“Organisations rarely lose control suddenly. Warning signs often appear long before consequences become material.”
Escalation
The earliest warning signs are often the easiest to ignore
Confidence is deteriorating
Leadership is no longer certain that risks are understood, owned, and under control.
Questions are being asked
Boards, regulators, investors, clients, legal counsel, or auditors require answers that withstand challenge.
Exposure is becoming visible
Risk begins to affect growth, investment, valuation, market access, reputation, or stakeholder confidence.
Consequences are materialising
An incident, breach, regulatory inquiry, dispute, or crisis demands immediate leadership and defensible decisions.
When it matters
Defensible decisions under pressure
I’m brought in when the cost of being wrong is high: legally, operationally, or reputationally.
-
Regulatory scrutiny
Regulators require answers, evidence, and decisions that withstand formal challenge.
-
Board accountability
Leadership must justify ownership, oversight, and decisions with confidence.
-
Material exposure
Exposure has become significant enough to require intervention or explicit risk acceptance.
-
Strategic decisions
Important decisions carry consequences that may be difficult to reverse.
-
Decision deadlock
Stakeholders disagree on exposure, priorities, obligations, or acceptable risk.
-
High-consequence initiatives
Critical programmes demand independent judgement before commitments are made.
Restoration
Regaining control
-
Clarity
Understanding what matters, what is at risk, and what comes next.
-
Ownership
Clear ownership of decisions, priorities, and organisational outcomes.
-
Direction
A clear path forward through uncertainty, complexity, and disruption.
“The wrong diagnosis makes even excellent execution expensive.”
Approach
Establishing reality
-
What do we really know?
Separate evidence from opinion and establish what can actually be substantiated.
-
What are we assuming?
Challenge accepted conclusions and expose blind spots before they become consequential.
-
What are we trying to solve?
Examine underlying causes before committing resources to treating symptoms.
-
What matters most?
Distinguish the urgent from the important and decide what can wait.
Perspective
Across boundaries
When trust breaks, consequences follow: exposure escalates, scrutiny intensifies, and organisations lose control. My work restores clarity, ownership, and direction where uncertainty and fragmentation threaten organisational stability.
Having worked across executive leadership, operations, commercial strategy, enterprise risk, compliance, legal affairs, data protection, cybersecurity, and engineering, I connect risks others treat separately and establish coherent direction.
This lets me cut through complexity, stabilise high-risk situations, and translate competing priorities into defensible decisions and effective, coordinated action.
Where failure carries material consequences, sound judgement demands the courage to challenge assumptions, the discipline to confront uncomfortable truths, and the resolve to act decisively under pressure.
The earliest warning signs are often the easiest to ignore. This is where I step in. Whether risk is emerging or already materialising, I operate where most hesitate: turning silence into dialogue, uncertainty into action, and risk into strength.
Integration
Combining what others separate
-
Executive
judgementForged through accountability, scrutiny, and consequential trade-offs.
-
Technical
depthGrounded in engineering, architecture, and operational reality.
-
Regulatory
insightShaped by legal practice, supervisory challenge, and enforcement.
Execution
15+ years operating under pressure
Some of the most important work takes place under conditions that do not permit public disclosure.
-
Undetected criminal activity
threatened critical infrastructureDuring an assessment of a multinational mobility platform operating across 100+ countries, I uncovered an unsuspected compromise of its production environment. A cloud component had been covertly reconfigured, enabling criminal actors to exploit critical infrastructure without detection.
My investigation established deliberate insider involvement through misuse of privileged access and identified infrastructure used to host and distribute child sexual abuse material. I briefed executive leadership, led technical coordination with law enforcement, and facilitated on-site forensic examination.
I directed and executed the remediation, shutting down compromised infrastructure, removing illicit material, and securing the affected environment. The incident was resolved without becoming public, limiting significant legal, regulatory, and reputational exposure.
-
Regulatory and banking barriers threatened cryptocurrency market entry
The Netherlands’ first Bitcoin exchange faced significant technical, regulatory, and banking requirements before commercial operations could begin. Secure trading infrastructure, cryptocurrency custody, customer identification, and financial crime controls were essential to making the business operational.
As one of the principal contributors, I engineered the exchange platform and its security architecture, integrating cryptocurrency custody, transaction integrity, and AML/KYC controls. I designed secure identity verification workflows, and implemented data segregation and retention safeguards, and demonstrated the effectiveness of these controls.
The exchange obtained the necessary licence and banking approval, enabling its successful market entry with security, privacy, and compliance embedded from inception. Within its first year, the business was acquired by US-based Kraken.
-
Security weaknesses threatened
patient data protectionA healthcare platform supporting patient self-assessment, medical records, and video consultations failed a security audit I conducted and an external penetration test while already serving patients. The failures exposed weaknesses in security, data protection, and operational assurance.
Through source-code review, I identified application security vulnerabilities, weaknesses in access control, and systemic deficiencies in secure development and data protection practices. I advised leadership on remediation priorities, established security and data protection standards, and implemented critical controls while directing their adoption across the organisation.
The organisation subsequently achieved ISO/IEC 27001 and NEN 7510 certification, while a follow-up independent penetration test identified no significant security findings.
-
Recurring outages triggered
regulatory scrutinyA high-volume European travel platform experienced recurring outages and booking failures, attracting scrutiny from the Dutch consumer regulator (ACM), including threats of enforcement action. Architectural weaknesses and infrastructure instability compromised service availability, while responsibility for hosting failures remained disputed with an external IT partner.
My assessment identified architectural deficiencies and confirmed hosting problems contributing to the outages. I advised leadership on remediation priorities, redesigned and implemented improvements to critical components, and supported the transfer of hosting services. I also engaged directly with the ACM to address its concerns and demonstrate corrective action.
The intervention eliminated recurring outages, restored reliable booking operations, and achieved a 500-fold performance improvement. The ACM’s concerns were resolved, with the threat of enforcement withdrawn.
-
Enterprise growth exposed gaps
in governance and controlA growing technology company faced increasing demands from enterprise customers as contractual, regulatory, and security requirements became more complex. Internal controls, development practices, and operational governance had not kept pace with the organisation’s commercial development.
I assumed responsibility across information security, data protection, legal, and compliance functions, establishing an ISMS and PIMS from the ground up and leading the organisation through ISO/IEC 27001 certification. I strengthened internal controls and contractual risk management, introduced formal governance structures, and led enterprise customer security and privacy due diligence.
The organisation achieved ISO/IEC 27001 certification with additional privacy controls in place, established more mature governance, and satisfied enterprise customer assurance requirements.
“The objective is not to eliminate risk. It is to make informed decisions about it.”Leadership & Advisory