Working with me

I work with founders and leadership teams of small, tech-led organisations that sell into regulated buyers — UK central and local government, the NHS, financial services, and education. Most clients are between 3 and 30 people, have a product that’s growing, and have just realised their next big deal will require an ISMS, a Cyber Essentials Plus certificate, or both.

I help with two things, in that order: building a credible information security capability, and keeping it credible after I’m gone.

How I work

I prefer engagements that explicitly cover both phases — build, then maintain — because both phases happen, whether or not the client plans for them.

Phase 1 — Implementation (3–6 months). A focused piece of work: introduce an ISMS aligned to ISO/IEC 27001 (or Cyber Essentials Plus, depending on the buyer), refactor or retrofit the infrastructure that needs to back it up, and answer the cyber assurance questions your sales team is currently fielding. Usually 1–2 days a week, with periodic intensive blocks.

Phase 2 — Retainer (open-ended). A low-day-count fractional CISO engagement once the ISMS is live. Typically 1–2 days a month: maintaining the ISMS, reviewing changes, owning the annual review cycle, sitting in on supplier audits, responding to incidents, and being the person procurement can put on a security questionnaire.

The goal of phase 1 isn’t to deliver a binder. It’s to leave you with controls actually wired into how your team works. The goal of phase 2 is to keep them wired in.

What I do

ISO/IEC 27001 and Cyber Essentials Plus for small teams

End-to-end ISMS implementation that meets the procurement bar without strangling engineering in process. Risk management, control selection, evidence gathering, and the policy work that goes with them. Currently studying for the PECB ISO/IEC 27001 Lead Auditor qualification — already operating as a Lead Implementer in practice.

Security-driven infrastructure as code

Most small teams adopting ISO 27001 discover their infrastructure can’t evidence the controls they’re claiming. I introduce Terraform on AWS (or your equivalent) as a control mechanism rather than an engineering luxury — pull request review as separation of duties, commit history as change-management audit trail, environments as code. Pragmatic patterns, modules, CI wiring, and the team training you’ll need to keep it working after I roll off.

Cyber assurance for regulated buyers

Help with the bit your sales team isn’t equipped for: responding to government and enterprise cyber security questionnaires, supporting bids that need a security narrative, and being credible in the room with the buyer’s CISO. I’ve worked inside several of these buyer organisations, so I know what they’re actually looking for behind the questionnaire.

Fractional CISO retainer

Ongoing security leadership for organisations that need a CISO of record but not a full-time one. Sits naturally after a phase 1 implementation; I also pick up retained engagements where someone else did the build.

Also available — occasional fractional or interim CTO work for small SaaS where there’s a specific delivery problem to unstick. Not the focus of this page.

Recent work

Goodbase Digital — March 2026 to present

ISO/IEC 27001 implementation in a 3-person company

Goodbase builds bespoke case-management tooling for charities and local authorities, and needed a credible security posture to keep selling into central government. I’m currently introducing a phased ISMS aligned to ISO/IEC 27001 with formal risk management, hardening Google Workspace, AWS, GitHub and Slack against the new controls, and retrofitting infrastructure as code across operational systems. I lead the cyber and information-governance responses for live sales conversations with prospective clients, including central government bodies. The plan is to roll into a fractional CISO retainer once the ISMS is in steady state.

London Borough of Hackney — May 2023 to October 2025

Building, then leading, a security function inside a large local authority

I joined as Lead Security Engineer & Technical Architect, where I led the mapping of Hackney’s attack surface after discovering ICT wasn’t aware of all the services it operated, introduced disaster recovery testing and a council-wide system criticality framework, and revived the engineering Community of Practice.

In April 2025 I stepped into the Interim Head of Cyber Security role to lead the security function ahead of a large external audit. I devised and implemented a five-year cyber strategy within the council’s financial constraints, and rolled out the NCSC Cyber Assessment Framework (CAF) to quantify security risk and prioritise improvements across the council. I led a team of four early-career cyber analysts with structured training and mentoring, drove a programme to manage personal-device risk for critical systems, and introduced Dependabot with developer training and governance tracking.

This is the experience that informs how I think about security maturity inside buyer organisations — and what they’re actually looking for from their suppliers.

Let’s talk

Tell me what you’re trying to figure out. No discovery call required.