Cybersecurity services
I work as an independent security consultant through Security Architects, currently engaged with a financial institution under NDA. Engagements are scoped as short, evidence-driven assessments that end with a prioritised remediation plan an engineering team can actually execute — not a PDF nobody reads.
What clients get out of it
- Documentation that engineers use instead of ignore — a documentation redesign in a previous role cut security documentation volume by 80% while improving adoption.
- Governance that reduces shadow IT rather than pushing it underground; a sanctioned-path approach brought shadow IT to near zero.
- Threat models and architecture reviews that produce concrete control changes, not abstract risk registers.
- Regulatory readiness framed as engineering work: DORA, NIS2, the EU AI Act, ISO 27001 and GDPR translated into controls and evidence.
All pages in cybersecurity services
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Cloud architecture review
Design-stage review of cloud and hybrid architecture: trust boundaries, identity model, segmentation, key management and detection design.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.
Threat modeling
Facilitated STRIDE threat modeling on your real architecture, plus the templates and coaching to keep teams doing it without me.
CISO advisory
Security leadership support for organisations without a full-time CISO: strategy, roadmap, board reporting and vendor decisions.
Compliance readiness
Gap assessment and remediation planning for DORA, NIS2, ISO 27001, GDPR and the EU AI Act — mapped to controls and evidence, not paperwork.
Incident readiness
Incident response plan review, cloud and identity playbooks, tabletop exercises and detection coverage assessment.
Penetration Testing
Adversarial testing of approved applications, APIs and exposed services, with evidence, risk context and a remediation retest.
Frequently asked questions
Do you work on retainer or per project?
Both. Assessments are fixed-scope projects; CISO advisory and AI governance work usually run as a monthly retainer with a defined number of days.
Can you work under NDA?
Yes — my current consulting engagement is with a financial institution under NDA, and client names are never used in marketing material.
Do you work remotely?
Yes. Engagements run remotely by default, with on-site workshops where threat modeling or executive alignment benefits from being in the room.