CISO advisory
Retained advisory for leadership teams that need security judgement more than they need another full-time hire: a roadmap tied to business risk, honest vendor assessment, and reporting that a board can act on.
Updated
Where I add most value
- Turning a scattered findings backlog into a sequenced 12-month roadmap with budget shape, dependencies, owner types and a clear reason for the order.
- Board and audit-committee reporting: fewer metrics, each tied to a decision, risk appetite or exception rather than a dashboard nobody acts on.
- Vendor and tooling decisions, including whether a tool is needed at all, what operating model it assumes and which evidence would prove it is working.
- Security documentation and process redesign — reducing volume while increasing adoption, with policy, standard and runbook ownership made explicit.
- Building the security awareness and OSINT training track; I have delivered OSINT and awareness training to 100+ employees.
I start with material risks, critical services, known findings, control ownership, supplier dependencies and blocked decisions. From there, I turn the baseline into a target state and short roadmap, often structured against NIST CSF 2.0. The cadence is a decision log and reporting for leadership; detail stays in the delivery backlog.
Frequently asked questions
How much time does this take?
Typically two to four days a month, weighted towards the start while the roadmap is being built.
Related
Compliance readiness
Gap assessment and remediation planning for DORA, NIS2, ISO 27001, GDPR and the EU AI Act — mapped to controls and evidence, not paperwork.
Security Architects — founder
Independent security consulting practice: cloud and AI security assessments, threat modeling, compliance readiness and CISO advisory.
Compliance
Turning DORA, NIS2, ISO 27001, GDPR and the EU AI Act into one control set with reusable evidence and aligned reporting clocks.
OSINT
Using open-source intelligence defensively: attack-surface discovery, executive exposure including AI-assisted pretexting, and awareness training that changes behaviour.
OSINT exposure awareness
What OSINT reconnaissance actually finds about an organisation and its executives, how AI voice cloning changes the pretext, and the awareness training that measurably reduces exposure.
Allegro Group
Security work at Europe's largest e-commerce marketplace: cloud security, identity, governance redesign and internal enablement.