Branko is available for hire
Hire BrankoBranko Džakula
Verified Expert in Engineering
Cybersecurity Developer
Munich, Bavaria, Germany
Toptal member since December 27, 2023
Bio
Branko is a cybersecurity entrepreneur and educator with 12 years of experience in cybersecurity ops and compliance. His expertise in implementing security frameworks and hands-on technical skills ensure data and IT assets are safeguarded to the highest standards. Branko has driven impressive growth, securing over $5M in funding for his ventures and over $3M in ARR. He teaches clients how to turn security into a lead magnet and a revenue driver to increase brand trust and business growth.
Portfolio
Secfix
Leadership, Product Design, Information Security Management Systems (ISMS)...
Un1quely
Team Development, Offensive Security...
Stellic
SOC 2, Information Security Management Systems (ISMS), Networking, Firewalls...
Experience
- Cybersecurity - 14 years
- Risk Management - 12 years
- Information Security Management Systems (ISMS) - 12 years
- Governance - 12 years
- Compliance - 12 years
- Application Security - 10 years
- Cloud Security - 8 years
- Offensive Security - 3 years
Preferred Environment
Slack, Notion, Cloud Security, Web Security, Endpoint Detection and Response (EDR), Web Application Firewall (WAF), Unified Threat Management (UTM), GRC, Incident Management, Communication, Consulting
The most amazing...
...achievement was increasing ARR by $6M+ by teaching digital health client sales teams to use high-security posture as a competitive edge in securing big deals.
Work Experience
Co-founder and Advisor - AI Security Governance
2021 - PRESENT
Secfix
- Provided expert advice and guidance on developing product content and features, ensuring market needs were met and security best practices adhered to.
- Raised an oversubscribed seed round of $3.6 million led by Octopus Ventures. It was featured in WIRED, TechCrunch, and Business Insider.
- Spearheaded the development of an AI Governance framework based on NIST AI RMF and the EU AI Act, establishing the strategic roadmap for LLM compliance evaluators and agentic safety controls.
- Oversaw the internal information security management system (ISMS) and provided leadership in all security-related matters, ensuring a robust and compliant security posture.
- Architected cloud-native AI governance strategies for Azure and Vertex AI, prototyping automated tools to assess model explainability and bias to ensure product alignment with emerging global regulations.
- Delivered comprehensive security consulting and support to customers, enhancing their understanding of security measures.
- Created and expanded a detailed knowledge base, providing valuable resources for internal and external stakeholders to better understand and implement security practices.
Technologies: Leadership, Product Design, Information Security Management Systems (ISMS), Fundraising, ISO 27001, Trusted Information Security Assessment Exchange (TISAX), SOC 2, General Data Protection Regulation (GDPR), Training, Security Operations Centers (SOC), IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, DevSecOps, Security, California Consumer Privacy Act (CCPA), ISO 27002, ISO 27701, Security Audits, Cybersecurity, OWASP Top 10, Risk Analysis, Risk Modeling, GCP Security, SaaS Security, Amazon Web Services (AWS), Cloudflare, Data Protection, Artificial Intelligence (AI), Code Review, Communication, Organization, Technical Writing, Project Management, Consulting, Managed Security Service Providers (MSSP), Compliance, SOC 2, IT Project Management, ISO 27001, Regulatory Compliance, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), AI Trust, Risk and Security Management (AI TRiSM), AI Risk Management Framework, Data Mapping, AI Data Classification, AI Consulting, AI Security, Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, AI Risk Assessment, Data Retention, Vanta, Role-based Access Control (RBAC), Incident Response, Supabase, Artificial Intelligence (AI), AI Security, Large Language Models (LLMs), HIPAA, HIPAA Compliance, HITRUST Common Security Framework (CSF), Hands-on Implementation, Security Policies & Procedures, Security Architecture, Healthcare
Co-founder and CISO - AI Security Compliance
2021 - PRESENT
Un1quely
- Pioneered the creation and enhancement of innovative cybersecurity services, positioning the company as a leader in the industry.
- Generated $3 million in ARR in two years, with over 200 clients served globally.
- Architected a comprehensive AI Risk Management framework—integrating NIST AI RMF and EU AI Act standards—to evaluate LLM agent behaviors and automate measurable controls for safety and bias.
- Encouraged a culture of innovation and excellence, challenging the ordinary and striving for superior solutions and services.
- Ensured a focus on employees first, driving performance, efficiency, growth, and satisfaction by perfectly syncing people, processes, and technology.
- Infused operations with ambition and drive, setting the tone for strategy meetings and guiding the company through decisions, dilemmas, and wonders with a steady hand.
- Fostered a caring culture, being there 100% for colleagues, partners, vendors, and stakeholders, ensuring a supportive network for all.
- Emphasized a security and privacy-first approach in all software development and cybersecurity initiatives, ensuring products are robust, lasting, and protective.
- Led the strategic prototyping of AI compliance evaluator tools, defining cloud-specific governance strategies for Azure, Vertex, and AWS to ensure scalable and explainable AI deployments for global clients.
Technologies: Team Development, Offensive Security, Information Security Management Systems (ISMS), Application Security, Team Leadership, ISO 27001, SOC 2, General Data Protection Regulation (GDPR), Threat Modeling, Threat Intelligence, Open-source Intelligence (OSINT), Training, Python 3, Security Operations Centers (SOC), IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, DevSecOps, Security, California Consumer Privacy Act (CCPA), NIS2, ISO 27002, ISO 27701, Security Audits, Cybersecurity, Azure, DevOps, Microsoft Power Apps, OWASP Top 10, Risk Analysis, Risk Modeling, GCP Security, SaaS Security, Amazon Web Services (AWS), Cloudflare, OpenVPN, Data Protection, Artificial Intelligence (AI), Code Review, Operational Streamlining, Communication, Organization, Technical Writing, Project Management, Consulting, Managed Security Service Providers (MSSP), Compliance, SOC 2, IT Project Management, ISO 27001, Regulatory Compliance, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), AI Trust, Risk and Security Management (AI TRiSM), AI Risk Management Framework, Data Mapping, AI Data Classification, Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, AI Risk Assessment, Data Retention, Vanta, Role-based Access Control (RBAC), Incident Response, Supabase, Artificial Intelligence (AI), AI Security, Large Language Models (LLMs), HIPAA, HIPAA Compliance, HITRUST Common Security Framework (CSF), Hands-on Implementation, Security Policies & Procedures, Security Architecture
Technology Compliance Project Manager
2024 - 2025
Stellic
- Implemented an information security management system attested against SOC 2 security trust criteria.
- Improved the cloud security posture of the AWS environment.
- Introduced a secure software development lifecycle (SSDLC) in the engineering pipeline, leveraging SAST and DAST tools, native security controls of version control software, and secure coding guidelines.
Technologies: SOC 2, Information Security Management Systems (ISMS), Networking, Firewalls, AI Risk Assessment, Data Retention, Vanta, Role-based Access Control (RBAC), Incident Response, Artificial Intelligence (AI), AI Security, Large Language Models (LLMs), Hands-on Implementation, Security Policies & Procedures, Security Architecture
Privacy Service Designer
2024 - 2024
Toptal
- Supported the initiative to design and develop a new privacy service offering for the Toptal Services practice. This included integrating subject matter expertise to align the service with international privacy regulations such as GDPR and CCPA.
- Collaborated with a cross-functional team to embed best practices and compliance standards into the privacy service offering. This effort streamlined processes and positioned the service as a leading solution in the market.
- Contributed to help shorten the go-to-market time frame, enabling the company to quickly respond to market demands and gain a competitive edge in the information security sector.
Technologies: General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Privacy, Security, Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, Data Retention, Vanta, Role-based Access Control (RBAC), Incident Response, Large Language Models (LLMs), Hands-on Implementation, Security Policies & Procedures, Security Architecture
VP of Security and Compliance
2020 - 2022
Argyle Systems
- Directed the strategic planning and execution of the company's information security program, ensuring a robust and comprehensive approach to protecting digital assets.
- Oversaw the development, implementation, and enforcement of security policies, ensuring compliance with legal and regulatory standards, conducting regular audits to identify and mitigate risks.
- Initiated and led extensive outreach programs, providing education and training to staff at all levels and significantly improving security awareness and practices within the organization.
- Managed the organization's risk management strategies and incident response plans, ensuring rapid and effective action in the face of security breaches and other incidents.
Technologies: Information Security Management Systems (ISMS), Compliance, Risk Management, Application Security, Cloud Security, ISO 27001, PCI DSS, General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), SOC 2, NIST, Training, Security Operations Centers (SOC), IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, DevSecOps, Security, ISO 27002, ISO 27701, Security Audits, Cybersecurity, Azure, DevOps, OWASP Top 10, Risk Analysis, Risk Modeling, GCP Security, SaaS Security, Cloudflare, OpenVPN, Data Protection, Code Review, Communication, Organization, Technical Writing, Project Management, Consulting, Managed Security Service Providers (MSSP), Compliance, SOC 2, IT Project Management, ISO 27001, Regulatory Compliance, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), Data Mapping, AI Data Classification, Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, Data Retention, Role-based Access Control (RBAC), Incident Response, Hands-on Implementation, Security Policies & Procedures, Security Architecture
CISO
2019 - 2022
Kaia Health
- Spearheaded the implementation of an ISMS based on ISO 27001, SOC 2, the GDPR, the CCPA, the HIPAA, and HITRUST frameworks, ensuring a comprehensive approach to security and privacy.
- Oversaw the establishment and maintenance of a robust security governance, ensuring alignment with organizational goals and regulatory requirements.
- Led compliance efforts and managed audits across various frameworks, ensuring the organization consistently met or exceeded security and privacy standards.
- Initiated and led extensive security awareness, education, and training programs, embedding security knowledge and practices across the company.
- Directed risk management strategies, identifying potential threats and developing plans to mitigate them, ensuring the company's resilience against security incidents.
- Managed incident response and business continuity planning, preparing the organization to effectively control and recover from security incidents.
- Championed the integration of security and privacy into every applicable process, ensuring these principles were an integral part of the company culture.
Technologies: Information Security Management Systems (ISMS), Compliance, Risk Management, Governance, IT Security, Cloud Security, Application Security, ISO 27001, HITRUST Certification, SOC 2, General Data Protection Regulation (GDPR), Training, Security Operations Centers (SOC), IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, DevSecOps, Security, California Consumer Privacy Act (CCPA), ISO 27002, ISO 27701, Security Audits, Cybersecurity, SecOps, Azure, OWASP Top 10, Risk Analysis, Risk Modeling, GCP Security, SaaS Security, Amazon Web Services (AWS), Bitdefender, Data Protection, Code Review, Communication, Organization, Technical Writing, Project Management, Consulting, Managed Security Service Providers (MSSP), Compliance, SOC 2, IT Project Management, ISO 27001, Regulatory Compliance, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), Data Mapping, AI Data Classification, Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, Data Retention, Role-based Access Control (RBAC), Incident Response, HIPAA, HIPAA Compliance, HITRUST Common Security Framework (CSF), Hands-on Implementation, Security Policies & Procedures, Security Architecture, Healthcare
Principal Information Security Officer and Head of the Compliance Board
2017 - 2019
HolidayCheck
- Spearheaded the successful implementation of an ISMS, enhancing organizational security posture and compliance.
- Directed the strategic leadership of the company's information security program, resulting in a robust and responsive security infrastructure.
- Oversaw and enforced security policies, ensured compliance with regulatory standards, and conducted rigorous audits, significantly reducing vulnerabilities and risks.
- Initiated and led comprehensive outreach programs, educated employees at all levels, and delivered targeted training, substantially improving security awareness and culture.
- Managed risk assessment processes and developed an efficient incident response strategy, minimizing impact and swiftly addressing security incidents.
- Led the company's efforts in achieving and maintaining regulatory compliance, effectively managing and continuously improving the compliance management system to meet industry standards and reduce legal risks.
Technologies: IT Security, Information Security Management Systems (ISMS), Cloud Security, Application Security, ISO 27001, General Data Protection Regulation (GDPR), PCI DSS, Training, IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, DevSecOps, Security, ISO 27002, Security Audits, Cybersecurity, SecOps, Azure, OWASP Top 10, Risk Analysis, Risk Modeling, SaaS Security, Amazon Web Services (AWS), OpenVPN, Data Protection, Communication, Organization, Technical Writing, Project Management, Consulting, Compliance, SOC 2, IT Project Management, ISO 27001, Regulatory Compliance, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), Data Mapping, Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, Role-based Access Control (RBAC), Incident Response, Hands-on Implementation, Security Policies & Procedures, Security Architecture
CISO
2017 - 2017
Devtech
- Led a team of IT specialists in successfully implementing a comprehensive ISMS, significantly enhancing the organization's security posture and compliance.
- Provided strategic leadership for the company's information security program, developing and implementing policies that effectively safeguarded information assets and technology infrastructure.
- Oversaw the development and enforcement of security policies, ensured compliance with various regulatory standards, and conducted detailed audits, reducing potential security threats and legal exposures.
- Initiated and led extensive outreach, education, and training programs, significantly raising security awareness and fostering a culture of security mindfulness throughout the organization.
- Managed the organization's risk management strategies and incident response plans, ensuring rapid and effective action in the face of security breaches and other incidents.
- Spearheaded efforts to adhere to the GDPR and other data protection regulations, implementing robust processes and controls to secure personal data and ensuring full compliance with legal and regulatory requirements.
Technologies: Information Security Management Systems (ISMS), IT Security, Software Development Lifecycle (SDLC), Application Security, Training, IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, DevSecOps, Security, ISO 27002, Security Audits, Cybersecurity, SecOps, Risk Analysis, Risk Modeling, SaaS Security, Amazon Web Services (AWS), Cloudflare, OpenVPN, Data Protection, Communication, Organization, Technical Writing, Project Management, Consulting, Compliance, SOC 2, IT Project Management, ISO 27001, Regulatory Compliance, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, Role-based Access Control (RBAC), Hands-on Implementation, Security Policies & Procedures, Security Architecture
Information Security Advisor
2016 - 2017
Etihad Airways
- Participated actively as an EAP member in the Etihad Aviation Group information security council, significantly contributing to shaping and aligning the overarching security strategy across the group.
- Orchestrated and executed proven, successful security awareness campaigns, markedly enhancing the security culture and awareness throughout the organization.
- Implemented data protection legislation and GDPR requirements, ensuring stringent compliance and protection of sensitive data across the company.
- Directed large teams of professionals in the execution of company-wide security projects, demonstrating exceptional leadership and project management skills.
- Oversaw the management of security practices, fostering a skilled and responsive security workforce.
- Managed and responded to security incidents effectively, minimizing impact and enhancing the organization's incident response capabilities.
- Ensured the establishment and maintenance of a robust security governance, aligning security initiatives with business objectives and regulatory requirements.
- Formulated and communicated executive-level information security strategies and roadmaps, providing a clear vision and direction for the organization's security posture.
- Handled risk assessment processes and compliance activities, significantly reducing vulnerabilities and ensuring adherence to regulatory standards.
- Led the implementation of an ISMS, enhancing the organization's ability to manage and protect information assets effectively.
Technologies: Information Security Management Systems (ISMS), ISO 27001, Threat Intelligence, GRC, Training, IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, Security, ISO 27002, Security Audits, Cybersecurity, Security Advisory, Risk Analysis, Risk Modeling, OpenVPN, Data Protection, Communication, Organization, Technical Writing, Project Management, Compliance, SOC 2, IT Project Management, ISO 27001, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), Data Governance, Cybersecurity Operations, Networking, Firewalls, Role-based Access Control (RBAC), Incident Response, Hands-on Implementation, Security Policies & Procedures, Security Architecture
Information Security Manager
2015 - 2017
Air Serbia
- Played a pivotal role as a core member of the Etihad Aviation Group information security council, determining the overarching security strategy and identifying synergies across the group.
- Spearheaded the implementation and alignment of governance practices with Etihad Aviation Group, enhancing organizational security posture and compliance.
- Implemented critical security systems successfully, including endpoint protection, mail security, network security, and web application firewalls, improving the organization's defense against threats.
- Led the implementation of a new risk management framework and IT audit management system, ensuring comprehensive risk identification, assessment, and mitigation.
- Orchestrated and executed successful security awareness campaigns, including phishing campaign implementation and regular awareness training for over a thousand participants.
Technologies: Information Security Management Systems (ISMS), Risk Management, Governance, Compliance, IT Security, Training, Security Operations Centers (SOC), IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, DevSecOps, Security, ISO 27002, Security Audits, Cybersecurity, SecOps, Risk Analysis, Risk Modeling, Data Protection, Communication, Organization, Technical Writing, Project Management, IT Project Management, ISO 27001, Privacy-enhancing Technologies (PET), Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, Hands-on Implementation, Security Policies & Procedures, Security Architecture
Information Security Engineer
2012 - 2015
Telenor Serbia
- Identified and managed information system vulnerabilities consistently, ensuring a robust and secure IT infrastructure.
- Oversaw the administration of user accounts, maintaining secure access controls and minimizing unauthorized access risks.
- Implemented general computing controls on internal control over financial reporting systems, enhancing financial data integrity and security.
- Developed and established comprehensive company guidelines, standards, procedures, and policies to govern security practices effectively.
- Performed detailed security risk analyses, identifying potential threats and devising strategies to mitigate them.
- Directed user acceptance testing for new systems and updates, ensuring they met security and usability standards before deployment.
- Identified and defined critical security requirements for systems and projects, ensuring all security aspects were considered during development.
- Ensured the establishment and adherence to robust governance practices, aligning security initiatives with business objectives.
- Followed and continuously integrated the latest technologies and methods in information security, keeping the organization at the forefront of security innovation.
- Engaged in system security hardening, reinforcing the defense against potential attacks and vulnerabilities.
Technologies: Incident Management, IT Security, Web Security, Cloud Security, Risk Management, Training, Python 3, Security Operations Centers (SOC), IT Governance, DevSecOps, Security, ISO 27002, Security Audits, Cybersecurity, SecOps, Azure, Risk Analysis, Risk Modeling, Data Protection, Communication, Organization, Technical Writing, Project Management, IT Project Management, ISO 27001, Data Privacy, International Data Privacy Regulations, Privacy Impact Assessment (PIA), Cybersecurity Operations, Networking, Firewalls, Hands-on Implementation
Experience
HITRUST Implementation for Digital Healthcare B2B2C SaaS Company
https://kaiahealth.com/legal/security/This project showcases my successful orchestration of a healthcare organization's journey to implement the HITRUST framework and achieve the HITRUST certification where I developed and executed a customized strategy, aligning the HITRUST Common Security Framework (CSF) with our unique organizational needs, ensuring efficient resource utilization and minimal operational disruption. This implementation brought in huge deals for the company, increasing revenue and returning investment in security in less than a year.
I fostered a culture of security and compliance by actively involving and securing buy-in from stakeholders across various departments, thereby ensuring a company-wide commitment to the initiative. The project also involved innovative solutions. I employed cutting-edge technologies and methodologies to streamline the compliance process, significantly reducing manual effort and enhancing accuracy. I also successfully bolstered our defenses against cyber threats, significantly reducing the risk of data breaches and enhancing trust among customers and partners.
I fostered a culture of security and compliance by actively involving and securing buy-in from stakeholders across various departments, thereby ensuring a company-wide commitment to the initiative. The project also involved innovative solutions. I employed cutting-edge technologies and methodologies to streamline the compliance process, significantly reducing manual effort and enhancing accuracy. I also successfully bolstered our defenses against cyber threats, significantly reducing the risk of data breaches and enhancing trust among customers and partners.
ISO 27001 Certification for a B2B SaaS Unified API Company
This project entailed crafting and executing a focused, high-velocity rapid deployment strategy that condensed the typical ISO 27001 implementation timeline without compromising thoroughness and rigor. During this process, I led a dedicated cross-functional team, fostering a high-energy environment that encouraged swift decision-making and problem-solving. I also implemented the Lean and Agile methodologies to accelerate the certification process, ensuring that every action taken was precise and contributed directly to the goal.
The company successfully achieved the ISO 27001 certification in just four weeks, a testament to the team's hard work and my strategic oversight. As a result, the company improved its security infrastructure and protocols significantly, ensuring robust protection of sensitive data and systems. The security expectations of enterprise prospects and clients were met and exceeded, and the company was able to expand its market reach and secure a substantial investment for future growth.
The company successfully achieved the ISO 27001 certification in just four weeks, a testament to the team's hard work and my strategic oversight. As a result, the company improved its security infrastructure and protocols significantly, ensuring robust protection of sensitive data and systems. The security expectations of enterprise prospects and clients were met and exceeded, and the company was able to expand its market reach and secure a substantial investment for future growth.
Dual Certification for a Remote Fintech Startup
https://trust.argyle.com/resourcesThis project involved developing a cohesive strategy that aligned the requirements of ISO 27001 and SOC 2, leveraging synergies between the two standards to streamline the process. I orchestrated a fully remote team, employing advanced collaboration tools and methodologies to maintain high productivity and engagement across different time zones. I also conducted a thorough risk assessment, focusing on the unique vulnerabilities of handling real-time financial data and implementing robust controls to mitigate risks effectively.
As a result of these efforts, the company attained the ISO 27001 certification and the SOC 2 Type 2 attestation, showcasing the company's commitment to the highest security standards. During the process, I established a comprehensive security framework that significantly bolstered the company's defenses against potential breaches and data leaks. In addition, the dual certification opened new avenues for client engagements, particularly with larger enterprises that demand rigorous security standards, thus driving business growth and competitive advantage.
As a result of these efforts, the company attained the ISO 27001 certification and the SOC 2 Type 2 attestation, showcasing the company's commitment to the highest security standards. During the process, I established a comprehensive security framework that significantly bolstered the company's defenses against potential breaches and data leaks. In addition, the dual certification opened new avenues for client engagements, particularly with larger enterprises that demand rigorous security standards, thus driving business growth and competitive advantage.
Launch and Expansion of Offensive Security Services
This project highlights the successful development and launch of an offensive security services offering for a cybersecurity services company. I spearheaded the creation of a robust team of 15 specialists and strategically introduced penetration testing services to US and Western Europe markets, achieving an impressive ARR of $3 million within two years solely from this new service line.
I conducted comprehensive market research to identify and understand the specific needs and challenges of the US and Western European markets. Then, I developed a tailored entry strategy highlighting our unique value proposition and competitive advantages. After that, I collaboratively worked with the team to design a suite of penetration testing services that met industry standards and incorporated innovative techniques and methodologies to provide superior value to clients.
I conducted comprehensive market research to identify and understand the specific needs and challenges of the US and Western European markets. Then, I developed a tailored entry strategy highlighting our unique value proposition and competitive advantages. After that, I collaboratively worked with the team to design a suite of penetration testing services that met industry standards and incorporated innovative techniques and methodologies to provide superior value to clients.
Security Compliance Automation Solution
https://www.secfix.com/about-usThis project demonstrates my leadership in designing and launching a revolutionary security compliance automation solution. Recognizing the need for more efficient compliance processes, I assembled a team to develop a tool that drastically cuts the time required to implement frameworks like ISO 27001 from months to weeks by automating the majority of ISMS controls. During the process, I employed the Agile development approach, incorporating continuous feedback from potential users to ensure the solution met and exceeded market needs and expectations.
Security Operations Center (SOC) Implementation and Management
This project encapsulates my comprehensive approach to implementing a state-of-the-art security operations center (SOC) for a client. It involved a series of complex and interrelated activities, including the coordination of security information and event management (SIEM) systems, installation of agent and network sensors, and the establishment of integration activities, service level agreements (SLAs), and protocols essential for running an effective SOC-managed service, including staffing level 1 and 2 security analyst roles.
This project was a testament to my ability to understand and implement complex security solutions in a dynamic environment. The successful implementation of the SOC fortified the client's defense against cyber threats and provided a scalable and flexible system that adapts to evolving security landscapes. My leadership in planning, executing, and managing this project demonstrates my comprehensive understanding of advanced cybersecurity measures and my commitment to delivering solutions that provide real, tangible value to clients. This initiative significantly contributed to the client's operational resilience and positioned them to protect their critical assets and data better.
This project was a testament to my ability to understand and implement complex security solutions in a dynamic environment. The successful implementation of the SOC fortified the client's defense against cyber threats and provided a scalable and flexible system that adapts to evolving security landscapes. My leadership in planning, executing, and managing this project demonstrates my comprehensive understanding of advanced cybersecurity measures and my commitment to delivering solutions that provide real, tangible value to clients. This initiative significantly contributed to the client's operational resilience and positioned them to protect their critical assets and data better.
GDPR and Privacy Implementation for Various Industries
I've executed GDPR gap analysis, implementation project execution, and continuous maintenance of compliance with GDPR across the following industries:
• Digital healthcare
• Airlines
• Hospitality
• Fintech
• Telecommunications
• Software and cybersecurity services
The projects involved complex PII and PHI data mapping, data transfer impact assessments, data processing agreements, responding to user data requests, consulting management on risks influencing design decisions for products and services, and ensuring continuous privacy by design.
I successfully maintained compliance with no regulatory penalties, and no customer churns due to privacy concerns, and I successfully executed continuous privacy awareness training within the organizations.
• Regulatory Knowledge
• Data Mapping and Classification
• Privacy Impact Assessments (PIAs)
• Data Protection Policies and Procedures
• Security Measures and Controls
• Data Subject Rights Management
• Cross-Border Data Transfer Expertise
• Regulatory Liaison and Reporting
• Audit and Monitoring
• Record of Processing Activities (ROPA)
• Incident Response and Breach Management
• Vendor Management
• Digital healthcare
• Airlines
• Hospitality
• Fintech
• Telecommunications
• Software and cybersecurity services
The projects involved complex PII and PHI data mapping, data transfer impact assessments, data processing agreements, responding to user data requests, consulting management on risks influencing design decisions for products and services, and ensuring continuous privacy by design.
I successfully maintained compliance with no regulatory penalties, and no customer churns due to privacy concerns, and I successfully executed continuous privacy awareness training within the organizations.
• Regulatory Knowledge
• Data Mapping and Classification
• Privacy Impact Assessments (PIAs)
• Data Protection Policies and Procedures
• Security Measures and Controls
• Data Subject Rights Management
• Cross-Border Data Transfer Expertise
• Regulatory Liaison and Reporting
• Audit and Monitoring
• Record of Processing Activities (ROPA)
• Incident Response and Breach Management
• Vendor Management
Founded and Led the 1st Cybersecurity Academy in Montenegro
Through my company, UN1QUELY, I founded UN1QUELY Academy, the 1st cybersecurity academy in Montenegro that has helped over 200 individuals break into a cybersecurity career.
This program focused on teaching students about security management practices following the implementation of ISO 27001, learning the basics of defensive security in a security operations center (SOC) environment, and the basics of offensive security practices in penetration testing web applications.
This program focused on teaching students about security management practices following the implementation of ISO 27001, learning the basics of defensive security in a security operations center (SOC) environment, and the basics of offensive security practices in penetration testing web applications.
Microsoft Azure Cloud Security Implementation
In a recent project engagement, a company focused on improving its security and compliance measures, where I reviewed and optimized their Microsoft cloud configuration, developed a comprehensive due diligence package, aligned their security compliance program with ISO 27001 and SOC 2 frameworks, and implemented contractual security requirements. These measures helped the company better protect its clients' data and maintain their trust and confidence in its services.
Incident Response for a Film Production Company
https://www.milkandhoney.productions/Conducted an incident response support exercise that included detailed forensics analysis, interviewing, and reporting. This enabled the client to gain visibility on the security incident response process and how to improve it, taking into account the industry, business goals, risks, and historical data.
AI Critical Vendor Security Assessment for a Consulting Firm
https://www.firmsconsulting.com/A detailed vendor security evaluation and assessment was performed for a client seeking a vendor in the AI space to accelerate consulting services. The evaluation included a detailed vendor security review, an interview with the founder and engineers, a technical assessment of the solution, and a review of the tech stack and architectural diagrams of the solution to identify any security risks unacceptable to the client.
Security Compliance for AI Application in Legal Space
Contributed to security compliance with the SOC 2 framework, supporting the implementation of security controls, vendor security questionnaires, and review and advisory on security policies and procedures. The work was done in vCISO advisory format with the engineering lead.
Education
2014 - 2015
Master's Degree in Computer Science
University of Montenegro - Podgorica, Montenegro
2013 - 2014
Specialists Degree (Spec. App. Sci.) in Computer Science, Secure Software Development Lifecycle (SSDLC)
University of Montenegro - Podgorica, Montenegro
2010 - 2013
Bachelor's Degree in Computer Science
University of Montenegro - Podgorica, Montenegro
Certifications
NOVEMBER 2025 - PRESENT
Certified ISO 42001 Senior Lead Implementer
PECB
JANUARY 2025 - PRESENT
Certified NIS2 Senior Lead Implementer
PECB
JANUARY 2025 - PRESENT
Certified DORA Senior Lead Manager
PECB
MAY 2024 - PRESENT
Certified ISO 27001 Senior Lead Auditor
PECB
MARCH 2024 - PRESENT
Certified in Cybersecurity (CC)
ISC2
MARCH 2023 - PRESENT
Information Security Management Principles
Un1quely
OCTOBER 2018 - PRESENT
Certified Information Security Manager (CISM)
ISACA
JUNE 2016 - PRESENT
Certified ISO 27001 Senior Lead Implementer
PECB
JANUARY 2016 - PRESENT
CCNA Advanced Network Security
Cisco
Skills
Tools
Slack, Notion, GCP Security, OpenVPN, Microsoft Power Apps
Paradigms
Team Development, DevSecOps, Role-based Access Control (RBAC), HIPAA Compliance, DevOps, Penetration Testing
Platforms
Vanta, Azure, Amazon Web Services (AWS)
Industry Expertise
Cybersecurity, Healthcare, Security Advisory
Frameworks
AI Risk Management Framework
Languages
Python 3
Storage
Databases
Other
Web Security, Endpoint Detection and Response (EDR), Unified Threat Management (UTM), GRC, Incident Management, Training, Endpoint Security, Data-level Security, Governance, Risk Management, Compliance, Information Security Management Systems (ISMS), IT Security, Team Leadership, Leadership, ISO 27001, SOC 2, HITRUST Certification, Trusted Information Security Assessment Exchange (TISAX), General Data Protection Regulation (GDPR), PCI DSS, California Consumer Privacy Act (CCPA), Threat Intelligence, Network Security, Business Development, Information Security, Computer Science, IT Governance, IT Audits, Enterprise Risk Management (ERM), CISO, Security, ISO 27002, ISO 27701, CISM, Security Audits, CISSP, SecOps, OWASP Top 10, Risk Analysis, Risk Modeling, SaaS Security, Data Protection, Communication, Organization, Technical Writing, Project Management, Consulting, Managed Security Service Providers (MSSP), Compliance, SOC 2, IT Project Management, ISO 27001, Privacy Impact Assessment (PIA), International Data Privacy Regulations, Data Privacy, Privacy-enhancing Technologies (PET), Data Governance, Cybersecurity Operations, SOC Compliance, Networking, Firewalls, AI Risk Assessment, Data Retention, Incident Response, HIPAA, HITRUST Common Security Framework (CSF), Hands-on Implementation, Security Policies & Procedures, Security Architecture, Cloud Security, Web Application Firewall (WAF), Secure Software Development Lifecycle (SSDLC), Cryptography, Data Structures, Operating Systems, Application Security, Offensive Security, Product Design, Fundraising, NIST, Threat Modeling, Open-source Intelligence (OSINT), Cisco, Cloudflare, Bitdefender, AI Trust, Risk and Security Management (AI TRiSM), Regulatory Compliance, Data Mapping, AI Data Classification, Supabase, Artificial Intelligence (AI), AI Security, Large Language Models (LLMs), Hardware, Software Development, Algorithms, Software Development Lifecycle (SDLC), IT Project Management, Stakeholder Management, Security Operations Centers (SOC), NIS2, Artificial Intelligence (AI), Code Review, Operational Streamlining, Privacy, Auditing, Audits, Security Management, AI Security, AI Consulting, Mail Servers, Digital Operational Resilience Act (DORA)
Collaboration That Works
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
1
Share your needs
Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2
Choose your talent
Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3
Start your risk-free talent trial
Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.
Top talent is in high demand.
Start hiring