First as the engineer leading technical response to Codecov at HelloFresh. Later as CISO at Moonfare, coordinating response to a third-party incident where a business counterparty’s breach created potential exposure on our side. Different technical profiles, same operational problem: scan fast, scope impact accurately, brief the board honestly, don’t let the noise derail the business.

I’ve come to think of supply chain as the most under-rated part of the threat model — and the part that’s hardest to run well when everyone’s already tired.

Started with a small senior team — OffSec+AppSec, Detection & Enterprise Security, InfoSec, Cloud — and a clear thesis: onboard an MSSP for SIEM and detection from day one so internal engineers could focus on hardening, vulnerability management, IAM, and policy. Grew mid-level engineers on both red and blue sides over the next two years. Got Moonfare to ISO 27001 in 2024. Took on DevOps and IT in 2024–2025, reaching 16 headcount at peak: 7 security, 5 DevOps, 4 IT.

The artifact I’m most proud of isn’t a tool — it’s the monthly security ops report. Attacks thwarted. Where they came from. MTTD and MTTR. Business cost avoided. Translating operational security into language the rest of the company could actually read.

Set up detection, ran cloud security posture analysis across 50+ AWS accounts, built CloudTrail rules and detection logic that later became the backbone of their SOC. Helped with several incident investigations, did on-site network pentests at their Karachi office, and worked alongside some of their best engineers.

Being embedded — sitting with a customer, inside their environment, at breach volume — teaches you something you can’t learn in an MSSP seat: security as a thing that happens inside someone else’s business, on their clock, with their priorities on your shoulders. Most of what I know about CISO-side tradeoffs started here.