His work focuses on translating governance and compliance requirements into practical security capabilities, connecting frameworks such as ISO 27001 and NIS2 with risk ownership, security controls, evidence and operational decision-making.
His broader professional and research interests include AI governance, continuous cyber risk management, adversarial readiness, third-party risk and the evolution of GRC from periodic compliance towards continuous assurance.
He develops practical approaches for organizations seeking to strengthen security while maintaining clear accountability, measurable risk management and sustainable governance.