-JS-20240807%20PNG.png)
CLIENTS & CASE STUDIES
The shape of it.
Not the secrets.
Most of my work sits under NDA, so here's what the problems looked like and what we did about them. Fractional CISO first, then the audits.
FRACTIONAL CISO
Granular Energy
Energy-tech SaaS · UK & EU · Fractional CISO, 2024 to now
THE PROBLEM
Enterprise energy buyers wanted proof. The team wanted ISO 27001 without hiring a full-time security lead.
WHAT WE DID
A pre-certification internal audit, then closing the gaps. Now two days a month running the ISMS in Drata: ISO 27001 and SOC 2, customer security reviews, an AI use policy, and patching that actually happens.
WHERE IT LANDED
Certified to ISO 27001, with security now part of how they sell rather than something that slows deals down.
Risk Ledger
Supply-chain security platform · UK · Interim Head of Information Security, 2025–26
THE PROBLEM
A security company between security leads. Their customers are security teams, so there's nowhere to hide.
WHAT WE DID
Ran the security function day to day, rebuilt their compliance programme in Vanta, and worked with the auditor to get them ready for SOC 2.
WHERE IT LANDED
A programme ready for SOC 2 and a clean handover to their new InfoSec Director.
STEAMHAUS
Steamhaus
AWS consultancy · Manchester · Fractional CISO & managed ISO 27001, 2026 to now
THE PROBLEM
The founder who held the ISMS together was stepping back, and customers still expected the same assurance.
WHAT WE DID
Took on the ISMS, moved it out of Notion and into Drata, and set up a calendar of risk reviews, management reviews and audits that doesn't rely on one person.
WHERE IT LANDED
ISO 27001 kept on track through a leadership change.
ISO 27001 AUDITS & ASSESSMENTS
In, done, out.
Pre-certification and annual ISO 27001 internal audits for SaaS, data and AI teams across the UK, the Netherlands, Germany, Denmark and the Czech Republic. Clients include Komoot, Seenons, Predyktable, Lleverage and Vocalls. Some came back the next year, which is the review I like best.
I also run cyber risk reviews and health checks for UK retail and ecommerce brands, many of them after the 2025 attacks on British retailers made boards ask the question out loud.
ALSO WORKED WITH
Bending Spoons · SuperScript · Desana · Abbott Lyon · Otiumberg · Komoot · Seenons · Predyktable · Lleverage · Vocalls · Lagom Studio
BEFORE STEEL.FYI
Nearly a decade in-house building security functions, often as the first security hire: THG, Missguided, Purple WiFi, Airtime Rewards, X-Lab and the NHS Test and Trace programme.