Six engagements chosen for the kind of problem they represent — building programmes from nothing, answering several regulators at once, and standing behind the result at Board level.
Across financial services, logistics, real estate and telecommunications, in AMER, EMEA and APAC.
A high-growth business operating across multiple regulated markets.
The organisation needed to satisfy several regulators, auditors and investors at once, without an established information security governance function to answer them from.
Built the global information security programme, the third-party risk management programme and the information security risk programme from scratch, and took ownership of the relationships with regulators, auditors and investors rather than routing them through others.
DORA, ISO 27001 and NIS2 implemented from scratch, alongside ownership of PCI DSS, SOX, SOC 2 Type II, SWIFT CSP, ITGC and NIST CSF.
Navigating international regulations, licence requirements and the needs of multiple geographies.
European digital-finance regulation arrived as several overlapping regimes at once, each with its own reporting, resilience-testing and third-party requirements — alongside mismatches with the existing APAC and AMER frameworks.
Developed and oversaw a single regulatory governance programme covering the full global set of requirements, and acted as international subject-matter expert for security, privacy, technology, operational resilience, incident management and ICT risk.
DORA, MiCA, PSD2, NIS2, ISO 27001, GDPR, LGPD, SOX and PCI DSS, plus local regulations in each market.
Building the cybercrime functions for government agencies and ministries from scratch.
Federal and regional cyber investigation capability was fragmented across taskforces, with no information security function or orchestrator inside the government.
Created and led the information security team, built an ISO 27001 ISMS from scratch, reengineered the federal cyber investigations framework for four police taskforces, and opened collaboration with international police forces, NGOs and government agencies.
ISO 27001, HUMINT and OSINT intelligence methods, federal investigations frameworks.
Leading Security, Privacy, and Technology across several licensed markets.
Operating licences each carry security, privacy and technology obligations that have to be demonstrably met and explained upward to the C-suite, investors and regulators.
Took security, privacy and technology ownership of the licences, with oversight of the security and privacy programme and regulatory governance, and acted as the interface to the Board, C-suite, investors and regulators.
Advisory and audit within AI, cyber and privacy across several markets.
Clients across very different sectors needed the same underlying question answered — whether their AI, security or privacy posture would survive attacks and scrutiny.
Delivered numerous advisory and audit engagements across cyber, privacy, AI and technology, focusing on cloud migrations, incident management, third-party risk, strategy design and implementation, maturity and gap assessments, and Board and C-suite training.
Owning governance framework creation and supplementary eGRC implementations from scratch.
Cyber and privacy were being run ad hoc and on paper, without a single system of record.
Managed the RSA Archer eGRC implementation and oversaw delivery of several cybersecurity and privacy projects alongside it.
RSA Archer eGRC.
For speaking engagements, professional networking, research collaboration, or a conversation about AI, cyber and privacy.