WHAT DO YOU DO?

I help organisations get their security house in order. In GRC (governance, risk, and compliance), this means having clear policies, sensible risk management, and demonstrating compliance with standards like ISO 27001 and PCI DSS. Day to day, I transform messy spreadsheets and ad hoc practices into simple, audit-ready routines, train teams to master the basics, and ensure incident response and disaster recovery are effective when it counts.

WHY DO YOU DO IT?

I spent years in the RAF doing information security, then a spell teaching management systems before moving into GRC, turning standards into practical routines that teams could actually follow. I enjoy making security understandable; when non-specialists grasp the basics, everything else improves. I’m motivated by outcomes: fewer incidents, smoother audits, and leaders with real visibility of risk. And yes, I do like a tidy spreadsheet, mainly because it keeps people aligned and progress visible.

WHAT KIND OF SPECIAL PROJECTS HAVE YOU BEEN INVOLVED IN?

I have worked in information security for more than 20 years, including RAF roles running penetration tests and security audits across Europe, Africa, and the Middle East, from coastal bases in Cyprus and field operations in Kenya to multiple desert deployments in some not-so-nice places. In consultancy, this grounding enables me to effectively partner with implementation teams, guiding projects through to certification. Highlights include achieving a personal best by taking a client’s company to certification in just seven weeks, from kick-off meeting to a clean ISO 27001 Stage 2 audit.

WHATS ON TOP OF YOUR BUCKET LIST?

I enjoy watching sporting events, and I’d love to travel to the US to see the Masters at Augusta. I’m a keen, if very average golfer, and I want to see the spectacle up close, the course, the quality of play, the whole event atmosphere. And with a bit of luck, I’ll be there to cheer on a British winner.