I lead every engagement personally — from situation assessment through recommendations to implementation support. Below is the scope of areas in which I work with organizations across the CEE and MENA regions.
CISO, CTO, Security Architects
A model that implicitly trusts the network does not protect against modern attacks — an attacker who has gained access moves freely. Zero Trust changes this assumption: every identity, every device, and every access request is verified independently of location.
I work with organizations on designing and implementing Zero Trust architecture in hybrid and cloud environments: identity verification, network microsegmentation, application access control, and continuous trust validation. The scope is adapted to the current maturity of the environment — from assessing the current state to supporting the implementation of specific controls.
We move away from a model that gives attackers freedom of movement — and build one that materially limits the reach of a breach.
CISO, CTO, DevSecOps Teams
Migrating to the cloud does not automatically transfer security responsibility to the provider. The shared responsibility model leaves the organization with decisions that directly affect exposure: identity and access management, workload protection, segmentation, encryption, and threat detection mechanisms.
I support organizations in building a coherent cloud security strategy: from architecture assessment and control gap analysis, through designing the target security model, to tool selection and implementation support. I work with AWS, multi-cloud, and hybrid environments.
The organization leaves with a strategy aligned to its operating model and risk profile — not a collection of disconnected tools without coherent logic.
CISO, CTO, Teams responsible for AI deployments
Organizations deploying AI models and LLMs create new attack surfaces that traditional security mechanisms do not cover: prompt injection, data leakage through models, uncontrolled access to sensitive resources, and lack of visibility into data flows.
I work with organizations on securing AI environments: identifying entry points and exposure risks, implementing access controls for models and data, configuring protection mechanisms (Cloudflare AI Gateway, Lasso Security), and developing policies governing AI use within the organization.
The goal is real protection — not a declarative policy that does not translate into technical controls.
CISO, CCO, Board, Compliance Teams
NIS2, DORA, and PCI DSS requirements are not abstract checklists — each has a direct translation into architecture, operational processes, and control mechanisms. Organizations that treat them purely as a compliance exercise typically do not build real resilience.
I support organizations in interpreting and practically implementing regulatory requirements: mapping requirements to existing architecture and processes, identifying gaps, selecting technical and organizational controls, and preparing for audit. I work with organizations starting their preparation as well as those verifying the maturity of existing implementations.
The organization leaves with a compliance position it can defend to an auditor and regulator — not documentation disconnected from operational reality.
CISO, CTO, Application and Infrastructure Security Teams
Web applications, APIs, and network infrastructure remain the primary attack vectors. Effective protection requires combining controls at the network, application, and identity layers — and understanding how attackers actually move through these layers.
I work with organizations on assessing and strengthening application and network security: architecture reviews, WAAP protection configuration and optimization, API access control, network segmentation, and protection against DDoS and application-layer attacks. Particular depth in Akamai and Cloudflare environments.
Security Engineers, Technical Leads, Managers
Moving from a technical role to a leadership role in cybersecurity requires a different set of skills: strategic thinking, decision-making under uncertainty, and communicating risk in a way that is meaningful to business stakeholders. These competencies are difficult to build without practical context.
I work individually with security engineers, technical leads, and managers who are developing competencies in cybersecurity or transitioning into roles with broader scope of responsibility. We discuss specific challenges, architecture decisions, strategies, and risk communication to the board. Each session is grounded in real situations — not training material.
Every engagement starts with understanding where the organization actually is - risk profile, architecture, regulatory exposure. I do not apply templates. The assessment shapes the scope.
Work ranges from a focused advisory session - reviewing a specific architecture or compliance gap - to a structured project or ongoing advisory. The format is defined by what the organization needs, not by a standard package.
Every stage, from the first call to the final recommendation, is handled by me directly. No handoff to juniors, no outsourced delivery.
Let's talk
Collaboration begins with a brief exchange. Reach out via email or LinkedIn.