Selected work.
Enterprise security architecture, multi-cloud hardening, vCISO advisory, and SOC transformation case studies for scaling and regulated organisations.
Financial services SIEM migration to Google SecOps
Challenge
A financial services firm was operating Microsoft Sentinel with >1.2PB of daily log volume across AWS, Azure, and on-premises infrastructure. Alert quality had degraded, and the SOC was spending 60% of its time on false positives rather than real investigations.
Approach: Conducted a 6-week assessment covering log source inventory, detection rule usage analysis, and compliance gap mapping. Designed a target-state architecture on Google SecOps with a shared BindPlane ingestion layer, allowing parallel Sentinel and SecOps operation during migration.
Delivery: Executed a phased migration over 8 months, moving 42 log sources and 127 detection rules. Implemented a canonical schema for identity, host, and cloud events. Established a 90-day parallel run comparing detection coverage between platforms.
Outcome
The migrated Google SecOps environment achieved 98% detection parity with the legacy Sentinel setup while reducing ingestion costs by 35%. The SOC reported a 3x improvement in investigation throughput. The legacy Sentinel environment was decommissioned after the 90-day parallel validation period.
Technologies: Google SecOps, Chronicle SIEM-SOAR, Microsoft Sentinel, BindPlane, AWS, Azure, GCP, Microsoft Defender
Multi-cloud security uplift for a UK SaaS company
Challenge
A UK-headquartered SaaS company expanding across AWS, Azure, and GCP had no centralised cloud security posture. Each engineering team was provisioning resources independently, leading to IAM drift, unencrypted storage, and non-compliant network configurations.
Approach: Conducted cloud security architecture reviews across all three providers using Wiz and Tenable.io CSPM/CWPP engines, mapped existing controls to ISO 27001 and NIST frameworks, and built a remediation roadmap prioritised by risk.
Delivery: Implemented landing zone guardrails using AWS Organizations SCPs, Azure Policy, and GCP Organization Policy. Deployed Wiz CSPM and Checkov-based IaC scanning in CI/CD pipelines. Established a shared security posture dashboard with monthly risk reviews for the engineering leadership team.
Outcome
Achieved ISO 27001 alignment across all three cloud providers within 4 months. Reduced critical security findings from weekly scans by 87%. Established a repeatable secure engineering process that continues to operate post-engagement through IaC guardrails.
Technologies: AWS, Azure, GCP, Wiz, Tenable.io, CSPM, CWPP, Terraform, Checkov, Open Policy Agent
Virtual CISO advisory for a growing fintech scale-up
Challenge
A fintech preparing for Series B funding needed to demonstrate credible security governance to investors and regulators. No permanent CISO on staff, and the engineering team had no formal security programme.
Approach: Provided fractional vCISO advisory at 12 hours per month, covering security strategy, risk assessment, policy development, and investor-ready reporting. Coordinated with the existing engineering lead to avoid disruption.
Delivery: Delivered a 12-month security roadmap, ISO 27001 gap analysis with remediation plan, vendor security assessment framework, and monthly board-level security reports with risk ratings, key metrics, and executive summaries.
Outcome
The company completed Series B funding at a £280M valuation with no security-related due diligence issues. ISO 27001 certification was achieved 4 months post-engagement. The vCISO relationship transitioned to quarterly advisory sessions for ongoing programme support.
Technologies: ISO 27001, SOC 2, vendor assessment framework, risk management
Enterprise IT Automation & Cloud FinOps Transformation for Retail Giant
Challenge
A global retail enterprise operating across AWS and Azure was spending over £3.2M/yr on unoptimised multi-cloud infrastructure, with manual environment provisioning taking 3+ weeks per sprint.
Approach: Conducted a 4-week platform engineering assessment. Designed modular Infrastructure-as-Code (IaC) templates in Terraform and OpenTofu, automated server configuration using Ansible, and established real-time FinOps cost governance rules.
Delivery: Automated 85% of legacy workloads into GitHub Actions GitOps pipelines. Enforced automated shutdown schedules for non-production environments and integrated ServiceNow IT service workflows for self-service resource provisioning.
Outcome
Achieved £1.3M in recurring annual cloud savings while increasing release frequency 5x with automated policy guardrails. Provisioning lead time dropped from 21 days to under 4 hours.
Technologies: AWS, Azure, Terraform, OpenTofu, Ansible, CloudHealth, GitHub Actions, ServiceNow
Zero Trust SASE & Identity Security Uplift for Healthcare Network
Challenge
A regional healthcare provider with 28 medical facilities and 14,000 endpoint devices had fragmented legacy VPN infrastructure, unmonitored privileged accounts, and elevated ransomware exposure.
Approach: Designed a unified Zero Trust Architecture (ZTA) and Identity Threat Detection & Response (ITDR) roadmap replacing legacy VPNs with Entra ID Conditional Access and Okta PAM.
Delivery: Deployed Zero Trust Network Access (ZTNA) microsegmentation across 28 sites, enforced FIDO2 phishing-resistant MFA for 9,000 clinicians and staff, and automated EDR deployment across 14,000 endpoints.
Outcome
Achieved 100% compliance on the NHS Data Security & Protection Toolkit (DSPT) audit while delivering frictionless, passwordless login for medical staff across clinical workstation fleets.
Technologies: Microsoft Entra ID, Okta PAM, CrowdStrike Falcon, Zscaler ZTNA, Palo Alto SASE, Windows Fleet
GenAI & AI-Assisted Application Security Review for Scale-Up Insurtech
Challenge
An AI-first insurtech scale-up running LLM-generated code and automated customer agents was facing prompt injection vulnerabilities, unauthorized PII leakage risks, and unvetted open-source AI package dependencies.
Approach: Performed a comprehensive GenAI security audit across LLM prompt logic, RAG vector database pipelines, and AI-assisted code repositories.
Delivery: Integrated NeMo Guardrails for real-time LLM input/output filtering, configured Semgrep SAST rules in GitHub Actions, and established automated Software Supply Chain (SBOM) vulnerability scanning.
Outcome
Passed SOC 2 Type II audit and major enterprise insurer vendor security reviews without a single high-risk finding, enabling key institutional distribution partnerships.
Technologies: NeMo Guardrails, Semgrep, SonarQube, Snyk, Python, LangChain, OpenAI API, GitHub Actions