About
About me
What I work on, and for whom.
I work in detection engineering and cloud-native security. Mostly for organisations where security is not optional — regulated industries, critical infrastructure, payments.
Most of that work comes down to a single question: does the control actually do what the document says it does. An ISMS whose measures were never tested technically, detections that live in a vendor console and vanish at the next platform migration, evidence reassembled before every audit instead of accruing from operations — the paperwork is complete and the control behind it is not there.
That is not a diligence problem. In most organisations compliance and engineering are done by different people who have to take each other on trust.
In June I founded BITPOL for supervised companies that want to prove their controls hold rather than document that they exist.
The story of how I got here is on the home page.