$ whoami — security · communications · research · action

Works in theory.
Works in practice.

Head of information security & compliance at a private risk advisory — Security, compliance and IT.

I built its ISO 27001 ISMS to UKAS-accredited certification, designed its security architecture, and deliver evidence-grade investigations to legal standard.

Before this, eight years in UK policing: child-abuse investigator, sergeant, and operational communications manager leading a nine-person communications function. Trained in philosophy and public policy, with mixed-methods research at the Master's level.

$ key achievements
ISO
27001:2022 ISMS taken to UKAS-accredited certification — covering all 93 Annex A controls.
218
individuals found over-checked in a screening gap analysis across all 1,429 staff of a client.
482
exhibits assembled into an evidence-grade corpus — a second case ran to 321 exhibits, every exhibit integrity-stamped.
£270k
budget negotiated to build a nine-person communications team from scratch — recruitment, licensing, training and CPD.
2,000
officers and staff reached through daily and weekly internal news; led all communications across South-Central London during Operation Bridges.
Nat'l
rollout of the "Walk and Talk" police–public engagement campaign — co-designed it, built it, then trained other forces to implement it across the country.
800k
regular audience for crisis and public engagement work. Created first training framework for operational communicators.
$ experience
·
  • Built the ISO/IEC 27001:2022 ISMS to UKAS-accredited certification: all 93 Annex A controls in an approved Statement of Applicability, a full policy suite, risk register, asset register and supplier-assurance process.
  • Consolidated the controlled document set from ~120 to 68, cutting monthly review load from nine documents to five while retaining every mandatory ISO record.
  • Hold and renew Cyber Essentials (certified 2025, v3.2; renewed August 2026, v3.3), with live remediation during assessment.
  • Run the UK GDPR / Data Protection Act programme: ROPA, DPIA and data-subject-rights procedures, a personal-data-breach procedure with the 72-hour ICO notification path built into business continuity, and lawful-basis analysis underpinning every investigation.
  • Designed and maintain the security architecture.
  • Business development: authored a screening-governance proposal that converted into live delivery, ran a UK public-procurement tender pipeline, and developed the firm's Trust Centre and brand assets.
  • Founded and direct the company, which exists to advance public education in AI and digital skills, with priority given to the digitally excluded.
  • First programme, Come Try AI: free hands-on public workshops that teach people to use AI tools safely and effectively to improve their lives.
  • First workshop day runs in September 2026, with 64 places.
  • Specialist on Clear, Hold, Build, the Home Office programme against organised crime.
  • Communications and intelligence work across the programme.
  • Communications Manager for South-Central Division (Oct 2023 — Oct 2024), directing messaging and information flow across live incidents.
  • Supervised and developed a team of up to eight — tasking, welfare, standards and performance.
  • Made time-critical decisions in fast-moving situations, coordinating between frontline units and command.
  • Conducted safeguarding investigations, building court-standard case files and managing evidence with rigorous chain of custody.
  • Worked across multi-agency safeguarding arrangements — social care, health and the CPS.
  • Balanced victim care and welfare with evidential and procedural demands under sustained emotional load.
  • Joined via Police Now's competitive graduate leadership scheme, policing a dedicated neighbourhood as a frontline emergency-response officer.
  • Assisted the major investigation Operation Knowlton, which saw five defendants jailed for life for murder; managed the initial scene of a fatal road-traffic major incident — first aid, evidence, and coordination of arriving responders.
  • Built community trust, handled incidents end-to-end, and developed the investigative and communication foundations the later roles were built on.
  • Worked in a small team on a knowledge-management and recruitment problem in British law enforcement, applying the ArchiMate business-architecture framework.
  • Combined the team's analysis into recommendations that were well received by the client.
$ selected work

Selected work across security, compliance, investigations, applied AI and communications. Details generalised to protect client confidentiality.

Built the organisation's ISO/IEC 27001:2022 ISMS to UKAS-accredited certification — all 93 Annex A controls in an approved Statement of Applicability, a full policy suite, and the risk, asset and supplier-assurance processes behind them. Consolidated the controlled document set from ~120 to 68 while retaining every mandatory record.

Assembled and structured a 482-exhibit evidence corpus documenting intimidation and its business impact, organised and cross-referenced to withstand legal scrutiny, in only two days.

Delivered a solicitor-instructed asset-tracing investigation across 321 exhibits, with every exhibit integrity-stamped so its authenticity and timing can be independently verified.

Assessed the screening status of all 1,429 staff of a client in only a few hours, surfacing 218 individuals over-checked and two hard legal safeguarding gaps — turning the findings into a remediation and governance proposal and advising the compliance posture of the policy solution.

Designed and built a private, locally-hosted team of models on my own hardware, for research and analysis where the material stays on the premises. Models chosen for intelligence, independence and integrity, with every output verified against source; paired with a redaction gateway that strips personal data before any prompt reaches a cloud model.

Created the “Walk and Talk” campaign to improve communication between police and the public — designed the internal administrative structure, the feedback and information-gathering survey, and all marketing materials, then trained other forces to implement it across the country.

Managed all communications across South-Central London during Operation Bridges following the Queen's passing — social-media monitoring, live local campaigning, internal operational communications, and advising management, colleagues and partners.

$ certifications
ISO/IEC 27001:2022 — built and run the organisation's certified ISMS (UKAS-accredited)
ORG CERTIFIED
Cyber Essentials — certified 2025 (v3.2); renewed August 2026 (v3.3)
ORG CERTIFIED
ISC2 Certified in Cybersecurity (CC)
CERTIFIED
$ education
MSc, Public Policy — Maastricht Graduate School of Governance
2016
MSc, Human Development — United Nations University (UNU-MERIT)
2016
BA Social Science (Politics and Philosophy) — University of Manchester, 2012–15; modules across politics, philosophy, sociology and anthropology
2015
$ capabilities
Security & Compliance
ISO 27001 UK GDPR / DPA Cyber Essentials Risk management Policy & governance Supplier assurance
Investigations & OSINT
Evidence handling Chain of custody Asset tracing Screening & vetting Intelligence analysis
Engineering
Network segmentation Firewalls / VLAN Google Workspace admin Linux / RPi hardening Python Self-hosting
Research & Methods
Mixed-methods Quantitative analysis Qualitative research Survey design Interviews Statistical software
Communications
Crisis & ops comms Public affairs & media Media production Campaign design Audience insight Writing & rhetoric
Detection & Monitoring
Wazuh SIEM/XDR Alert triage Detection rules File integrity monitoring Vulnerability management Active response
$ applied ai
Speed of delivery
AI-assisted workflow

Use AI across research, drafting, and analysis to compress work that would otherwise take days into hours — while verifying every output against source.

Private local model team
3 GPUs · ~72 GB VRAM · fully local

Built a private, locally-hosted team of models for research and analysis where the material stays on the premises. Models chosen for intelligence, independence, and integrity.

Custom quantisation & pruning
completed · retired on evaluation

Built a custom expert-pruning pipeline (REAP, extended to run data-parallel across three GPUs, about 2.4× faster) and produced a pruned model to fit capable models to the hardware. Evaluated it head-to-head on the tasks that matter and retired it when newer models beat it.

Redaction gateway
cloud-LLM safety boundary

Strips personal data before any prompt reaches a cloud model.

$ making / homelab
Wazuh SIEM/XDR lab
Wazuh 4.14 · Raspberry Pi · six agents

Wazuh 4.14 (OSSEC-based SIEM/XDR) deployed all-in-one on a Pi with six agents: FIM, vulnerability management, custom decoders and correlation rules, rule tuning, centralised agent config, active response (iptables block), CIS SCA review, index retention, ntfy alerting, daily alert triage.

Photography
street & documentary · London

See the gallery →

Miniature painting
hand-painted · 28mm

Hand-painted tabletop miniatures.