VP Cybersecurity Strategy
Link11 GmbH
Dealing with all things security.
Security engineering leadership for regulated businesses — cloud security, detection and incident response, and DevSecOps, under NIS2, DORA, BaFin BAIT and ISO 27001. I've built security functions from the first hire, and been the one accountable when they had to hold up to a regulator.
How I think
Three takes I'll defend.
Security looks like a cost center because it lets itself.
Most security leaders complain the executive team doesn’t see the value. That’s their failure, not the executive team’s. A good security function is operational excellence — time, money and depth defended every day, mostly invisible. Management isn’t paid to go looking for invisible work. They’re paid to ask one question: did we win?
If you have the operational depth and you’re still read as cost, that’s a visibility problem, not a value problem. Name the IR playbook your engineer wrote and what it now blocks in two minutes, automatically. Ship a monthly defensive-uplift report. Make the whole crew visible — not just whoever ran the playbook at eleven on a Sunday night.
Compliance is hygiene or it’s theater. There’s no middle.
Paper compliance looks like 99 of 100 boxes ticked. Then someone goes a layer deeper into access management and finds four teams granting permissions four different ways, none of which match the process written up for the auditor. The policy passed. The practice never changed.
It takes technical depth to find the four silos and a leader willing to pick a fight with all four to fix them. The path of least resistance is to write the policy, pass the audit and call it done — which teaches management exactly the wrong lesson: the first certification was cheap, so the next one will be too. That paper compliance was worse than none arrives with the incident. That’s the bill.
AI in defense rewards the curious.
Good security minds are paranoid. Great ones are paranoid, curious and willing to tinker. AI is the shift that shows which kind you have.
We’ve seen this before. We were paranoid about cloud and wanted the perimeter back. That stance lost — cloud security got rebuilt around the new shape. AI is moving faster, and the headcount excuse is gone: nothing stops a security team from standing up agents and deterministic automation against the backlog except the willingness to learn.
The curious will shape how AI security gets done. The rest will still be drafting the policy that says you can’t use it.
Career
Lahore to Berlin, by way of detection rooms, IaC, and a combined 16-person org.
Sr. Director, Infrastructure & Security (CISO)
Moonfare GmbH
Joined as first security hire; left leading a combined 16 across Security, IT, and Cloud Infrastructure & DevOps. Initiated and led the firm's DORA readiness programme as it moved off a tied-agent model toward direct BaFin supervision under the WpIG. ISO 27001 in 2024, posture improved 300%, AWS spend cut 50%+ via architectural redesign as cost-centre owner, and a company-wide AI governance programme.
- Built the security function to 7 engineers across Detection, AppSec/OffSec, Cloud Security and InfoSec before the scope widened to IT and Cloud Infrastructure & DevOps
- Led DORA readiness end to end — gap assessment, the security function's accountabilities under the regulation, ICT third-party contractual changes, and TLPT scoping
- Owned the AWS relationship as cost-centre owner, and secured financial-services provisions for the firm's most critical cloud dependency
- From no SIEM and a bare-minimum WAF to zero trust, EDR and an in-house-tuned SIEM, with human and machine identities separated and rules tested in purple-team exercises
- ISO 27001 certification, top-tier audit result
- Monthly security ops report as a management artifact: attacks thwarted, MTTR/MTTD, business cost avoided
Progression within Moonfare
Lead Security Engineer
Aug 2021
6 mos
Sr. Security Manager
Feb 2022
1 yr 8 mos
Director of Security (CISO)
Oct 2023
2 yrs
Sr. Director, Infra & Security (CISO)
Sep 2025
5 mos
Senior Security Engineer
HelloFresh Group
Investigated and mitigated the Codecov supply-chain incident (among others), earning company-wide recognition for response quality. Shipped Python/Docker/Terraform tooling that reshaped forensic speed, and built a custom vulnerability management CLI integrating Jira + GitHub across 1,000+ repos.
DevSecOps Engineer
About You SE & Co. KG
Wrote IaC — Ansible, Terraform, CloudFormation, Packer — to deliver security-hardened AWS infrastructure for an enterprise e-commerce PaaS. Built deployment pipelines with health checks, security rulesets, and guardrails embedded directly as code.
The move January 2019
PK → DE Lahore → Hamburg
Senior Security Engineer (MSSP / SOC)
Ebryx (Pvt.) Ltd.
Worked 24/7 SOC floors. Engineered detection playbooks and SIEM correlation rules against MITRE ATT&CK for IOC hunting and anomaly detection. Embedded as resident security engineer for core clients — built custom AWS monitoring on CloudTrail, VPC Flow Logs, and GuardDuty that became backbone infrastructure at Careem/Uber MEA.
- Detection engineering + SIEM correlation at MSSP scale
- Cloud posture analysis across 50+ AWS accounts at Careem
- On-site incident investigations and network pentests in Karachi
Progression within Ebryx
Associate Security Engineer
Aug 2015
6 mos
Security Engineer
Feb 2016
1 yr 5 mos
Sr. Security Engineer
Jul 2017
1 yr 6 mos
B.E., Computer Software Engineering
National University of Sciences & Technology (NUST)
Where hands-on network security — pfSense, Untangle, L0phtCrack, John the Ripper — pulled me out of traditional dev and into cyber for good.
Moments
The calls behind the timeline.
A moment
01 of 03
Supply chain — twice, two hats
Different hats. Same muscle.
A supply-chain incident is a leadership test before it's a technical one. You can run the IR perfectly and still fail on communication.
First as the on-call engineer responding to Codecov at HelloFresh. Later as CISO at Moonfare, coordinating response to a third-party breach that created potential exposure on our side. Different technical profiles, same operational problem: scan fast, scope impact accurately, brief the board honestly, don’t let the noise derail the business.
Supply chain is the most under-rated part of the threat model — and the hardest to run well when everyone is already tired.
A moment
02 of 03
Moonfare — first hire to 16
Rent the triage. Own the detection.
Every control had to earn its place before it went in. I wanted a function that moved the business, not one that reacted to it.
The first call was what to rent and what to own. Detection started from zero: no SIEM, no EDR. An MSSP ran the SIEM setup and L1 triage at first, which freed the engineers I hired for hardening, vulnerability management, IAM and policy. Rule tuning, L2 analysis and incident response stayed in-house from day one, with the rules tested in purple-team exercises, and once the team matured we dropped the MSSP and took triage in-house too. The second call was to grow mid-level engineers on both the red and blue sides rather than hiring a senior into every seat.
The artifact I’m proudest of isn’t a tool. It’s the monthly report that put security in language the rest of the company could actually read.
A moment
03 of 03
Careem — embedded, Lahore & Karachi
Resident engineer, 50+ AWS accounts.
Careem became my employer's client after a security incident. I got loaned out to build their detection capability from scratch.
Set up detection, ran cloud security posture analysis across 50+ AWS accounts, and built the CloudTrail rules and detection logic that became the backbone of their SOC. Ran incident investigations and on-site network pentests out of their Karachi office.
Being embedded teaches you what an MSSP seat can’t: security as something that happens inside someone else’s business, on their clock, with their priorities on your shoulders. Most of what I know about CISO-side tradeoffs started there.
Credentials
One for the board. One for the bench.
Stanford University
Advanced Cybersecurity Certificate of Achievement
Five courses, 60+ hours: Foundations of Information Security; Using Cryptography Correctly (XACS130); Exploiting and Protecting Web Applications (XACS133); Cloud Security (XACS235); Network Security (XACS255) — taught by Dan Boneh, John Mitchell and Neil Daswani.
SANS SEC540 · Cloudwars
I won the Cloudwars Challenge Coin — the SEC540 capstone, scored live against the rest of the class on attacking and defending a cloud-native pipeline.
Leadership
What makes me credible in a boardroom.
- GSTRT — GIAC Strategic Planning, Policy & Leadership
- GSLC — GIAC Security Leadership Certification
- GIAC Advisory Board Member
- CISM — Certified Information Security Manager (ISACA)
Technical
What keeps me honest in engineering conversations.
- CDP — Certified DevSecOps Professional
- GCSA — GIAC Certified Cloud Security Automation
- AWS Certified Security — Specialty
- AWS Solutions Architect — Associate
Badges verifiable on Credly.
Education
Where the formal grounding came from.
B.E., Computer Software Engineering
National University of Sciences & Technology (NUST), Islamabad · 2011–2015