I build security functions that unlock regulated markets.
Head of Information Security with more than ten years in technology and six in security. I build functions regulators trust and engineers don’t route around, for regulated fintech and global SaaS companies. Based in Dubai.
What I do
- Build the function from zero
- Operating model, hiring, levelling frameworks and salary bands, through to a 24/7 security function that runs on a lean, well-negotiated budget and reports risk to the board.
- Turn regulation into market access
- Lead the security workstreams behind financial licences and certifications, and translate what regulators and auditors expect into controls engineers will actually run. SOC 2 Type II, ISO 27001, PCI DSS, CSA STAR and TISAX.
- Make security a commercial asset
- Bring security into the sales cycle with trust centres, pre-sales support and clean audit evidence, so enterprise buyers can say yes faster.
- Secure cloud-native engineering
- Zero Trust access, AWS and Kubernetes hardening with policy-as-code, a secure development lifecycle, and detection and response that gets exercised, not just documented.
- Govern AI adoption
- Write the policies and guardrails that let teams adopt AI tools quickly without creating unmanaged risk.
Selected results
- Under 10 minmean time to detect, built up from no visibility, with an incident response rotation
- 30+ to under 7 daysexposure window for high-risk vulnerabilities, through SAST, SCA and threat modelling
- 50% to 88%cloud CIS benchmark alignment, through a hardening programme built on automated remediation and policy-as-code
- 300 endpointsmoved off VPN to Zero Trust, with phishing-resistant authentication and device posture checks
- 0 critical findingsacross four external penetration tests, alongside two SOC 2 Type II audits, TISAX and CSA STAR Level 2
- 40%+average discount negotiated on enterprise security tooling
Credentials
- CISM
- CISSP
- CEH
- ISACA member
- ISC2 member
- BSc Computer Science, High Honours
Writing
- Getting IAM Right: Identity & Access for Founding Teams, From Day One to Scale2025The security decision founding teams most often defer, and the hardest to retrofit once the company scales.
- The 5 Security Pillars Every Founder Should Prioritize2025Practical ways founders can embed security early, before the expensive mistakes.
- Breaking Down Silos: Uniting for Cybersecurity2023
- Protecting the Unknown: The Power of an Inventory2023
- Cyber Risk Mind Map2023
- Comprehensive Risk Management Guide2023
- Build Your Security Program: The First Three Steps2023