Ceneo
Operational IT and security work at a high-traffic price-comparison platform, September 2019 to June 2022 — promoted from IT Security & Compliance Specialist to Senior in April 2021. The environment where I learned that maintainability is a security property.
Updated
Scope
- Built the company's first security incident response programme from scratch, including a canary-token-based honeypot system to catch intrusions early.
- Took the company to full NIST CSF and GDPR compliance, and represented Ceneo directly to regulators, including the Polish Personal Data Protection Office (UODO).
- Wrote the company's security policy framework, ran onboarding and periodic security/compliance training, and built the organisation's security awareness programme from the ground up.
- Implemented a DLP system and supported an in-house anti-bot system built on machine learning.
- Ran and supervised penetration testing (including third-party engagements) and vulnerability management using Nessus.
- Did computer forensics work: collecting and documenting digital evidence and handing it to the police where required.
- Designed physical security for a new office location — camera placement, motion sensors, locking systems — and ran physical security testing.
- Built the "report phishing" button: a one-click way for employees to pull a phishing campaign that got past filters, removing it in seconds instead of waiting on a ticket.
What I'd change
Early phishing-simulation work here taught me the wrong lesson at first: click rates dropped, so it looked like it was working. It wasn't — it just trained people to disengage from security communications generally. I rebuilt the programme around fewer, better-explained simulations paired with actual feedback and recognition for people who reported suspicious emails, instead of catching people out. Security awareness isn't about catching mistakes, it's about giving people a reason to report things.
Related
Allegro Group
Security work at Europe's largest e-commerce marketplace: cloud security, identity, governance redesign and internal enablement.
Incident response
IR lifecycle aligned to NIST SP 800-61r3 and CSF 2.0, cloud and identity playbooks, detection coverage and post-incident learning that changes controls.
Identity & Zero Trust
Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.
Identity attack paths
Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.
Conditional Access baseline
An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.
From Threat Modeling to a General Principle
Thoughts on threat modeling