The people who would lead the work

Founded Envenox after a decade split between a software consultancy and a security firm, having watched the same handover fail from both sides.

Runs delivery, commercial and the parts of the company that have to work whether or not anyone finds them interesting.

Hires the engineers and testers, and owns the background-check policy that lets them touch client code.

Leads the testing and red team practice. Fifteen years of hands-on testing, four of them inside a financial services SOC, which is why his reports are written for the person who has to action them at 2am rather than for the person who files them.

• OSCP
• OSWE
• CREST CRT
• GIAC GXPN

Owns the secure SDLC practice and the joint engagements where our testers and our engineers work from the same backlog. Previously a platform engineer, which she says is the only reason developers listen to her.

• OSWE
• CISSP
• GIAC GWAPT

Runs the managed detection service and the cloud security practice. Built and then dismantled three SIEM deployments before concluding that detection content matters more than the platform it runs on.

• GIAC GCDA
• GIAC GCIA
• AWS Security Specialty
• CISSP

Leads GRC and the vCISO practice, and has sat on both sides of an audit. Her standing position is that a control which exists only to be audited is a liability, and she will tell you which of yours those are.

• CISSP
• ISO 27001 Lead Auditor
• CIPP/E
• PCI QSA

Leads the build practice. Has handed over eleven systems to in-house teams and measures the success of a project by how quickly the client stops needing to call.

• AWS Solutions Architect Professional

Architects the business systems work — ERP, CRM and the platform engagements. Spent six years in manufacturing operations before writing software for it, which is why she asks to see the spreadsheets in week one.

• AWS Solutions Architect Professional
• CKA