Mariia Tiurina

I designed the program, including a clear policy with severity-based SLAs, a triage framework that turns thousands of raw scanner findings into an actionable list, and a rollout plan that fits your teams' actual workflows instead of adding a parallel process nobody uses.

I ran this exact program across PCI DSS, legacy, and shift-left products simultaneously—taking one environment from 30,000 unscoped findings to a clean pen test in 14 months.

Model Context Protocol (MCP) servers are the newest, least-audited attack surface in AI right now. Most security tooling for it is still automated-scan-only—it tells you something's exposed but not whether it's actually exploitable.

I do both: discovery scanning to map your attack surface, plus manual exploit validation to prove real impact, not theoretical risk. You get evidenced findings (request/response proof, CWE classification, severity) and concrete remediation steps—not just a list of warnings.

I built and published an open-source MCP security lab demonstrating a full discovery-to-exploit workflow against a real misconfiguration (CWE-22, path traversal)—the code and write-up are public on GitHub.

A threat model is only useful if someone can act on it. I build models that trace every finding back to a specific, labeled part of your system—not generic "improve your authentication advice," but P03 back-end, DF13: here's the exact gap and the fix.

I use two frameworks together: STRIDE for technical threats (spoofing, tampering, privilege escalation, etc.) and LINDDUN for data privacy risks (consent, GDPR compliance, data exposure), so you get full coverage, not just half the picture.

Generic "don't click suspicious links" training doesn't change behavior. People remember stories, not slides, so I build training around real, well-documented breaches and concrete habit changes, not compliance-checkbox content.

Topics I cover span social engineering and phishing recognition, password hygiene, MFA fatigue attacks, incident-reporting culture, and AI/LLM-related risks for employees who use AI tools at work.

I built a module around a real 2022 MFA-bypass breach at a major company, designed for non-technical audiences.

Startups and small companies preparing for SOC2 or ISO 27001 almost always need the same thing first: a clean, professional set of security policies that auditors and customers will actually accept—not a template with your logo pasted on it.

I write policies based on your actual environment, including team size, tools, and data handled, mapped to the specific controls auditors check for, so you're not just compliant on paper. Common requests include an acceptable use policy, a password and access control policy, an incident response plan, a vulnerability management policy, a data classification policy, and a vendor risk policy.

Ship code fast without shipping vulnerabilities. I help engineering teams integrate SAST, SCA, and DAST into their CI/CD pipeline — with quality gates that block bad code automatically, not a spreadsheet of findings nobody triages.

I've run this across 4 product lines at once (PCI DSS, two legacy systems, and a mobile shift-left program), taking a baseline of around 30,000 raw SAST/SCA findings down to a clean pen test in 14 months with zero criticals. I introduced DAST specifically to prove runtime exploitability whenever teams disputed static findings — and built CI/CD gates that block commits automatically on policy violations, so security stops depending on someone remembering to check a report.

What you get isn't just tool configuration — it's a working triage process your developers will actually follow, calibrated so real risk gets fixed, and noise gets filtered out before it reaches anyone's queue.

Walking into an audit unprepared is how clean environments still fail. I run gap assessments against SOC 2 (Trust Services Criteria), ISO 27001 (Annex A), and DORA (ICT risk management, third-party risk, incident reporting) — mapping what you actually have against what the framework requires, then handing you a prioritized roadmap instead of a wall of findings.

Where it saves the most time: if you need more than one framework, I map your controls once and show where SOC 2, ISO 27001, and DORA overlap, so you're not running three separate readiness projects for requirements that are 70% the same control. I've built compliance documentation across SOC 2, ISO 27001, and GDPR environments, and run vulnerability and risk programs that had to hold up under PCI DSS-level scrutiny — this is that same governance discipline pointed at your audit date.