I build the controls I sign.
Security engineering leadership for regulated businesses — cloud security, detection and incident response, and DevSecOps, under NIS2, DORA, BaFin BAIT and ISO 27001. Most of my career was spent on the grittier end of that sentence: running detection on 24/7 SOC floors in Lahore, writing IaC at About You in Hamburg, responding to the Codecov incident at HelloFresh.
At Moonfare I joined as the first security hire and left leading a combined 16 across security, IT, and cloud infrastructure & DevOps. I also initiated and led the firm's DORA readiness programme as it moved off a tied-agent model toward direct BaFin supervision — the gap assessment, the security function's accountabilities under the regulation, the ICT third-party contract changes across critical vendors, and the AWS relationship I owned end to end as cost-centre holder. I left in January 2026, ahead of the licence: the work was preparing the firm for direct supervision, not the outcome itself.
Today I'm VP Cybersecurity Strategy at Link11.
Writing on security engineering in regulated estates — what NIS2 and DORA ask of the controls — and testing where AI earns its keep in defensive security.
Different hats. Same muscle.
A supply-chain incident is a leadership test before it's a technical one. You can run the IR perfectly and still fail on communication.
First as the on-call engineer responding to Codecov at HelloFresh. Later as CISO at Moonfare, coordinating response to a third-party breach that created potential exposure on our side. Different technical profiles, same operational problem: scan fast, scope impact accurately, brief the board honestly, don’t let the noise derail the business.
Supply chain is the most under-rated part of the threat model — and the hardest to run well when everyone is already tired.