Understand before securing
You cannot secure a system well if you do not understand how it works, where trust exists, and how its parts interact.
Expertise
Understand the system before trying to secure it.
I have spent my career learning how technology works from the physical layer upward. That started with microelectronics and moved through telecommunications, networks, enterprise infrastructure, security, identity, data, and now agentic systems.
I am less interested in becoming the person for a particular product than understanding the problem underneath it. Products change. The fundamentals around communication, identity, trust, authorization, execution, reliability, and observability change much more slowly.
01 // How I think
Problems over products
Learning the underlying problem makes it easier to move between vendors, platforms, and new technologies without starting from zero.
Design for people
Security controls have to account for human behaviour and how people actually get work done. A control that people route around is not doing its job.
02 // Depth
A career spent moving up and across the stack.
My foundation in microelectronics taught me to be curious about what is happening underneath the abstraction. Over time that curiosity moved from hardware and distributed terminals into computers, cabling, wireless, switching, routing, servers, directory services, WANs, enterprise communications, security operations, software, identity systems, data, and autonomous agents.
Electronics & computingTelecommunications & networksInfrastructure & enterprise systemsSecurity engineeringIdentity & zero trustData & automationAgent systems
03 // Operating environments
I have applied that experience in very different environments, from systems that connect remote terminals and geographically distributed networks to business infrastructure, specialized operational systems, and large-scale software platforms. Consulting across private-sector organizations also meant regularly dropping into unfamiliar environments, learning how the business and technology worked, and becoming useful quickly. The constraints change by industry; the need to understand the system does not.
Telecommunications
Hospitality
Government & public infrastructure
Insurance
Energy
Software & SaaS
Consulting across private sectors
04 // Areas of expertise
Claims are more useful when you can inspect the work behind them.
These areas connect what I know with the research and tools I publish here. As the site grows, these pages will grow with it.
Agent Security
Identity, authorization, execution boundaries, human-in-the-loop controls, and evidence for agentic systems.
Agent identityAuthorizationHarness safetyMCP
Identity & Access
Identity lifecycle, access policy, zero trust, authorization, and the systems that connect people and workloads to resources.
IAMOktaActive DirectoryZero trust
Security Engineering
Building controls that work in real systems: detection, response, vulnerability management, endpoint trust, automation, and risk.
Detection & responseVulnerability managementEndpoint securitySecurity controls
Data & Security Analytics
Using data pipelines, measurement, and analysis to understand whether security controls are actually working.
Security metricsData pipelinesBigQueryControl effectiveness
Infrastructure & Networks
Experience from the physical network upward: telecommunications, LAN/WAN, wireless, servers, directory services, firewalls, virtualization, and cloud.
NetworkingTelecommunicationsWindows ServerActive Directory