🇯🇪 Jersey, Channel Islands
Organisations around the world call me in when an incident goes beyond what their own team can handle, from hacked systems and Personal Data compromises to forensic analysis of intrusions. Most of my other work is white-label or under NDA: the technical solutions, architecture and platforms other companies run their entire business on.
Security runs through all of it, across Linux servers, web applications, SaaS products and websites. I have found and responsibly disclosed vulnerabilities in critical systems for years, with 130 CVEs found and reported since 2018: 15 in Joomla core and 115 across 26 third-party extensions. In 2022 I was shortlisted in the Digital Jersey Tech Awards for finding a vulnerability in the Government of Jersey COVID digital certificate platforms.
On Data Protection, I work with Personal Data law in Jersey, the UK, the EU and other jurisdictions worldwide. I give the legal and regulatory advice, and the technical work I undertake spans the engineering behind it: encryption at rest, secure-by-design systems, and infrastructure that meets or exceeds privacy law wherever it operates.
Behind that are decades of software development in PHP, full-stack SaaS and the whole platform lifecycle, from architecture through to DevOps. Today I'm a Fractional CTO and retained consultant to companies globally, and I run several digital businesses I founded, including multi-award-winning mySites.guru. I'm also on call at fix.mySites.guru.
AI is changing how code and systems are built and secured, and I work at the front of that shift. I use it daily in agentic coding workflows across my projects and in custom integrations built on LLM APIs. I'm also enrolled and approved in Anthropic's Cyber Verification Program for defensive work, including vulnerability triage and verification, malware analysis and reverse engineering.
Away from code I fly my own aircraft, holding a Commercial Pilot Licence and a Qualified Flight Instructor certification, and take my own boat out with the MCA/RYA Advanced Powerboat certificate, commercially endorsed, among several other maritime certifications.
- SSH & Git signing ED25519
SHA256:Vt++EmZzaZKA3RCT6JO/x0xjYtCaXutpQOlJf+4cMfI(download) - GPG
4870 2C9E 4AFF 73DC EB26 5BBE FE1F 49F4 A342 E27C(download)
Reporting a vulnerability? See security.txt.