I am back with Luxair in Luxembourg, where I previously ran the selection of the new PAM and IGA platforms. This time the task is to help finalize both projects and take them into production. I lead the roll-out and the governance and processes around it, and I am the main point of contact between the IT Security team, the vendors, the infrastructure teams and the business. Along the way I help remove direct administrative access to systems, and I make sure the knowledge stays with Luxair's own people when the assignment ends.

• Reverse-engineered and documented the existing PAM360 build across four live environments that had no documentation
• Built a configuration comparison that makes drift between the environments visible
• Wrote whitepapers on improvement opportunities, including hardening proposals and a working demonstration of ephemeral privileged accounts
• Worked within OT availability and safety constraints that rule out standard IT access patterns
• Wrote the operating documentation (onboarding, daily operations and support) and handed it over to the internal PAM team
• Built PowerShell tooling that reconciles PAM and AD data and replaced a daily manual reporting process

• Security solution architecture across IAM domains in a major airline environment
• Target-state architecture documentation, integration patterns, and operational design
• Structured vendor evaluations, PoC management, and comparative scoring

• Leading data collection and analysis phase for enterprise IGA programme
• Stakeholder interviews and workshops on identity and access workflows
• Governance gap analysis across access provisioning, roles, and recertification

• PAM acquisition and architecture lead - Segura selected as vendor
• Vendor evaluation, contract negotiations, onboarding strategy and roadmap
• PAM integration with IAM, Active Directory, and operational security processes

• Driving enterprise MFA and SSO programme for approximately 3,000 users
• Leading MFA implementation and SSO-based application onboarding
• Supporting NIS2 compliance requirements effective October 2024

• Identifying security improvement areas in production and OT-adjacent environments
• Designing test documentation to verify compliance with customer security requirements
• Advising on policies and procedures for secure integration rooms
• Translating high-level security requirements into concrete technical controls

• Direct advisory support to CISO on security governance
• Authoring IT security policies and supporting documentation
• Developing risk and threat assessment processes
• Establishing third-party security review processes
• Contributing to crisis management and tabletop exercises
• Advising on OT security aligned to IEC 62443

• Identified vulnerabilities for new and existing operational processes and technical environments and proposed practical security improvements
• Leading CyberArk PAM implementation for more than 400 users
• Delivering PAM onboarding processes, documentation, and operational procedures
• Upgrading enterprise internet proxy infrastructure and deploying anti-ransomware solutions
• Threat assessments and SME input on security-related projects

• Designed security architecture blueprint for a virtualized, segregated development environment with secure remote access and code exfiltration controls
• Product manager and deployment lead for enterprise-wide data classification solution across all QNB international units - including user awareness training
• Subject matter expert for PAM solution design, policies, and adoption strategy

• Delivered CyberArk PAM within agreed scope, budget, and timeframe - rethinking how IT staff manage privileged accounts across the bank
• Acting as BISO for Wealth Management operations (Scandinavia, Luxembourg, Switzerland, Singapore)
• Implemented SPLUNK SIEM for audit logging, SoD monitoring, and PII data privacy controls during core banking migration
• Responsible for DR, BCM process and periodic testing; BCP training for senior executive first response teams
• Drove integration of local IT operations with Group security governance including password compliance, access logging, and endpoint protection

• Joined Nordea to modernise its ageing NT4-based infrastructure - built the first Active Directory for the Isle of Man branch, followed by Luxembourg and Switzerland
• Responsible for delivery of complete IT infrastructure in Singapore: datacenter, international links, DR colocation, servers, storage, and networking
• Delivered the IT infrastructure layer for Nordea's new Temenos Core Banking platform, including all file-based system interfaces
• Designed executive mobile workstation solution with full disk encryption, managed firewall/VPN, and endpoint protection
• Procurement lifecycle ownership: vendor contact, technical spec review, price and contract negotiation, budgeting, and delivery planning

• Strengthened server and workstation security - defined system baselines and adherence procedures
• Installed and managed two complex Veritas robotic backup systems for NT, Unix, and VMS environments
• Delivered automation scripts to support helpdesk operations and resolved SoD issues during data migration

• Part of an elite team delivering Windows NT and Novell projects for major Danish clients
• Outplaced to Kriminalforsorgen - designed and deployed a new standard workstation build (NT 4.0) to all locations in Denmark, with complete NT server infrastructure redesign
• Pre-sales engagement, project delivery, and client training across the customer base

• On-site at A.P. Moller / Maersk Contractors for six months - second-level support and Windows NT workstation deployment
• Established remote operations center for online customer support via router connections
• Obtained MCSE and MCT certifications while delivering client projects
• Part of the Y2K on-call initiative at Finanstilsynet

• Built and led a three-person technical support team for a storage, memory, and processor component distributor
• Managed internal operations of five servers (NetWare, Notes, Navigator, BBS, Fax)
• External technical support to major Danish resellers and their enterprise clients