gave her reasons not to give up on a cybersecurity career,” she says. “The job market in this field has become extremely competitive, and even in the age of AI, demand isn’t keeping up with supply, especially for entry-level roles. Hearing that reminded me why this work matters.”

Within EPAM, Emma also draws on Women at EPAM, the company’s internal community for women in tech. “Women at EPAM and external communities like WiCyS are very different, not just in field, but in audience, purpose and engagement,” she says. “Women at EPAM has been a valuable space for learning from women in situations similar to mine. We work in a technology consulting environment that is still strongly unbalanced, and we support each other in navigating it and thriving in our roles.”

That outside work feeds directly back into her own team at EPAM, too. “By being present in the community, I can promote EPAM’s brand in the job market, which encourages applications from underrepresented groups,” she says. This year, her team grew by 50 percent and added three women; before that, she was the only woman. “I’m very proud of that, because in the past we couldn’t even get women to apply for our roles.”

She ties that back to how she defines security culture day to day — a growth mindset, accepting each other’s differences and staying open to new ideas. “That is how we encourage creativity and innovation in security and deliver better solutions for our clients,” she says. “It also means building a diverse team, so that different voices are heard and different ideas are considered.”

How Is Agentic AI Changing Cloud Security?

Agentic AI is changing cloud security by introducing non-deterministic, autonomous behaviors, rendering traditional baseline detection obsolete. This change requires teams to monitor agent decision-making alongside standard infrastructure logs.

Securing cloud environments built on agentic AI starts with the same fundamentals as any cloud security program, says Emma. Least privilege, strong identity and access control, data protection and continuous monitoring, plus clear limits on what autonomous agents can access, do and decide without a human checking in.

In her day-to-day role, Emma spends time securing cloud environments that increasingly used to run agentic AI. “Visibility and monitoring are the most underestimated areas of cloud-native security,” she says. “Workloads are distributed across multiple clouds and are often ephemeral, spinning up and disappearing in minutes, so it’s easy to lose track of what is running, where and what it is doing.”

Agentic AI makes that harder, not easier. “Agentic AI is non-deterministic: given the same input, an agent may take a different path each time, choosing different tools, making different calls and chaining actions in ways nobody explicitly programmed,” she says. “Traditional detection relies on known patterns and a stable baseline of normal behavior, and with agents, that baseline is much harder to define. Malicious behavior, such as an agent hijacked through prompt injection, can look very similar to legitimate activity.”

Her fix starts with what security teams watch in the first place. “Visibility needs to go beyond infrastructure logs,” she says. “We also need insight into what agents are doing, which tools and data they access and why.”

Her advice to mentees navigating that shift is notably unflashy. “There is nothing magical about agentic AI,” she says. “The security principles remain the same as those we apply to cloud and application environments. What changes is that you need to understand how these systems work and behave.” Her advice from there is practical — upskill in AI while continuing to strengthen core security fundamentals.

“There is also the flip side — AI for security,” she says. “Attackers are already using AI to move faster, so we need to learn how to respond to AI-driven threats and keep pace, including by applying agentic AI to speed up detection and response.” She adds one more note, “AI can be a real productivity booster. Used smartly, with integrity and honesty, it can help you do your best work.”

The bigger question she wants people asking, though, cuts to where the field is heading. “Who governs the governor?” she asks. “When the tools we rely on to oversee and protect our environments are themselves powered by autonomous, non-deterministic agents, we can’t simply assume they will behave as intended. We need to establish clear trust boundaries: limit what they can access and do, keep humans accountable for critical decisions and monitor them like any other privileged identity. Otherwise, they may go rogue.”

What Is the Best Career Advice for Aspiring Cybersecurity Professionals?

To succeed in a cybersecurity career, professionals must overcome the hesitation to apply for stretch roles and recognize that hands-on experience, resilience and a growth mindset drive long-term success.

Overcoming that hesitation is central to Emma’s advice for anyone looking to advance in tech leadership. “We often hesitate to apply for a role unless we meet 100 percent of the criteria,” she says. “My advice is to grab the opportunity anyway. If you meet even half of it, apply.”

That willingness to step forward is ultimately what led to her recognition as Security Woman of the Year. But what the award means to her, in the end, isn’t really about her. “Winning this award strengthened my own career brand, and the EPAM brand,” she says. “It tells a story: if I can win this award, anyone who is talented and hardworking in security can. I hope that encourages others to keep pursuing this career path, especially those who have been thinking of giving up.”

Ready to build a cybersecurity career like Emma’s? Explore open roles at epam.com/careers.