Capability statement
vCISO & Fractional CISO.
The CISO role is primarily a communication and decision-making discipline. Helping the board understand risk, helping the organisation make better decisions, and building security into how the business operates, not bolting it on top.
That framing comes from fourteen years in British Army Intelligence, where actionable intelligence mattered more than raw data collection.
Credentials
ISO/IEC 27001:2013
Lead Auditor, IBITGQ certified
ISO 27005
Risk Manager, Certified
CIISec
Chartered Institute of Information Security, Member #196022
AMBCS
Associate Member, British Computer Society, #990536311
FdSc
Intelligence and Security Systems
British Army
Intelligence Corps, 14 years, 3 operational deployments
Capability areas
Six of the areas most engagements draw on.
Board & leadership
Translating risk into decisions the board can act on. Risk appetite, governance structures, CISO reporting, stakeholder communication.
Risk management
ISO 27005 certified. Risk quantification, registers, threat modelling, exec briefings. Probability and business impact, not traffic lights.
AI governance
Acceptable Use Policy, ISO 42001, EU AI Act, shadow AI audit, platform procurement advisory, AI risk register.
Compliance
ISO 27001, NCSC CAF, NIS/NIS2, GDPR, Cyber Essentials, SOC 2. The output of a good risk programme, not a substitute for one.
Incident & resilience
IR planning, tabletop exercises, breach response, ICO notification, BCP/DR advisory, crisis communications.
Programme design
Building or maturing a security programme. Gap analysis, maturity assessment, roadmap, budget prioritisation, operating model.
Engagement model
Shaped by what the organisation actually needs, not a fixed package.
Flexibility. Fully adaptable to your priorities. The depth of involvement and deliverable focus are agreed upfront and adjusted as needs evolve.
Format. Remote-first, with on-site sessions available. A structured cadence for review, advisory and deliverable work, plus availability for urgent queries between sessions.
Commitment. Day-rate, not a fixed calendar sprint. One day a week suits some organisations; others need more. A fixed retainer gives predictable cost and continuity either way.
Notice. One month. No lock-in beyond the agreed engagement period.
Not sure yet whether this is the right shape? That is what The Sanity Check is for.
Free, an hour, no pitch. An honest outside read on your security strategy and where you stand on AI governance.