CISO · Cyber Risk Advisor · Active Defender · Zürich
Twenty-five years across Tier 1 financial services and Big Four — staying technically sharp while being heard in the boardroom.
The combination that matters: someone who can read a threat at protocol level and explain its business consequence to a CFO in sixty seconds. Most security leaders do one or the other well. The work I'm proud of required both in the same conversation.
Board and C-suite risk advisory across Tier 1 banking and Big Four professional services. Investment cases that moved multi-million CHF decisions. Risk appetite conversations, vendor challenges, regulatory briefings.
Cloud and AI security architecture, DevSecOps, application security, and active deception technology — built and operated in production. The technical credibility is what makes the board conversations land.
Transformed the security posture of online and mobile banking platforms serving 650,000 customers — zero high/critical production findings since 2017. Board-level advisory on existential and reputational risk. Drove the shift to a DevSecOps mindset across IT development teams. Security advisor for the Credit Suisse Italy migration into UBS, ensuring a secure, high-integrity transition with zero incidents throughout.
Enterprise CISO for PwC Switzerland. Challenged a 20-year assumption that end-users needed local admin rights — dismantling it enterprise-wide and cutting malware incidents by 99%. Chaired the EMEA Security Group across 60 territories and 150,000 employees; member of the Global Information Security Solutions Board. Trusted advisor to the General Counsel and Risk Management Partners on security risk. Managed CHF 500k–2M annual security investment.
Built from the observation that internet-facing systems are probed relentlessly — and defenders spend most of their energy trying to repel that noise.
The alternative: embrace attackers rather than block them, and feed them synthetic environments that look real but aren't. Attacker persistence becomes a liability for the attacker. MIRE/C³ is that idea in production.
A distributed honeypot array generating real-time attacker behaviour intelligence from live internet-facing traffic. Presented at the SIGS SOC Forum 2023.
Contributed improvements back to the OpenCanary open-source project — pull requests reviewed and accepted by the maintainers.
Want to talk security, deception tech, or about something that keeps you up at night?