Expertise.
From architecture to leadership.

I take on operational leadership and governance within the agreed mandate. The focus is on cooperation between central security, country organisations and providers, with clear decision-making in day-to-day operations.

• Service ownership, roles and escalation paths across internal teams and external providers.
• Service reviews covering scope, outstanding actions and dependencies.
• Coordination of critical incidents and communication of technical situation assessments to the responsible decision-makers.

SOC Operations · EDR Operations · MSSP Governance

I connect the assessment of technical options with future operating requirements. This includes target architecture, dependencies, policy and exception handling, and coordination of international rollouts.

• Assessment of EDR and Device Control capabilities within existing endpoint and operating environments.
• Alignment of central requirements with local needs, technical dependencies and operational owners.
• Planning of pilots, rollout waves, acceptance criteria and operational handover.

CrowdStrike Falcon · Trellix · Device Control · EDR / XDR

My technical background includes security logging, SIEM use cases, risk-based incident triage and forensic analysis. This experience informs the design of detection, analysis and response processes.

• Review and development of use cases and playbooks, including their interfaces with the SOC.
• Assessment of log sources, analysis requirements and technical dependencies for central logging and SIEM environments.
• Alignment of triage, escalation and incident coordination with internal teams and providers.

Elastic / ELK · Google Chronicle · Cisco XDR · SOC / CERT

I develop security metrics programmes and decision-oriented reporting. The starting point is a specific management question, a defined measurement scope and traceable data. My experience also includes leading an evidence-based cyber defense maturity assessment.

• Definition of each metric’s purpose, calculation, data source, owner and interpretation.
• Review of data quality, coverage and comparability before metrics are used in management reporting.
• Connection of metrics and findings to required action, decisions and follow-up.

Security Metrics · NIST CSF 2.0 · OSMS

I combine requirements, architecture and security controls with AI-directed engineering workflows. I retain professional accountability, from task decomposition through testing and code review to documentation and operational handover.

• Bring requirements, data flows, identities and permissions together in a traceable architecture.
• Direct agentic implementation with automated tests, security checks and code reviews.
• Make maintainability, documentation and deployment readiness part of delivery.

AI-Directed Engineering · IAM / Entra ID · AWS · Microsoft Azure