01
A roadmap driven by business risk
Not by whichever vendor shouted loudest, and reported in plain English a board can act on.
Open to speaking and collaboration
Security with no blind side.
cypher has tested for the weaknesses behind security incidents, investigated them and defended against them. Now he builds the programmes that prevent them. Cloud Security Engineer · Application Security Lead at Oyster HR · Security Operations, AppSec, Cloud & AI Security
AppSecat the pull request
CloudAWS and GCP
SecOpsevidence first
What that looks like for your organisation
Five outcomes, each one something a board, an auditor or an engineer can feel.
02
Security that engineers adopt
Enforced at the pull request and routed to the team that owns it, not filed in a quarterly PDF.
03
Incident response that is calm
Evidence-first investigation, with escalation paths to Legal and regulators ready before they are needed.
04
Compliance as an engineering outcome
SOC 2, ISO 27001, PCI DSS and GDPR as by-products of good engineering.
05
Security spend argued as economics
Bug bounties and tooling judged on the risk they avoid, not the activity they generate.
The question behind every audit
Hard questions, plain answers.
Auditors, regulators and boards all ask the same thing: is this under control? I build programmes that answer with evidence, not assurances.
Evidence, not assurances Reported in plain English
Why it holds up
One verifiable claim per chapter: testing, investigating, defending, building.
- 2020–21
Testing
Penetration Tester & SOC Analyst · Visibility Technology ServicesPentested five organisations and wrote the incident response runbooks.
- 2021–22
Investigating
Senior Cyber Security Consultant · PwCLed incident response and digital forensics on incidents with over $7M in associated losses.
- 2022–25
Defending
Lead Senior Cybersecurity Engineer · SBM BankRan security operations for a licensed bank across 1,500 endpoints, and cut detection false positives by 32%.
- 2025–
Building
Application Security Lead · Oyster HRLeading the engineering security programme: application, cloud, CI/CD, incident response and AI security.
AWS Certified Security, Specialty Google Professional Cloud Security Engineer Full background
“What stands out most is his communication and leadership style: clear, firm, and assertive, while consistently respectful and collaborative.”
Engineering Leadership · Oyster HR
Projects
All projects Active
Building a Security Function from Zero: A 12-Month Playbook
A playbook for the first security hire or the engineering leader who owns security by default: what to do in the first 90 days, how to build a roadmap ranked by business risk, what to buy and what to build, when compliance arrives, and how to report progress leadership can act on.
ActiveSecuring Agent Tool Use: An MCP Control Catalogue
A vendor-neutral catalogue of controls for agents that call tools through the Model Context Protocol. It covers tool poisoning, confused-deputy access, weak server authentication and over-privileged credentials, organised by where each control sits in the life of a tool call.
ActiveThreat Modelling AI Systems: From LLM Features to Agents
A practical method for threat modelling anything built on a language model, from a single chat feature to agents that plan, call tools and keep memory. It combines STRIDE, CSA's MAESTRO layers and the OWASP Top 10 for Agentic Applications into one worksheet a product team can actually run.
Blog
All posts Contact
Building a security function, or shipping AI? Let's talk.
Open to speaking and collaboration.