Juan Pablo Luengas Restrepo – Progreso

When tremors began shaking Guatemala in November 1917, no one expected they’d continue through late January 1918—or change how the Central American nation is built.

But after Guatemala City was almost completely destroyed, it was rebuilt with cement that better withstood the rumblings and convulsions of tremors and earthquakes, and the work became a foundation for Progreso.

Progreso has helped Guatemalans build and rebuild and continued operations through the COVID-19 pandemic. However, like other companies, it remains under constant threat of cyberattacks that could cripple its operations or result in the loss of sensitive company and customer information.

Juan Pablo Luengas Restrepo | Technological Risk Coordinator and Chief Information Security Officer | Progreso

Since 2008, Juan Pablo Luengas Restrepo, Progreso’s technological risk manager and chief information security officer, has helped build and protect the company’s IT infrastructure as the company helps build Guatemala’s infrastructure.

It can be an unrelenting task, he says, but cybersecurity requires vigilance.

“The biggest challenge of my role is to generate awareness in users, because millions of dollars can be invested in last generation technology,” Luengas Restrepo says. “If people do not have the adequate education and awareness of the use of said level of technology, it is useless.”

Strong foundations

In 1899, Carlos Federico Novella Kleé founded Carlos F. Novella y Cia on a farm that’s since become part of Guatemala City. As the company grew into Cementos Progreso, it opened a second plant in 1974, now known as the San Miguel plant. The plant opened its third production line in 1998. As demand began outpacing supply, a third plant was built in 2013 and has operated as the San Gabriel plant since 2020.

In addition to supplying cement, the company provides sand, gravel, energy trading and packaging materials. Its Carlos F. Novella Foundation was established to improve the lives of people living near where the company operates. Foundation work includes assisting people finance, build and maintain homes, Luengas Restrepo says.

While he’s been leading IT initiatives since joining the company in 2008, he says the last year has amplified the need for cybersecurity to protect the company and customers. He’s got the expertise to provide it, but it’s a shared burden, he says.

“People are more aware because of the news about hacks and breaches around the world,” he says. “When I put the message in the company context, people can see anyone can be a target in the company.”

People are also increasingly vulnerable to cyberattacks at home that can breach their employers’ networks, he adds. As Luengas Restrepo explains, “from the IT perspective, it’s worse because people may feel safer at home, and they aren’t.”

He educates employees using the tools and training supplied by KnowBe4. With training modules and phishing tests part of its services, Luengas Restrepo says KnowBe4 provides both concise instruction and practical applications that build and reinforce cybersecurity.

KnowBe4 also emphasizes the hazards of social media posts hackers can use as a basis to enter a company’s systems. The results, built on training and monthly tests, have been great, he adds. Progreso employees report five to 15 phishing attempts per day to him.

Another shared effort in strengthening cyber defense comes by requiring Progreso departments to classify their information as part of automating processes.

Luengas Restrepo and Tigo/Widefense, a Guatemalan consulting company, are working together on the project. Work began in September 2020 as policies on the use of company information were revised. The automation is tailored to adhere to new policies and protect sensitive information. The project is scheduled to be finished in the first quarter of 2022, he says.

Progreso is already stricter about cybersecurity and data protection than required by Guatemalan laws, but Luengas Restrepo has higher standards in mind anyway.

“We can demonstrate that we are a company with high quality standards, and our customers can have confidence that their information is protected,” he says. “We can compete with anybody in the world.”

A passion, not a job

Growing up, Luengas Restrepo’s loved playing video games and doing things with his computer.

The career possibilities became more apparent as the native of Colombia was finishing high school and earned his degree in systems engineering from Universidad Galileo in 2006. He then earned his master’s degree in reliability analysis and management from the same university in 2008. While in graduate school, Luengas Restrepo was also head of processing for COEIMSA, a consulting company that performs market analysis studies.

In 2008, he joined Progreso as a database and application support engineer, recalling he began by helping the company implement its SAP enterprise resource planning platform. His responsibilities continued expanding as he analyzed applications and projects, and in November 2010 Luengas Restrepo became head of applications.

In 2013, he became the technological risk coordinator and CISO and in 2020, when Progreso made his role a managerial position, he was the obvious choice to lead it. That’s also when he was named technological risk manager/CISO.

“It’s like security on the street—you need to take care of yourself and make the people around you safer,” Luengas Restrepo says. “Everything I’ve done has been so enjoyable, it doesn’t feel like a job.

I’m always thinking about what I can do with that information or configuration or access and what could go wrong.”