I grew up in South Africa, studied computer systems engineering and have spent the last 20-odd years working at the intersection of security, technology, and business.
In 2004 we co-founded Xantium Integrated Solutions. We built it into a PCI-accredited secure card and SIM manufacturing company serving banks and financial institutions across southern Africa, and in 2016 were acquired by IDEMIA, one of the world’s largest identity technology companies. I stayed through the transition and eventually moved into digital sales for their African operations, focused on eKYC, biometrics, and payment solutions.
In 2020 I moved to Munich. The city suited me. I joined an AI-powered industrial IoT scale-up, built their ISO 27001 ISMS from scratch, and got promoted from security engineer to team lead in about six months.
Since then I’ve been doing the work I find most interesting: building security programs, advising private equity firms on technology due diligence, and helping companies navigate the compliance landscape that has landed on everyone in Europe at once — ISO 27001, NIS2, GDPR, the EU AI Act, the Cyber Resilience Act.
Along the way: CISSP (2006), OSCP (2008), PMP, CISM, CCSP, ISO 27001 Lead Implementer, and a few more recent ones. I finished a Bachelor’s degree at the University of Johannesburg in my mid-thirties, because I wanted to, not because any job required it.
I’ve spoken at the IT-GRC-Kongress on AI risk management, BrightTalk on SSO and automation, and ZACON on locksport — a different kind of security.
Outside of work: cooking, cycling, running, kitesurfing when I can get to the coast.
This site is where I write about security, technology, and whatever else ends up on my mind.