If he is on a corporate device, he has a corporate-issued MITM certificate, which allow third party "security" companies to read, store and analyze his complete network traffic in plain text.