I help you manage information and cyber security. From an initial risk assessment to implementing controls and reporting to management.
Together, we set clear priorities, assign responsibilities and build a practical plan that fits your team’s capacity and budget.
I work alongside management and your internal IT team to put that plan into practice and keep track of progress.
Growing and mid-sized businesses, suppliers facing customer security requirements, and organisations in regulated sectors. Especially where management and the internal IT team need an experienced partner without a full-time CISO position.
A customer requires certification, or you want a more systematic approach to managing information security. You need to understand what already works, where the gaps are and what evidence an audit will require. I help define the scope of your ISMS, set priorities and prepare a plan that reflects your team’s capacity and target dates.
You need to understand the requirements and identify which obligations apply to your organisation. A list of rules is only useful when someone is responsible for meeting them and the necessary changes become part of daily operations. I help assess your current position and define practical steps for management, IT and communication with NÚKIB, the Czech National Cyber and Information Security Agency.
A business partner requires a TISAX assessment and you need to understand the preparation involved. This means clarifying the assessment scope, reviewing existing controls and gathering evidence that shows how they work in practice. I help identify gaps, assign tasks and plan the preparation around your company’s daily operations.
IT keeps daily operations running, but someone needs to set security priorities and track progress. Decisions are delayed, and management lacks a clear view of risks and the work underway. As your virtual CISO, I help clarify responsibilities, coordinate security activities and provide the information management needs to make decisions.
Ongoing security leadership, clear responsibilities and coordination between business management and the technical team.
A security roadmap sets out priorities, responsibilities and deadlines for each action. Regular reports give management a clear view of the main risks, progress and decisions that need their input. We agree how to verify that each action is complete, then review and update the roadmap as your business changes, within the agreed scope of the engagement.
An assessment of your current position and a selection of actions that fit your risks, available resources and budget.
The assessment produces a gap analysis, a risk register and an action plan. The register describes potential impacts, while the plan sets out priorities, owners and agreed deadlines for the proposed controls. It takes account of available capacity, budget and dependencies between tasks. Management can use these findings to decide what to address first and how to track progress.
Preparing people and procedures for situations that require fast decisions, a coordinated response and service recovery.
An incident response plan defines roles, contacts and procedures for communication and escalation. It clarifies who assesses the situation, who makes decisions and how the technical team works with management. I also prepare a scenario for a team exercise based on a selected incident. We turn the exercise findings into specific updates to procedures and follow-up actions to improve readiness.
For each framework, I start by assessing your current position. This is followed by a preparation plan, clear responsibilities and support with implementing the necessary controls.
The international standard for an information security management system. You receive a gap analysis and a prioritised plan for implementing controls and preparing for a certification audit.
Czech cyber security requirements, including the lower- and higher-obligation regimes. You receive an assessment of the requirements relevant to your organisation and an action plan with owners and priorities.
The EU framework for digital operational resilience in the financial sector. You receive a review of ICT risks and supplier oversight, with actions to improve readiness for outages and incidents.
EU cyber security requirements for products with digital elements. You receive a plan for integrating security and vulnerability management into product development, delivery and support.
An information security assessment and exchange mechanism for the automotive supply chain. You receive a readiness review, a list of gaps and an evidence preparation plan for the assessment.
The first conversation clarifies what you need. We agree on the scope, your team’s involvement and the schedule before starting the engagement.
We discuss your goals, current security practices, customer requirements and any deadlines that need to be considered.
We agree on the assessment scope, required information, responsibilities and the format of the resulting plan.
I support your team with implementation and prepare a progress overview for management.
A standalone review with a scope and deliverables agreed in advance.
Audit or assessment preparation, a risk analysis, or setting up selected processes.
Regular support with an agreed monthly allocation of time based on your organisation’s needs.
I understand technology and what it takes to keep it running securely.
My background combines information security, IT operations and team leadership. Technical and management experience allows me to assess both the design of a security control and its impact on how an organisation operates.
I have led IT operations and infrastructure teams, coordinated security assessments in international environments and worked on ISO 27001 compliance, business continuity and disaster recovery. This experience helps me connect security requirements with the realities of running a business.
I focus on risk management, security assessments and communication between IT and the business. My recommendations reflect actual needs, available resources and what your team can maintain in daily operations.
vCISO · Information & Cyber Security
Assessing security risks, reviewing security solutions and proposing controls. Working with technical teams, IT management and business stakeholders to define priorities and put them into practice.
Management Consulting · Cyber Security
Security projects, ISO 27001 compliance assessments, business continuity and disaster recovery plans, and security due diligence for mergers and acquisitions.
Head of Information Technology
Established an IT services department, led the team and held responsibility for infrastructure security and availability. Led ISO 20000-1 implementation and certification.
Head of IT Operations
Led IT operations, capacity planning and infrastructure development. Connected operational needs with business requirements and managed IT resources.
IT Security Assessment Manager
Coordinated security assessments and external suppliers in an international environment. Defined processes and supported collaboration between IT and internal customers.
UNIX/Linux infrastructure
UNIX/Linux administration, high-availability infrastructure, storage, backup and recovery, and enterprise systems integration.
MSc (Ing.) in Artificial Intelligence, BSc in Cybernetics – Technical University of Košice.
During an introductory 30-minute call, we discuss your situation, expectations and any deadlines. I then propose the next steps and scope of work. We arrange a time by email or phone.
Before work starts, we agree on the interviews, documents and meeting schedule needed from management and IT, with named contacts for both teams; implementation tasks are planned alongside your day-to-day operations.
After the gap analysis, you receive a preparation schedule with milestones for implementing controls, collecting evidence and reviewing readiness; certification or the assessment itself is carried out by the relevant independent body.
Yes. The engagement builds on your team’s knowledge. I help set security priorities, assign responsibilities and translate technical findings into information management can use to make decisions.
Call me or send a message about what you need to resolve. We will discuss your situation and the next steps.