Luxembourg · freelance-first · Europe
I help regulated and technology-led organisations connect cybersecurity, DevSecOps, cloud automation and AI governance into systems that can be operated, audited and improved.
SENIOR CONSULTANT
From production hardening and threat detection to regulatory readiness and process automation.
What I bring together
Security work is strongest when policy, platforms, people and delivery move in the same direction.
Security operations that connect exposure discovery with action: vulnerability assessment, EDR/XDR policy and agent review, detection logic, threshold tuning, alert investigation, MalOps and incident escalation. I work across production environments, audit evidence, CIS hardening and operational ownership rather than treating security as a dashboard exercise.
See security deliverySecure delivery from design to production: CI/CD controls, infrastructure as code, Kubernetes and OpenShift security, identity and secrets, workload isolation, logging, observability and GitOps governance. The focus is practical automation that reduces manual effort while preserving change traceability, rollback capability and release confidence.
See platform deliveryPractical implementation of DORA, NIS2, MiCA and EU AI Act expectations through ICT risk assessments, control mapping, KPI/KRI design, third-party reviews, RACI and escalation models, DR analysis, failover testing, tabletop exercises and audit-ready evidence. Requirements become owned routines that management and delivery teams can use.
See the delivery methodAutomation for processes that are slow, repetitive or difficult to govern: BPMN and process modelling, RACI and SIPOC, baseline analysis, process mining, reporting automation and AI-assisted research. I structure AI danger and risk analysis, human oversight, data protection, access controls and guardrails for RAG and LLM-based workflows.
Discuss a transformation problemFlexible security leadership for organisations that need senior coordination without an immediate permanent executive hire: security operating models, ICT risk registers, CAB and change governance, KPI/KRI reporting, crisis and incident escalation, third-party oversight, awareness and management-level decision support.
Discuss a leadership mandateSelected delivery contexts
Different environments, same discipline: understand the system, make the risk visible, then improve the way it runs.
Configuration, release and deployment governance across development, testing, UAT, pre-production and production. Automation moved a full deployment and test cycle from 6–12 hours to a maximum of 42 minutes.
Automation / Release / Control
Created and led the first automation squad, delivered the Automation Management System in four months and helped move infrastructure from local environments through hybrid cloud to Azure.
DevOps / Azure / Zero Trust
Linux estate, vulnerability management, SOC2 implementation, CIS benchmark reviews, patch lifecycle and custom Cybereason agent/tooling development. The work connected production security operations with control evidence, risk treatment, third-party follow-up and executive reporting.
EDR / Vulnerability / SOC2
Readiness programmes, cloud-agnostic containerisation and local AI systems for research and document review. Engagements combine governance design, process baselines, AI risk analysis and measurable time reduction instead of isolated technology pilots.
AI Risk / Kubernetes / Process
How I work
Engagements are structured to leave behind better decisions, clearer ownership and systems that teams can actually operate.
Map the environment, controls, dependencies, gaps and operational reality.
Turn risk and requirements into a practical target state and delivery path.
Remove toil from delivery, security operations, reporting and evidence collection.
Measure the change with useful KPI/KRI, testing, traceability and feedback loops.
Working vocabulary
ISO 27001 · GDPR · SOC2 · CIS Benchmarks · NIST · MITRE ATT&CK · Zero Trust · ICT risk · KPI/KRI · RACI · audit evidence
Kubernetes · OpenShift/OKD · Azure · AWS · GCP · Terraform · Ansible · GitLab · ArgoCD · Helm · Python · GitOps
Cybereason · Cisco Secure Endpoint · Sophos Intercept X/XDR · Trellix EDR/XDR · Elastic Security · ELK · Splunk · Prometheus · Grafana
BPMN · ARIS · RACI · SIPOC · Value Stream Mapping · Camunda · n8n · Process Mining · RAG · LLMOps · NIST AI RMF
Technical Overview
Technology choices are matched to the operating model, risk profile and delivery constraints. The result should be understandable to engineers and defensible to management.
Identity-first access, segmentation, secrets management, secure baselines, EDR/XDR controls, vulnerability remediation, logging and evidence flows across production environments.
Linux and Red Hat, Windows, VMware, OpenStack, KubeVirt, Kubernetes, AKS, OpenShift/OKD, Rancher, Docker, AWS, Azure and GCP.
Python, Terraform, Ansible, GitLab CI, ArgoCD, Helm, Argo Workflows, Octopus/Tentacle, Nexus or Artifactory and SonarQube for controlled delivery.
Cybereason, Cisco Secure Endpoint, Sophos Intercept X/XDR, Trellix EDR/XDR, Elastic Security, ELK, Prometheus, Grafana and Thanos.
Keycloak, PostgreSQL, MongoDB, S3-compatible storage and integration platforms such as Mule, with security, access and operational ownership built into the design.
Selenium, Robot Framework, TestLink, Cucumber, BPMN, ARIS, RACI, process mining, KPI/KRI, DR and failover, CAB, crisis escalation and management reporting.
A useful conversation starts with the actual constraint.
Freelance-first · advisory, hands-on delivery or transformation support · Luxembourg · hybrid · remote · rate on request