Six months ago, I would not have guessed that a diaspora program would lead me straight into the security architecture of one of Mongolia's largest banks. Through IOM and YouthInc's Mongol Diaspora project, in partnership with Khan Bank, I was selected as a Cybersecurity intern — and placed on the PCI DSS Compliance team.
What is the Mongol Diaspora project?
The Mongol Diaspora project, run by YouthInc, connects young Mongolian professionals and students — including those studying abroad — with leading companies back home for real, hands-on internship experience. Khan Bank is one of the partner organizations, and I applied hoping to combine my computer science background with practical exposure to how a real financial institution protects its systems.
Life on the PCI DSS Compliance team
PCI DSS (Payment Card Industry Data Security Standard) is the global standard that governs how banks and payment processors protect cardholder data. My work centered on Requirements 1 and 2 of PCI DSS v4.0.1 — the requirements focused on network security controls and secure system configuration.
In practice, this meant learning how a bank's network is divided into security zones, how traffic between those zones is controlled, and how modern tools like network microsegmentation, firewall rule reviews, and container-level network policies work together to keep sensitive systems isolated. I also got a first look at how a web application firewall fits into the bigger picture of protecting customer-facing services.
I want to be clear that the specific technical findings from my internship are internal to Khan Bank, so I won't go into detail here — but the conceptual learning was enormous. Concepts I had only read about in textbooks — zero-trust principles, defense in depth, least-privilege access — suddenly had a real, physical shape: actual rule tables, actual network diagrams, actual trade-offs between security and usability.
The moment it clicked
The moment that stood out most was preparing a short video presentation with my team, where each of us explained a piece of our work in three minutes. Framing my technical findings as a story — almost like a detective walking through clues — forced me to translate dense compliance language into something a non-technical audience could actually follow. That skill, translating complexity into clarity, turned out to be just as important as the technical work itself.
What this internship gave me
Beyond the technical exposure, this experience sharpened how I think about security as a discipline: it's not just about writing correct configurations, it's about designing systems that are resilient, auditable, and understandable to the people who have to maintain them. As I prepare my graduate school applications, this internship gave me something no classroom could: a sense of what it actually feels like to protect real infrastructure, under real constraints.
Thank you
I'm grateful to my mentor, Ochirbat, and the entire PCI DSS Compliance team at Khan Bank for their patience and guidance, and to IOM and YouthInc for building the bridge that made this opportunity possible through the Mongol Diaspora project.
If you're a student curious about cybersecurity or considering the Mongol Diaspora program, feel free to reach out — I'm happy to share more about the experience.