Allegro Group
Security work inside one of Europe's largest e-commerce platforms, where the constraint is always scale: thousands of employees, a large engineering organisation, and controls that have to work without becoming a bottleneck. I joined as IT Security Specialist in July 2022, was promoted to Senior IT Security Specialist in April 2023, and left in November 2024.
Updated
Highlights
- Reduced shadow IT to near zero by providing sanctioned, monitored paths instead of blanket prohibitions.
- Wrote the group-wide AI usage policy and built a STRIDE-based threat modeling methodology adapted specifically for GenAI solutions — both are still in use, and this is the achievement I'm proudest of from my time at Allegro.
- Led the cloud security work stream and managed cloud security projects across the whole capital group, including GCP and Azure alongside Google Workspace and Microsoft 365.
- Led the security workstream for a group-wide PAM rollout and for cloud DORA adoption; implemented CSPM for Azure on measurable indicators, tracking configuration drift instead of one-off scan results.
- Led hardening of a new cloud environment for a fintech business line to meet PCI DSS requirements.
- Delivered OSINT training to 100+ employees in the anti-fraud department, and separately trained the CSIRT team.
- Supported CSIRT as third line of defence on major incidents, on an on-call basis.
- Ran penetration testing of cloud applications and pre-approval security assessments of new applications; findings from the cloud pentesting work prevented incidents that would otherwise have reached production.
- Represented Allegro externally in cybersecurity industry groups (including IAB) and in the Ministry of Digital Affairs' GrAI working group reviewing the EU AI Act.
- Won Best Presentation at an internal Allegro Tech event for an AI security talk.
Related
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
OSINT
Using open-source intelligence defensively: attack-surface discovery, executive exposure including AI-assisted pretexting, and awareness training that changes behaviour.
Allegro Tech
Internal Allegro Tech speaking, including a Best Presentation award for a security talk.
CISO advisory
Security leadership support for organisations without a full-time CISO: strategy, roadmap, board reporting and vendor decisions.
OSINT exposure awareness
What OSINT reconnaissance actually finds about an organisation and its executives, how AI voice cloning changes the pretext, and the awareness training that measurably reduces exposure.
Ceneo
IT and security operations at a large price-comparison platform: infrastructure, identity, monitoring and internal support processes.