Bridging technical delivery with risk, governance, and regulatory requirements — translating strategy into standards, architectures, and roadmaps.
Passionate information security professional with a broad and deep technical background, built over decades of hands-on experience across diverse environments and roles. Brings genuine enthusiasm to the field and explains complex security topics in accessible, practical terms — to engineers and board members alike.
A natural integrator who brings together regulatory obligations, privacy principles, industry standards, and business objectives into coherent, complete, and operationally effective security programs — whether shaping a single project or building an organisation-wide InfoSec program.
Actively follows emerging trends and quickly adopts new technologies, applying AI tooling effectively and responsibly to accelerate security work. Equally comfortable in technical deep-dives and strategic conversations — consistently focused on enabling the business rather than blocking it. Known for pragmatic, outcome-focused programs that are not just compliant, but efficient and fit for purpose.
Ranked by engagement frequency across clients. These reflect where demand has been strongest — not the boundaries of expertise.
| # | Domain | Scope | Roles |
|---|---|---|---|
| 01 | Governance, Policy & Frameworks | Control frameworks (ISO, NIST, CIS, ISF), policy lifecycle, control mapping & validation, governance structures | CISOTISO |
| 02 | AI Security & Governance | AI risk frameworks, EU AI Act alignment, securing AI systems and pipelines, AI threat modeling, responsible AI governance | ESACISOAdvisor |
| 03 | Privacy & Data Protection | GDPR compliance programs, privacy-by-design, DPIA, international data governance, integration with security architecture and regulatory frameworks | TISOCISOESA |
| 04 | Regulatory & Compliance | DORA, NIS2, PCI DSS, GDPR: gap analysis, obligation mapping, remediation roadmaps | CISOTISO |
| 05 | Zero Trust & Identity | Zero Trust strategy, ZTA, IAM/PAM, CASB/MCAS, Conditional Access, identity-first patterns | ESASSA |
| 06 | Supplier / Third-Party Assurance | TPRM, supplier clauses, SOC/ISAE/ISO evidence review, assurance findings management | TISOCISO |
| 07 | DevSecOps & Secure SDLC | Secure SDLC, CI/CD controls (SAST/DAST/SCA), code review governance, pipeline hardening | SSATISO |
| 08 | Security Architecture & Design | Target-state architectures, reference patterns, security-by-design, architectural decision records, design reviews | ESASSA |
| 09 | Risk & Decision Support | Decision papers, options analysis, risk trade-offs, executive advisory, risk acceptance governance | CISOESA |
| 10 | Network Security & SASE | SASE adoption, SD-WAN migration, segmentation, NDR, secure connectivity design | ESASSAAdvisor |
| 11 | SOC / SIEM / Detection | SIEM/SOAR build-out, logging standards, use-case lifecycle, MSSP onboarding, Blue Team strategy | SSAESA |
| 12 | Vulnerability Mgmt / CTEM | CTEM roadmaps, prioritisation models, remediation workflows, operating models & dashboarding | TISOESASSA |
| 13 | Applied AI & Security Tooling | Effective and responsible use of AI in security work; AI-assisted analysis, threat modeling, documentation and solution design; evaluating AI tool risk | ESAAdvisorCISO |
| 14 | Security Process Design & Optimisation | Mapping and improving security processes; troubleshooting complex security issues; designing pragmatic, efficient operating models across security domains | All roles |
Technologies, frameworks and tools encountered across engagements — used, evaluated or considered in solution design. Not an exhaustive list; reflects real project exposure.
Available for security architecture and advisory engagements — enterprise, regulated environments, and complex transformation programs.