I was senior security architect at a multinational manufacturer of connected water infrastructure. There I helped establish a product security programme, and went on to own and run it, with sign-off authority on product launch, and delivery of the first ISO 27001 certification for the platform.
Across my security architecture roles I've owned security strategy, budget planning, and risk management, as well as the on-the-ground technical work: threat modelling, secure software development processes, secure boot and firmware update process design, bug bounty and disclosure programmes. And before that, I spent twelve years writing software.
My experience means I know what is and isn't practical for a delivery team to take on. My solutions are always designed around what benefits the business and its people.
If I were a CTO at a growing company trying to get security right without standing up a full team, he would be my first call.
Recent posts
Part 3: Threat Modelling AI Systems
Addressing typical threats to LLM system integrations
Part 2: Threat Modelling AI Systems
Strategies for identifying vulnerabilities in LLM integrated systems
Part 1: Threat Modelling AI Systems
Investigating threat modelling approaches for systems that use LLM technology
EU Cyber Resilience Act Preparation
Planning and preparation for implementers of the EU Cyber Resilience Act
EU Cyber Resilience Act: Are You Ready?
The reporting requirements of the EU Cyber Resilience Act come into force in September 2026
Nobody Wants To Steal Your Sensor Data
Why we can't evaluate all businesses by the standard confidentiality model
Regulatory Pressure on Utility Third Party Risk Means Suppliers are Falling Behind
Suppliers need to adapt quickly as new regulations ask more questions of their products