AaronOrmerod
I've spent twenty years doing security for telecoms, payments and regulated platforms. These days most of it goes on AI security and governance, under ISO 42001.
About
I'm a security engineer and architect, based in the UK. I've been doing this for about twenty years, mostly in critical national infrastructure, industrial control, telecoms, defence, med-tech and finance.
I spend most of my time in the design and the build. Network diagrams, pipelines, code, threat models. I like to hand over something that's already working.
I've run security programmes end to end, in regulated sectors, with teams in several countries. The audit side came with that, so I do ISO 27001, Cyber Essentials and GDPR assessments too.
Most of my time now goes on AI security and governance. The thing I keep running into is that AI moves faster than anyone can govern it. Somebody swaps the model, or plugs in another integration, and six months later you're running something nobody ever signed off.
I try to keep the blockers low. If it makes someone's job harder they'll just go round it.
If you've got something that needs building or fixing, get in touch.
Specialisms
Med-tech, finance, telecoms, defence and critical national infrastructure. Teams across several countries, and an audit attached to every kind of data in that list.
AI Governance & Security
Red teaming models and the pipelines around them, then building the governance. Most of my time goes here now.
DevSecOps
Built and scaled it inside high-growth engineering teams. Pipelines, delivery lifecycle, and a lot of arguing about which findings actually block a release.
Cloud & Infrastructure Security
AWS, Azure and GCP. I start with identity and work outwards: who can assume what, what it reaches, how far a compromise spreads. I build these, not just review them.
Vulnerability Management
Getting past CVSS-only prioritisation to whether a thing is reachable, whether anyone is exploiting it, and what an attacker could actually do with it.
Threat Modelling
STRIDE, PASTA and LINDDUN, mapped onto MITRE ATT&CK. I run them at design time.
Threat Hunting
Going through telemetry with a hypothesis, looking for the stuff no detection rule covers.
Threat Intelligence
Taking what actors actually do, mapping it to ATT&CK, and turning that into hunts and threat model assumptions.
Incident Response
Digital forensics and response. Most of it comes down to what you can still collect in the first hour.
Industrial Security
OT and IT convergence, SCADA, industrial control. Most of the work is finding out what the engineering network is actually connected to.
Critical National Infrastructure (CNI)
Security architecture for plants you can’t stop for a weekend, and the regulatory assessments that go with them.
Certifications
About half of these are engineering and half are audit and governance, which is deliberate. Building and assuring are usually two different departments that talk past each other: the engineers think the auditors do not understand the system, the auditors think the engineers are marking their own homework. I have built the thing and I have been the one auditing it, so I can tell you which of those complaints is fair in your case.
Advanced in AI Security Management (AAISM)
ISACA
OffSec AI Red Teamer (OSAI+)
OffSec
ISO 42001:2023 AIMS Lead Implementer (AIMS LI)
GASQ
Certified Information Security Manager (CISM)
ISACA
Certified Information Systems Auditor (CISA)
ISACA
ISO 27001:2022 ISMS Lead Auditor (CIS LA)
GASQ
ISO 27001:2022 ISMS Lead Implementer (CIS LI)
GASQ
ISO 27701 PIMS Lead Auditor (PIMS LA)
GASQ
ISO 27701 PIMS Lead Implementer (CPI LI)
GASQ
Certified DORA Practitioner (C-DORA P)
GASQ
Certified Data Protection Officer (C-DPO)
GASQ
PCI DSS Lead Implementer (PCI DSS LI)
GASQ
GIAC Certified Forensic Analyst (GCFA)
GIAC
AWS Certified Security, Specialty
Amazon Web Services
AWS Certified Advanced Networking, Specialty
Amazon Web Services
AWS Certified DevOps Engineer, Professional
Amazon Web Services
GDPR Assessor
IASME
Cyber Essentials & Cyber Assured Assessor
IASME
Writing & Research
Mostly vulnerability management and security measurement. Whether CVSS scores, SOC 2 reports and control dashboards tell you what they claim to.
View all writing & research →How Many of Your Dependency CVEs Can Actually Reach You?
A preregistered replication in Go: govulncheck's call-graph analysis against dependency-level findings on 105 modules from the Go module index, with a hand check of 40 findings
Read paper →What Is the Point of a CVSS Base Score?
What the specification says a base score represents, and what 380,000 NVD records and the CISA KEV catalogue show it distinguishes
Read paper →Are Security Headers and Content Security Policy Security Theatre?
What deployed headers are specified to do, what 1,266 reachable sites actually send, and what the evidence says about attack outcomes
Read paper →Work with me
I take on principal-level security architecture, vulnerability management and cloud work. More of it is AI security and governance every year.
What are you trying to secure, and what keeps getting in the way?
Architecture, vulnerability management, cloud, AI governance, or a programme that's stalled. Tell me what's going on and I'll let you know either way.
Discuss a Project