services
I help Swedish startups scale securely. Usually the conversation starts in one of two ways: you want to build security properly from the start, or an enterprise customer just sent you a questionnaire and you need to get your house in order.
I work with a small number of clients at a time. Mostly companies between early stage and Series D, in fintech and legal tech.
security-reviews.md vulnerabilities
I look at your code, infrastructure, and cloud configuration with full access to how the system actually works. The output is a prioritised list of real issues, with recommendations tied to your specific design and threat model.
A common trigger is a customer asking for an independent security review. If they need a formal pentest or review report, I write one.
This was the core of my work as WithSecure's Cloud Security Lead for Sweden: client pentests, cloud security architecture reviews, and the written reports that went on to their own customers.
- Penetration testing
- Code and application review
- Cloud infrastructure, configuration, and access control review
security-architecture.md roadmap
You're designing something new, or you need to fix how something is structured. Forward-looking work: how should the system be built, what controls need to be in place, and what's the plan to get there. The output is a roadmap, not a findings report.
At Tink I joined as Visa was acquiring the company — taking an open banking platform from Swedish startup posture to Visa enterprise, quickly.
- Threat modelling and risk prioritisation
- Zero trust and secure defaults
- Cloud and infrastructure security (AWS, Azure, GCP)
- Access control and identity management
- Architecture controls for OWASP Top 10 risks
- AI system security and risk controls
security-engineering.md secure defaults
The scaffolding that makes secure development the default. The goal is golden paths: build the approved, secure way to do something so easy that engineers reach for it naturally. Security becomes a property of the system, not something that lives in anyone's head.
At Juni, an EMI-licensed fintech running a PCI DSS environment, I built this layer from scratch: pipeline controls, secrets management, IaC scanning, and secure defaults engineers got automatically.
- Secure CI/CD pipeline controls
- Secrets management and secure defaults
- IaC security controls and policy enforcement
- SAST/DAST integration
- Dependency and supply chain security
- Developer security tooling and golden paths
detection-and-ir.md operations
Building the capability to detect and respond to threats, not just prevent them. Knowing when something is wrong, having the automation in place to respond, and not relying on someone manually reviewing logs at the right moment.
At Juni I built a full SOAR platform from scratch on AWS Step Functions. When something triggered, it pulled context from other log sources automatically and reached out to the affected user to confirm whether they'd initiated the event.
- Threat modelling for detection coverage
- Detection engineering and threat detection rules
- SIEM implementation and tuning
- SOAR platform build-out and automation
- Incident response playbooks and runbooks
- Alert triage and automated remediation pipelines
compliance.md certification
ISO 27001, SOC 2, ISO 42001, PCI DSS. If you have a deadline and you're not sure how to get there, I can help you figure it out.
The honest version: compliance gets a lot easier when you've already built things sensibly. If the foundation is there, certifications tend to go faster than people expect. If it isn't, we fix that first.
At Legora, an AI platform for lawyers scaling from 40 to nearly 500 people, we got through ISO 42001 in weeks.
security-lead.md full-ownership
All of the above, under one owner. I take full responsibility for security across the organisation: what gets built, in what order, and how it fits together. For companies that aren't ready for a full-time CISO but need a senior person with real ownership.
This can also work as a defined engagement: come in, build the foundations, implement a governance structure, and hand it off to internal leadership in a state they can actually run.
At Legora I was the first security hire, at around 40 people. I owned IT, security, GRC and enterprise solutions engineering as the company grew to nearly 500 and went from $1M to $100M ARR in 18 months.
- Security strategy and roadmap
- Security hiring and team building
- Board and investor reporting on security posture
- Vendor and tooling decisions
- Compliance programmes
- Security incident response ownership
Let's talk through what makes sense for you
Tell me what you're building and what's prompting the conversation. I reply within a day or two.