Credentials & Institutional Affiliations
Academic credentials, professional certifications, industry affiliations, regulatory engagement, and publication record.
Credentials & Affiliations
Third-party validated expertise — academic pedigree, professional certifications, and institutional affiliations that underpin the doctrine.
Academic Authority
Honorary Professor — Cybersecurity, AI & Quantum Computing at Schiphol University. Honorary Senior Lecturer in Information Security at UCL. Research collaborations with imperials.
Professional Certifications
CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), CCSP (Certified Cloud Security Professional), CCSE (Checkpoint Certified Security Expert).
Industry Pedigree
27 years securing regulated enterprises. Big 4 consulting alumni (Deloitte, PwC, EY, KPMG). Zero breaches managing over £500B in assets across Tier-1 financial services, critical infrastructure, and government.
Regulatory Body Engagement
Direct engagement with EBA, EIOPA, ESMA supervisory frameworks. DORA implementation advisory. NIS2 transposition consultation. EU AI Act readiness architecture for regulated entities across EMEA.
Publication Record
900 published governance doctrine frameworks. Peer-reviewed research in AI security, operational resilience, and institutional governance. Cited across regulatory submissions, board reports, and supervisory correspondence.
27 years. Five certifications. One principle: the evidence chain either holds or it does not.
CISSP. CISM. CRISC. CCSP. CCSE. Every credential pressure-tested across Tier-1 regulatory environments — banks, sovereign boards, CNI operators, parliamentary select committees.
Parliamentary Testimony & Public Appointments
Direct engagement with the legislative process — oral testimony, board appointments, and advisory roles that place this doctrine at the intersection of governance and law.
Parliamentary Oral Testimony
Called to give oral evidence before the Joint Committee on the UK Cyber Security and Resilience Bill — contributing technical and governance analysis directly into draft legislation. One of fewer than a dozen practitioners asked to testify on the Bill’s provisions covering incident reporting obligations, critical national infrastructure scope, and CISO accountability frameworks. Evidence entered the formal parliamentary record.
Vice Chair — National Disasters Emergency Centre, Singapore
Appointed Vice Chair of the National Disasters Emergency Centre, Singapore — a sovereign-level emergency coordination body. Responsible for cyber resilience integration into national emergency response doctrine, cross-agency incident coordination protocols, and critical infrastructure continuity planning across Singapore’s regulated sectors.
Cyber Resilience Centre for London
Active leadership role within the Cyber Resilience Centre for London — the Metropolitan Police-backed national cyber resilience hub. Contributing to threat intelligence dissemination, SME resilience programme design, and public-private sector incident coordination frameworks across the London economic area and national critical infrastructure ecosystem.
ISO Technical Committee Engagement
Contributing expert to ISO/IEC technical committees on information security management and AI governance. National Standards Body engagement on ISO 27001, ISO 42001 (AI management systems), and ISO 22301 (business continuity). Doctrine frameworks cited across regulatory submissions, board-level governance reports, and supervisory correspondence with FCA, EBA, ENISA, and ESMA.
Sector Delivery Record
27 years of hands-on delivery across every major CNI sector — classified environments, regulated financial systems, and sovereign infrastructure. Zero breaches across £500B+ assets under protection.
Defence & Aerospace
Cyber governance delivery for defence sector clients — classified information architecture, supply chain security, OT/ICS protection for aerospace manufacturing, and national security clearance-level programme management. NCSC and MoD framework alignment.
Tier-1 Financial Services & Banking
CISO-level advisory and programme delivery across major UK and European banks. £500B+ in assets secured. FCA, PRA, EBA, and DORA regulatory engagement. Trading floor cyber risk, payment infrastructure security, and board-level governance mandate delivery. Zero breaches throughout engagement portfolio.
Public Sector & Healthcare
NHS-adjacent healthcare cyber architecture, HIPAA/HITECH and UK-GDPR data governance frameworks, public sector information security programme delivery for central government departments. DSP Toolkit alignment, CQC regulatory interface, and clinical data governance programme leadership.
Energy & Critical Infrastructure
OT/ICS cyber architecture for energy sector operators — IEC 62443 implementation, Purdue Reference Model deployment, SCADA security hardening, and CNI-grade incident response planning. NERC-CIP and UK NIS Regulations compliance programme delivery.
Transport & Aviation
Cyber resilience programme delivery for major UK transport hubs including aviation infrastructure — safety-critical systems protection, passenger data governance, and operational technology security. EASA, CAA, and DfT regulatory framework compliance architecture.
Law Enforcement & Government
Direct delivery for UK law enforcement agencies — sensitive data architecture, intelligence system security, investigative platform governance, and protective marking compliance. Central government departmental cyber programme management at Director-level mandate.
Global Standards & Framework Alignment
Not framework-aware. Framework-operative. Each standard below has been deployed in live regulated environments — not studied, applied.
ISO Standards Suite
- ISO 27001:2022 — Lead Auditor certified. Full ISMS design and deployment across Tier-1 entities. Gap analysis, control implementation, certification audit support.
- ISO 42001:2023 — AI Management Systems. First-mover implementation across EMEA regulated entities. EU AI Act compliance architecture integration.
- ISO 22301 — Business continuity and operational resilience. Integration with DORA and FCA operational resilience rules.
- ISO 31000 — Enterprise risk management framework integration. Board-level FAIR-aligned reporting.
NIST Framework Suite
- NIST CSF 2.0 — Govern, Identify, Protect, Detect, Respond, Recover. Full six-function deployment across global programmes. Cross-mapped to ISO 27001 and DORA.
- NIST SP 800-53 Rev 5 — Federal information security controls. Applied in defence-adjacent and government sector programmes.
- NIST SP 800-171 — CUI protection. Supply chain and defence contractor cyber programme alignment.
- NIST AI RMF — AI risk management framework. Integrated with ISO 42001 for comprehensive AI governance architecture.
EU Regulatory Frameworks
- DORA — Full ICT risk, incident reporting, third-party oversight, and TLPT delivery. EBA/ESMA/EIOPA engagement. 900+ framework doctrine cross-referenced.
- NIS2 — Transposition advisory, essential entity scoping, governance obligations, supervisory engagement across 14 EU member states.
- EU AI Act — High-risk AI system compliance architecture, conformity assessment, Annex III scoping, and AI governance board mandates.
- GDPR / UK GDPR — DPA-aligned data governance, DPIA frameworks, international transfer mechanisms, and supervisory authority engagement.
Media Bylines & Published Authority
Industry-grade published voice across the sector’s most authoritative platforms — peer-reviewed, editor-reviewed, and media-cited across the global cybersecurity canon.
Trade & Industry Media
Academic & Peer-Reviewed Record
900 published governance doctrine frameworks — each representing a formally structured, evidence-based contribution to the cybersecurity knowledge base. Peer-reviewed research spans AI security and governance, operational resilience architecture, institutional governance models, and regulatory compliance engineering.
Cited across FCA submissions · EBA guidance responses · ENISA public consultations · Board-level governance reports · Supervisory correspondence · Parliamentary evidence
Cybersecurity as a Team Sport
27 years of frontline delivery teaches one truth: no individual — however credentialed — secures an enterprise alone. Sustainable cyber resilience is a collective discipline.
The Team Sport Doctrine
“Cybersecurity is a team sport.” This is not a platitude — it is a programme design principle. Every governance framework, every board mandate, every regulatory response succeeds or fails at the intersection of technical competence and organisational alignment. The CISO cannot win alone. The board cannot delegate and disappear. Security is owned collectively or not at all.
Cross-Functional Leadership
27 years of delivering across the full stakeholder spectrum — from Tier-1 bank boards to parliamentary select committees, from field engineering to C-suite advisory. The ability to translate technical risk into board language, and to hold regulators, lawyers, and engineers in the same governance conversation, is the rarest and most valuable capability in the profession.
The Evidence Chain Principle
In a profession where reputations are built on certifications and destroyed by breaches, the only currency that holds is evidence. Every doctrine framework, every regulatory submission, every board report stands or falls on whether the evidence chain holds. 27 years. Zero breaches. The chain holds.
“Cybersecurity is a team sport. I have spent 27 years building the teams, writing the playbooks, and delivering the outcomes that prove it.”
CISSP · CISM · CRISC · CCSP · CCSE · UCL · Imperial College · Schiphol University · Parliamentary Testimony · Singapore Vice Chair · Cyber Resilience Centre London · All Big 4 · Zero Breaches
Technical & Programme Skill Stack — Estate Doctrine Series
Skills, frameworks, and protocols mastered across the 20-volume Estate / IoT / Smart-Building doctrine series. Coverage spans the full stack — from BMS / IoT protocols to portfolio-scale ESG and Net Zero programme economics.
Protocols, Architecture & Engineering
Non-Technical & Programme Skills
Commercial & Business Outcomes
Board Mandate Engagement
27 years of hands-on delivery, available for board mandate.