Summary

Senior Security Engineer with 20+ years of hands-on experience designing and implementing security controls across cloud, on-prem, network, and ICS/OT environments. Expert in translating security standards (NIST, IEC 62443, etc.) into practical technical implementations. Specializes in building and automating secure infrastructures using Zero Trust, SASE, and micro-segmentation. Proficient in the full stack of security technologies, including cloud security platforms (CNAPP/CSPM), SIEM, EDR, firewalls, and identity management, with a strong focus on DevSecOps and automation.

Why do I change companies every three years?

Before COVID, many roles were fixed term engagements with a defined end date. After COVID, the market shifted strongly toward body leasing and body shopping contracts. In these engagements, the contract typically ends when the project or delivery phase ends. 

Policies, Procedures & Awareness

• ISO 20000, ISO 22301, ISO 27005, ISO 27014, ISO 27017-19, ISO 27031, ISO 27032, ISO 27034, ISO 27035, ISO 27036, ISO 27037, ISO 27040, ISO 27041, ISO 27042, ISO 27043, ISO 27050, ISO 27018, ISO 27701, ISO 29100, ISO 31000, ISO 31010, ISO 31700, ISO 21434, IEC 62443, ISO 27001, Safety ISOs 50000, 60000
• NIST Cybersecurity Framework 2.0, NIST SP 800 30, NIST SP 800 37, NIST SP 800 39, NIST SP 800 53, NIST SP 800 61, NIST SP 800 82, NIST SP 800 171, NIST SP 800 207 Zero Trust, NIST SP 800 184, NIST SP 800 115, NIST SP 800 137
• CRA, GDPR, DORA, NIS2, eIDAS, TISAX, BSI IT Grundschutz, KRITIS, MaRisk, BAIT, VAIT, KAIT
• SOX, PCI DSS, PCI SSF, HIPAA, NERC CIP, CSA CCM, COBIT, CIS Controls v8, ISM3, COSO
• Software and product security governance: OWASP SAMM, BSIMM, SAFECode, SSDF NIST, OWASP ASVS
• Supplier and third party : ISO 27036, SIG Shared Assessments, TPMR Third Party Risk Management practices

Enterprise and Solution Architecture:

LeanIX EAM, ArchiMate, ADM , draw io, Miro, Whimsical, Graphviz, Jira, Azure DevOps Boards, Confluence, ServiceNow Secops, Log4brains, IBM DOORS, OpenControl, Compliance Masonry, AWS Audit Manager, Azure Policy, Open Policy Agent Rego, Auth0 Attack Protection playbooks, Varonis DatAdvantage maps, Purview data lineage, Syft, Grype, CycloneDX, SPDX, Dependency Track, Renovate, Dependabot, Archi plus ArchiMate, Structurizr C4 or PlantUML, IriusRisk, Jira plus Confluence with ADRs, Terraform plus Checkov plus OPA, Prowler or ScoutSuite, Syft plus Dependency Track, OpenTelemetry plus Grafana plus Loki, AWS Well Architected or Azure Advisor reviews 

Threat modeling and attack simulation:

Microsoft Threat Modeling Tool, IriusRisk, OWASP Threat Dragon, securiCAD, PASTA, ThreatSpec, PyTM, MITRE ATT , Fence Tool EBIOS, FAIR, OCTAVE, MEHARI, MAGERIT, CWE Top 25, CAPEC

Perimeter IT Network Security and micro segmentation:

Guardicore, Claroty CTD and SRA, Armis, Vectra, Nozomi Networks, NanoLock, Verve Industrial, Microsoft Defender for IoT, Tenable OT, Prisma Cloud, RSA NetWitness, Imperva WAF, Fortinet, Juniper, Palo Alto Networks NGFW, DNS sinkholing, DNS behavior analysis, Microsoft Defender stack, Darktrace

Endpoint Security:

CrowdStrike, Carbon Black, Red Cloak, Microsoft Defender for Endpoint, Wazuh and ELK, THOR or Loki, HIPS or FIM Windows or Unix, sandboxing or detonation, recovery tooling, OllyDbg, IDA Pro

Database Security:

IBM Guardium, Imperva DB Firewall, Check Point CloudGuard, Trend Micro Cloud One

Identity & Access Management:

Okta, PingID, Microsoft Entra ID, Active Directory, Cisco ISE, TACACS, RADIUS, NAC, MFA, Conditional.

Logging & Forensics:

RSA enVision, Splunk Enterprise Security, Wazuh and ELK, Netwrix, Microsoft Defender XDR, Microsoft Sentinel, QRadar, Maltego, InsightIDR TI, Volatility, Autopsy, Helix, FTK, SANS SIFT

Threat Intelligence:

MISP, Maltego, SpiderFoot HX, BitSight, ZeroFox, SecurityScorecard, CyCognito, Faraday, Recorded Future, Insight TI, Censys, SpyCloud, data or API discovery

Data Leak Prevention:

Microsoft Purview DLP, GTB DLP, Forcepoint DLP, Netskope DLP, Fidelis DLP, Trellix DLP, Zscaler DLP, Symantec DLP, Mimecast DLP

Cloud Security:

• CNAPP Microsoft Defender for Cloud, Prisma Cloud, Aqua Security, Wiz, Check Point CloudGuard
• CSPM: CrowdStrike Cloud, Tenable Cloud Security, Qualys CloudView, Rapid7 InsightCloudSec
• CWPP: Sysdig Secure, CrowdStrike Falcon Cloud Security, VMware Carbon Black Cloud
• CIEM: Microsoft Entra Permissions Management, CyberArk, Saviynt, Prisma Cloud IAM
• EASM: Censys, CyCognito, BitSight, SecurityScorecard, Rapid7 TI, Hadrian
• CASB: Microsoft Defender for Cloud Apps, Netskope, Zscaler CASB, Skyhigh
• SSPM: Obsidian, Adaptive Shield, Grip Security
• PIAM PIM PUAM PAM Cloud Identity and Access Security: Microsoft Entra ID, Okta Workforce Identity Cloud, Ping Identity,
• CyberArk Identity, BeyondTrust, SailPoint
• IaC Security: Tenable Cloud Security, Aqua Trivy
• Container and Kubernetes Security: Sysdig, Aqua, Falco, Anchore
• Key Management: AWS KMS, Cloud HSM, Azure Key Vault, Thales CipherTrust, HashiCorp Vault

Vulnerability Management:

Nozomi, Qualys, Nessus, Tenable, Rapid7, Greenbone, Retina, CoreImpact, Intune Defender ASR. 

Secure Software Development and Application Security:

Black Duck, Veracode, Checkmarx, SonarQube, Burp Suite Pro, Invicti, Netsparker, Acunetix, Qualys Web App Scanning, Rapid7 AppSpider, Nmap, Nikto, Greenbone OpenVAS, Vega, Metasploit or Metasploit Pro, Core Impact, Invicti Enterprise, GitLab Secure, Jenkins Security Plugins, CircleCI pipelines with SAST, DAST, regression and smoke security testing. Microsoft Defender for DevOps, Aqua Trivy, Tenable Web App Scanning, Selenium, Postman, TestRail, Katalon, BrowserStack, container image scanning, dependency and license compliance checks, manual and automated penetration testing, continuous security gate enforcement across CI or CD.