OT Security Consultancy & Advisory

A seasoned security professional with 20 years' experience in IT and OT security consulting positions across numerous sectors and verticals, operating at a board & executive level and augmented by a technical ‘hands-on’ background. A leader in security strategy, risk management, governance and assurance, comes with a proven track record of delivering simultaneous, large-scale, mission-critical security capabilities for leading public and private sector clients. Recently been acting as CISO for a global chemical manufacturing company.

A Cyber Safety Engineer holding GICSP, TUV Rheinland Functional Safety Engineer and BOSIET certifications and a wealth of experience in Safety Instrument Systems, Sensor and End-Element field device selection and application Process Control and Machine Automation.

Background is Controls & Instrumentation (30+ years) and is experienced in the definition and build of business process, in the drive for ongoing continuous improvement for safety, quality, and good service.

Is a principal OT Cyber Security Consultant and an information technology professional since 1996. He has 12 years+ experience in SCADA and Operational Technology. A Senior Manager responsible for commissioning and approving the development of architectural principles, policies, standards and patterns for Cyber Security focused upon industrial control systems within UK Critical National Infrastructure (CNI).

Leads all aspects of client delivery including OT Security technical solution deployment and support, cyber advisory services, cyber risk assessments and ongoing client experience management.

An industrial control system expert who assists clients with understanding current OT systems, vulnerabilities, potential attack points and solutions. Experienced in evaluating production control network architectures for cyber risks and susceptibilities, developing, testing and implementing mitigation strategies as well as leading the control system elements of cyber assessments at upstream on and offshore, midstream, downstream and LNG plant accounts.

Projects have included manufacturing gas plants, oil rigs, refineries, pipelines and chemical gas plants. Has extensive experience in the Energy sector with companies such as Honeywell, BP, Total, Shell, Exxon, Conoco/Phillips and others where he designed/engineered and seamlessly implemented Control Systems.

Focuses on Cyber Assessment Services and implementation of ICS Security solutions for customers. He spent the past ten years looking at cyber risks to control systems and developing ways to mitigate them. Has worked with Fortune 10 oil and gas clients, a large onshore drilling company, large offshore production company and two midstream clients to help evaluate production control network architectures for cyber risks and susceptibilities and develop mitigation strategies.

Has been actively involved in the red and blue team aspects of cyber assessments, designing cyber protection architectures, scoring, product development, configuration and implementation at a number of defence and energy customers. Previously, a research scientist at UVA working on the DoD / SERC system-aware, cybersecurity project. For the past several years has been engaged in research with government and industry partners to develop a new-systems-engineering focused approach to address the increasing threat posed by insider and supply chain-based attacks.

This approach, referred to as System-Aware Cyber Security, integrates fault-tolerant system design concepts with advanced cyber security concepts and the methods developed by the automatic control systems community in order to provide additional cyber security capabilities to deter possible attackers, detect when a system has been compromised, isolate the sub-systems that have been compromised, and restore a compromised system to an uncompromised state.

An experienced white hat hacker who performs cyber assessment services including vulnerability assessment and Pen testing. Has managed and performed over 1,100 security related projects primarily focused on Pen testing / disaster and incident recovery plans for companies - has performed over 900 vulnerability assessments and penetration tests and has managed projects that involved penetration testing of both physical network security.

Has a working knowledge of several internal and external audit mythologies including NERC, HIPPA, FDIC, PCI DSS working with frameworks such as NIST ISO 27001-2. Has also conducted a number of oil and gas focused cyber assessment and penetration research projects, primarily focused on onshore drilling related equipment and midstream assets.

Assists with technical initiatives including red teaming, cyber assessments, and product hardening. Expertise spans firewalls, computer forensics, information security services, networking, cyber physical systems and more. Previously has served as Director of Risk Assessment and Senior Developer where he provided expertise in firewalls, networking, communications, risk modelling, product R&D, forensics, information security, open systems, incident response, and log analysis.

Has served as the Project Manager for several oil and gas clients conducting assessments and mitigation deployments in up, mid and downstream.

Is steeped in cybersecurity knowledge and experience, holding a Certified Information Systems Security Professional (CISSP) certification as well other cyber and networking certifications from Cisco (CCNA, CCNP Security), Certified Cloud Security Professional (CCSP), and GIAC Cyber Threat Intelligence (GCTI). has a strong background integrating IT into OT for control systems and HMI environments.