Services

I help Swedish startups scale securely. Usually the conversation starts in one of two ways: you want to build security properly from the start, or an enterprise customer just sent you a questionnaire and you need to get your house in order.

I work with a small number of clients at a time. Mostly companies between early stage and Series D, in fintech and legal tech.

Here's what I help with:

Security Reviews

You have something built and you want to know what's wrong with it. I look at your code, infrastructure, and cloud configuration with full access to how the system actually works. The output is a prioritised list of real issues, with recommendations tied to your specific design and threat model.

A common trigger is a customer asking for an independent security review of a system or a specific feature. If the customer needs a formal pentest report or security review report, I write one.

Things I typically cover:

Security Architecture

You're designing something new, or you need to fix how something is structured. This is forward-looking work: how should the system be built, what controls need to be in place, and what's the plan to get there. The output is a roadmap, not a findings report.

Depending on the engagement, this typically covers some combination of:

Security Engineering

The scaffolding that makes secure development the default. The goal is golden paths: build the approved, secure way to do something so easy that engineers reach for it naturally. Security becomes a property of the system, not something that lives in anyone's head.

Things I typically cover:

Detection Engineering & Incident Response

Building the capability to detect and respond to threats, not just prevent them. This is the operational layer: knowing when something is wrong, having the automation in place to respond, and not relying on someone manually reviewing logs at the right moment.

At Juni I built a full SOAR platform from scratch (serverless, AWS Step Functions). When something triggered, it pulled in context from other log sources automatically and, where needed, reached out directly to the affected user to confirm whether they'd initiated the event. Engineers stayed out of the loop unless it actually warranted escalation.

Things I typically cover:

Compliance & Certifications

ISO 27001, SOC 2, ISO 42001, PCI DSS. If you have a deadline and you're not sure how to get there, I can help you figure it out.

The honest version: compliance gets a lot easier when you've already built things sensibly. If the foundation is there, certifications tend to go faster than people expect. If it isn't, we fix that first.

At Legora, an AI platform for lawyers scaling from 40 to nearly 500 people, we got through ISO 42001 in weeks.

Frameworks I've worked with: ISO 27001 · SOC 2 · ISO 42001 · PCI DSS · GDPR

Fractional Security Lead

All of the above, under one owner. I take full responsibility for security across the organisation: what gets built, in what order, and how it fits together.

For companies that aren't ready for a full-time CISO but need a senior person with real ownership, not just someone to review documents and give opinions.

This can also work as a defined engagement: come in, build the security foundations, define and implement a governance structure, and hand it off to internal leadership in a state they can actually run.

What this typically covers:

Want to talk through what makes sense for you?