vCISO and Board Advisory
Security strategy, roadmaps, governance models and risk reporting that a board can act on, from someone who has run security across multiple countries.
- Strategy
- Board Reporting
- Vendor Management
Cybersecurity Leadership · vCISO · Board Advisory
I help boards and CISOs secure what the business depends on.
- Enterprise Security Architecture
- AI Security and Governance
20+ Years Securing What Matters Most.
Across payments, banking, manufacturing, and critical infrastructure in India, the Middle East, Southeast Asia, and Europe, I have spent over two decades protecting complex technical ecosystems.
My work spans the complete resilience lifecycle—from designing Zero Trust security architectures and scaling security operations to leading incident response and regulatory compliance.
Today, I help leadership teams navigate the next frontier of risk: governance and security for Artificial Intelligence. I bridge the gap between technical reality and board-level oversight—answering the critical questions on accountability, auditability, and failure mitigation when AI is deployed at scale.
- Based in
- Dubai, UAE
- Markets
- GCC, India and South East Asia
- Sectors
- Payments · BFSI · Critical infrastructure · Manufacturing
- Frameworks
- PCI-DSS · ISO 27001 · NIST · ISO/IEC 42001
- Credentials
- CISSP · SCCISP and more
Where I Add the Most Value
I'm most useful where technology decisions turn into board-level risk decisions, across the whole security programme.
AI Security and Governance
Securing GenAI, RAG and AI agents, and extending the GRC you already run to cover AI, with auditability and human oversight built in.
- NIST AI RMF
- ISO/IEC 42001
- EU AI Act
Security Architecture and Zero Trust
Architecture reviews and threat modelling, Zero Trust and micro-segmentation programmes, identity and secure access for critical environments.
- Zero Trust
- IAM
- Micro-Segmentation
GRC, Compliance and Audit Readiness
Risk assessments, gap analyses and audit readiness across payments, banking and critical-infrastructure regulation.
- PCI-DSS
- ISO 27001
- SOX
- DESC ISR
Cloud, Infrastructure and Resilience
Cloud security architecture and assessments, network and endpoint security, disaster recovery and continuity planning, VAPT.
- Cloud Security
- DR / COOP
- VAPT
Security Operations and Response
Designing SOC and MDR capabilities, SIEM, EDR and DLP, incident response, threat intelligence and vulnerability management.
- SOC / MDR
- Incident Response
- EDR
Open Work: The AI Security Wiki
Most teams securing AI are rebuilding the same controls from scratch. I built the AI Security Wiki so you don't have to.
A free, vendor-neutral framework for security leaders, architects and GRC professionals who are securing AI systems in real environments. Free to use and modify under CC BY-SA 4.0.
- Test cases for evaluating AI security products in a proof of concept
- 629
- Control objectives, each citing OWASP, MITRE ATLAS, NIST AI RMF and ISO/IEC 42001
- 44
- Regional regulatory sections, from the GCC and EU to India and Brazil
- 12
- Fill-in templates, from an EU AI Act classification form to a DPDP processing record
- 51
Experience, in Brief
Employers are described by sector. My full background has the detail.
- 2020 – nowSpecialist, Cybersecurity Engineering, Critical-Infrastructure UtilityLead enterprise security initiatives across traditional infrastructure, cloud, digital platforms and AI systems.
- 2018 – 2019Tech Lead, Cyber Security, Global Technology Consulting GroupCreated a managed detection and response (MDR) framework and built an MSSP capability from the ground up, including SOC workflows, service catalogues, threat intelligence and incident response
- 2016 – 2018Independent Cyber Security Consultant, Enterprises, System Integrators and Cloud-Native CompaniesHelped a payment gateway in Thailand restructure its cloud security controls to achieve PCI-DSS recertification on AWS
- 2009 – 2016Manager, IT Security and Segment Security Officer (APAC), Global Payments CompanyRegional security lead for India, China, the Middle East and Southeast Asia in a payments environment.
Recent Writing
Articles on security leadership, architecture, compliance and AI security. All writing
AI Security Wiki Update: The Regional AI Regulatory Hub
The AI Security Wiki's biggest update yet: regulatory coverage for 12 regions, 51 templates, 44 control objectives and 629 test cases.
The AI Security Wiki: A Free, Vendor-Neutral Framework for Securing AI
Most teams securing AI are rebuilding the same controls from scratch. I built the AI Security Wiki so you don't have to.
Considering a vCISO, an Advisor or a Board Seat?
Tell me what you're working on. I reply personally.