IT security consultant for finance, life science and the public sector
Independent IT security consultant with clients in banking, insurance, life science, the public sector and manufacturing. Most work under strict regulation, so the work has to hold up in an audit.
A selection of organisations I have worked with
15 client organisations·6 industries·5 regulatory frameworks beyond GDPR
Clients by industry
5
Finance
3 banks, 2 insurers
DORA, PCI DSS
4
Life Science
Pharma and life science
GMP
2
Public sector
Public organisations
NIS2, CSM-RA
2
Manufacturing
Manufacturers
NIS2
1
Software
Software house
GDPR
1
Consulting
Consulting firm
GDPR
See what the work looked like in the case studies →
How I work in regulated industries
Some clients are in finance, pharmaceuticals and rail, where requirements such as PCI DSS, NIS2, DORA, CSM-RA (the EU Common Safety Method for risk evaluation and assessment) and GMP apply on top of GDPR.
I bring a risk-based, analytical mindset to a new task, and favour an agile, pragmatic approach wherever possible.
What I help clients with
Vendor-neutral advice across platforms: the problem decides the tool, not the other way round.
Identity and access management
IAM architecture, access models and reviews, SSO, and vendor selection for IGA and PAM.
Risk and control assurance
Risk assessments and control reviews against ISO 27001, NIST CSF and CIS Controls, including audit-finding closure.
Disaster recovery and continuity
Recovery plans that are actually tested: restore tests, reviews with the business and tabletop exercises.
Data loss prevention
DLP and cloud app control (CASB), from policy design to rollout.
Vulnerability and patch management
Patch strategy and rollout: frameworks, tooling requirements and the organisation to run them, plus risk-based vulnerability prioritisation.
Secure email
Setting up DMARC, SPF and DKIM, and implementing secure email delivery.
Endpoint and network security
Endpoint hardening and agent rollout, VPN and SSL inspection.
Configuration baselines and drift
Baselines for cloud and identity environments, drift alerting and configuration backup across multiple tenants.
Analysis and project leadership
Requirements, Lean process analysis and delivery of security projects and programmes.
Prefer a fixed scope? See the Baseline review →
Want to talk through your environment?
Book a 30-minute call and we will go through where you stand and what to look at first.