I audit organizations against NIS2 requirements and architect the Zero Trust roadmaps that close the gaps. GIAC-certified across eight domains, including Defensible Security Architecture (GDSA, Zero Trust) and Cloud Security Automation (GCSA, earned with honors). GIAC Advisory Board member, an invitation reserved for exam scores of 90 or above. 10+ years of security work spanning U.S. federal agencies, financial services, and EU environments.
If your organization falls under NIS2 and you want a gap assessment or a Zero Trust architecture review, email me directly. No intake forms, no sales layer. You talk to the auditor.
The law is already in force. Poland’s amended National Cybersecurity System Act (the KSC Act), which implements NIS2, took effect on April 3, 2026. It covers roughly 42,000 companies across 18 sectors: energy, transport, banking, healthcare, digital infrastructure, manufacturing, public administration, and more.
The deadlines are close.
The penalties are real. Fines reach 10 million EUR or 2% of global turnover for essential entities, and management can be held personally liable for compliance failures.
If you have not yet confirmed whether your organization is covered, that is the first conversation to have. It costs you one email.
NIS2 gap assessment. I map your current controls against the directive’s risk-management measures and incident-reporting duties, then deliver a prioritized, evidence-based findings report your leadership can act on.
Zero Trust architecture review and roadmap. Target architectures grounded in NIST SP 800-207 and defensible security architecture principles: identity, network segmentation, least-privilege access, and monitoring, sequenced so each step reduces real risk.
Penetration testing and full-access audits. GWAPT-certified (with honors) web application testing with OWASP Top Ten coverage, plus full-access (white-box) audits that show what a malicious insider or compromised account could actually reach: identity permissions, lateral movement paths, and sensitive data exposure. Clear remediation reports your teams can act on, with findings that map back to your compliance evidence, not a theatrical red-team exercise.
Audit readiness. Documentation, evidence collection, POA&M management, and incident-response tabletop exercises, so the real assessment holds no surprises.
Cloud and identity security. Hands-on reviews of Azure, AWS, and Microsoft Entra ID environments, from account audits to vulnerability management programs.
Frameworks I work in: NIS2, DORA, GDPR (Article 32 security measures), the EU Cyber Resilience Act, ISO/IEC 27001, NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-207 (Zero Trust), CIS Critical Security Controls, and the OWASP Top Ten.
Most gap assessments run four to six weeks, scoped to your size and sector.
Weeks 1-2: Scoping and evidence. Confirm your entity classification (essential or important), map the systems in scope, and collect existing policies, registers, and evidence.
Weeks 3-4: Assessment. Controls review against the KSC Act’s risk-management measures, identity and access audit, and validation testing where agreed.
Weeks 5-6: Findings and roadmap. Prioritized findings report, a remediation roadmap with owners and timelines, and an executive briefing for management.
You end with three things: a gap register mapped to the law’s requirements, a board-ready summary, and a remediation plan your team can execute alone or with my help.
No invented testimonials here. These are anonymized, verifiable outcomes from my security and audit work in U.S. federal and financial-services environments.
Kept seven U.S. federal systems audit-ready in XACTA, closed 15+ POA&Ms, and maintained ~90% security-documentation compliance.
Audited 500+ Microsoft Entra ID accounts, uncovering 10+ unauthorized users and driving immediate corrective action.
Evaluated 20+ internal-threat controls at a major U.S. financial institution and surfaced weak controls for targeted refinement.
Ran an incident-response exercise with 15+ participants that exposed three critical security gaps and triggered focused remediation.
Free 1-page checklist: 23 essential NIS2 controls mapped to your organization type (essential vs. important entity). No signup required, just your email.
No spam. One email per month with audit insights.
Cost depends on your organization size, sector classification (essential vs. important), and systems in scope. I provide a transparent fixed quote after a free 30-minute scoping call. No obligation, no sales layer.
A typical gap assessment runs 4–6 weeks: Weeks 1–2 (scoping & evidence), Weeks 3–4 (assessment & testing), Weeks 5–6 (findings & remediation roadmap). Larger organizations or multi-site deployments may run 8–10 weeks.
Both. NIS2's "important entity" tier is built around mid-sized companies, and the engagement scales to your size: a 50-person company gets a tightly scoped assessment, not an enterprise-shaped process.
That's a free conversation. Email me your organization's size, sector, and main services. I'll tell you if NIS2 covers you, by what date, and what your first step should be. No obligation.
Yes. I run incident-response tabletop exercises tailored to your sector and threat model, and I can help build or review your incident-response plan to meet NIS2 requirements.
• Engineered cloud security governance by deploying Cloud Custodian on AWS, writing custom Python-based policies to enforce compliance and auto-remediate risks.
• Executed penetration testing on web applications, identifying critical vulnerabilities and partnering with developers to patch code before production deployment.
• Deployed AI-based security guardrails within CI/CD pipelines, automatically blocking risky code changes and reducing manual code review time.
• Audited 500+ Microsoft Entra ID accounts, uncovering 10+ unauthorized users and driving immediate corrective action.
• Kept seven federal systems continuously audit-ready in XACTA and closed 15+ POA&Ms to maintain regulatory alignment.
• Provided weekly Zero Trust architecture guidance (GDSA-certified) for transitioning cloud systems toward a Zero Trust maturity model.
• Led an incident-response tabletop exercise with 15+ participants that surfaced three critical security gaps.
• Evaluated 20+ security controls and recommended architectural changes that strengthened risk detection and incident response.
• Audited mobile application source code against the OWASP Top Ten, verifying secure coding practices and strengthening compliance review policies.
NIS2 Readiness Assessment, Security Auditing, Compliance Frameworks (NIST, ISO 27001), XACTA, POA&M Management, Risk Assessment, Security Controls Assessment, Incident Response Tabletop Exercises, OWASP Top Ten
Zero Trust Maturity Models, Defensible Security Architecture (GDSA), Identity Security (Microsoft Entra ID), Least-Privilege Firewall Design, Vulnerability Management (Tenable, BigFix, Defender for Cloud), Splunk Threat Detection, Penetration Testing
Microsoft Azure, AWS, Cloud Security, Infrastructure Management, Virtual Machines, Network Security, Azure Active Directory, Microsoft Entra ID, Cloud Backup Solutions, Disaster Recovery
Sharing insights on cybersecurity, technology trends, and professional development.
View All Posts →700 mapping cells later: interim results from my SANS research mapping federal cybersecurity guidance against the OWASP Top 10 CI/CD Security Risks, and the four gap areas every pipeline owner should check.
Read More →Poland's KSC Act gives covered entities until October 3, 2026 to self-identify and register. A practical walkthrough of who is covered, what registration requires, and the three-step check to run this month.
Read More →How my hands-on experience building CI/CD pipelines turned into a formal research whitepaper mapping federal security guidance against real-world pipeline vulnerabilities.
Read More →This site is scanned weekly for secrets, vulnerabilities, and code security issues using open-source tools. View scan history on GitHub