Available for consulting · Remote & Hybrid
Security that works for people, not just auditors.
ISO 27001:2022 Lead Auditor, AI governance specialist, and IT GRC consultant helping organisations across the EU and DACH region build security cultures that last - not just pass audits.
About
Most organisations approach information security as a compliance exercise. They get certified, file the paperwork, and move on - until the next audit. I think that's the wrong way around.
With over 25 years across IT management, quality assurance, and information security - and having worked hands-on with organisations from Greek manufacturing SMEs to German IT services firms - I've seen what happens when security is bolted on versus built in.
I hold both ISO 27001:2022 Lead Auditor and ISO/IEC 42001 AIMS certifications, putting me at a rare intersection: the two governance frameworks that matter most right now as the EU AI Act comes into force. I help you meet the requirements - and understand why they exist.
I work remotely and in hybrid models, in Greek, English, and German. Whether you're a Mittelstand company preparing for surveillance, a Greek firm navigating NIS2, or a startup building AI products under the EU AI Act - I can help you move forward with clarity.
Video
I'm building a video series on information security, AI governance, and practical compliance - aimed at the people who actually have to implement this stuff, not just read about it. Short, plain-language, no jargon for its own sake.
Subscribe on YouTubeLinkedIn Articles
Most information security management systems look great on paper and achieve very little in practice. Here's what separates the ones that work.
Read on LinkedIn → CultureControls are necessary. They're not sufficient. The organisations that maintain certification without drama are the ones that figured this out.
Read on LinkedIn → Series · Ch. 1A clause-by-clause walk through ISO 27001 for practitioners. Chapter one: understanding your organisation's context before anything else.
Read on LinkedIn → Series · Ch. 2Who actually cares about your ISMS - and what do they really want from it? Chapter two digs into the stakeholder map most people draw wrong.
Read on LinkedIn → Series · Ch. 3Defining scope is where most ISMS projects make their first quiet mistake. Chapter three on drawing boundaries that actually mean something.
Read on LinkedIn → Series · Ch. 4The SoA is often treated as a formality. Chapter four on why it's actually one of the most strategic documents in your entire ISMS.
Read on LinkedIn →Services
Contact
Whether you're preparing for your first ISO 27001 certification, navigating an EU AI Act compliance question, or just want a second opinion on your ISMS - I'm happy to have a first conversation with no obligations attached.
I work with organisations of all sizes, from Mittelstand companies in Germany to startups and public sector bodies in Greece. Remote-first, available across time zones.