Lars Backman
Cybersecurity consultant in Stockholm. I build security machinery for early-stage startups and scale-ups: secure defaults, automated workflows, GRC engineering, and a framework tailored to the organisation. The kind that earns customer trust and stays out of the way of hyper-growth.
Most recently at Legora, driving SOC 2 Type II, ISO 27001 and ISO 42001 through as one of the first organisations in the Nordics — while the company scaled from 40 to almost 500 people, and from $1M to $100M ARR.
First security hire and Security Lead. Owned IT, security, GRC and enterprise solutions engineering, and built the whole function as the company grew from 40 people to nearly 500.
Senior Security Engineer. Appsec, prodsec and security operations for a PCI DSS environment, plus in-house detection and response tooling that resolved events without human triage.
Security Engineer. Joined as Visa was acquiring the company: taking the posture from Swedish startup to enterprise, quickly — application security, incident response, and threat modelling.
Pentester and Cloud Security Lead for Sweden, after their Cyber Security Academy in Copenhagen. Client pentests and cloud architecture reviews.
How I think about security
Many security risks can be engineered away, not just mitigated or monitored. You take them off the table by building systems where the secure path is the default and the insecure path doesn't exist.
That's why I don't argue for shift left or DevSecOps anymore. Security should shift down the stack, and secure defaults should be an architectural decision rather than a process. Engineers get a secure ecosystem to work in, which lowers their cognitive load — and if you run coding agents, the same design gives them a rigorous harness.
Authentication is another example. Passwords are done. Every system should connect through SSO and SCIM, and your central IDP should accept nothing but WebAuthn or FIDO2: passkeys and hardware keys, no SMS codes anywhere. Do that properly and the entire class of phishing-based credential attacks disappears.
Compliance is a byproduct of building this way, not the goal. If you're operating under DORA, GDPR, PCI DSS or ISO 27001, secure by default is the most direct path to certification. And being open about how something works doesn't make it less secure. Usually the opposite.
How I got here
I've been hooked on computers my whole life, but security is the part that really stuck. Struggling to find junior positions, I started as a system administrator instead — that's still the foundation for how I work now. I'll always start by asking how you want to work, because security that's architected well enables exactly that.
After that I got into WithSecure's Cyber Security Academy, and my first security role came out of it. Since then it's been fintech and legal tech. These days I use AI extensively in my own work; it has changed how fast I move, and how much I can reasonably take on.
Work together
Tell me what you're building and what's prompting the conversation. I reply within a day or two.