About me
Senior Product Security Architect with 15+ years of experience across software engineering, enterprise integration, solution architecture and cybersecurity. I specialise in helping product and engineering teams build and maintain secure, resilient and compliant products, combining hands-on technical experience with architecture, risk management and stakeholder engagement.
In my current role, I provide product security and security architecture expertise across a portfolio of products and solutions. My work includes security architecture reviews, product security assessments, architecture and threat modelling, vulnerability assessment and remediation, penetration-testing coordination, security risk management, secure development guidance and regulatory readiness.
My engineering, architecture and security background lets me bridge the gap between security requirements and practical technology implementation.
Experiences
March 2022 - Present
Senior Product Security Architect
Provide product security and security architecture expertise across a portfolio of software products and solutions, working with product, engineering, quality, operations and business stakeholders to identify, assess and mitigate security risks throughout the product lifecycle.
- Lead product security assessments, security architecture reviews and assessment reporting across multiple products and solutions.
- Provide architecture guidance to product teams, supporting a shift-left approach and helping identify security risks early in the development lifecycle.
- Review findings from static analysis, dynamic analysis, dependency scanning and penetration testing, assessing their impact and supporting remediation.
- Develop and maintain architecture diagrams and security documentation.
- Coordinate penetration testing, including scope definition, test preparation, stakeholder coordination, findings review and remediation follow-up.
- Create and maintain Plans of Action and Milestones (POAMs) and product security assessment tracking.
- Work with product teams and Technology Operations on vulnerability remediation, including high-severity findings.
- Support Cyber Resilience Act (CRA) readiness, including SDLC process changes, product gap assessments and remediation across applicable products and solutions.
- Support customer security questionnaires, RFIs/RFPs, customer security assessments and technical security documentation.
- Develop or review customer-specific security documentation, including threat models, architecture documentation and Product Security Guides.
- Participate in customer and SOC 2 audits, providing product security expertise.
- Support customer security incidents when required, including technical analysis and internal/customer coordination.
- Contribute to cross-functional security initiatives.
July 2016 - March 2022
Senior Integration Developer / Architect
Worked as a senior integration developer and architect within a geographically distributed global environment, delivering and supporting B2B and A2A integrations connecting customers, suppliers, carriers and internal business applications.
- Designed and developed enterprise integration interfaces supporting business-critical processes across multiple functions.
- Worked with e-commerce, Finance, Supply Chain, Customer Service, Sales, Operations and Distribution teams to translate business requirements into technical solutions.
- Provided technical architecture and design guidance for integration solutions and reviewed proposed architectures.
- Redesigned the integration infrastructure from a single-node architecture to a clustered architecture, improving resilience and availability.
- Managed integration workload priorities with business stakeholders to align delivery with business priorities and deadlines.
- Administered, maintained and patched the integration infrastructure and webMethods environment.
- Provided Level 3 technical support, performing root-cause analysis and implementing corrective measures for recurring production issues.
- Supported testing and operational activities while ensuring adherence to quality and audit requirements.
- Technologies: webMethods • EAI/ESB • B2B/A2A Integration • SAP • IBS/Iptor • XML/XSD • SOAP/REST • cXML • EDI X12 • EDIFACT • AS2 • FTP/SFTP/FTPS • HTTP
July 2015 - June 2016
Integrations Technical Lead
Led the technical delivery of enterprise integration solutions within a customer-facing environment.
- Led the technical team in understanding customer requirements and delivering appropriate technical solutions.
- Gathered and analysed business and technical requirements and translated them into integration solutions.
- Performed solution architecture and design validation.
- Supported project costing and capacity planning.
- Led technical testing, including performance and resilience testing.
- Supported solutions through operational deployment and ongoing maintenance.
- Technologies: webMethods Integration Server • CAF • BPM • XML/XSD • SOAP/REST • Java • Unix/KSH/BSH • BIRT
February 2011 - July 2015
Integrations Developer
Delivered enterprise integration solutions across multiple projects, working across the full development lifecycle from requirements analysis and solution design through development, testing, administration and production support.
- Developed and maintained enterprise integrations using webMethods EAI/ESB.
- Designed and implemented integrations using webMethods, Java, XML, XSD and SOAP/REST web services.
- Worked with ETL solutions using Informatica.
- Developed supporting Java components and database integrations.
- Administered and supported integration solutions in operational environments.
- Technologies: webMethods • Informatica • XML/XSD • SOAP/REST • Java • Oracle • MySQL • Unix/KSH/BSH • BIRT
Volunteering
July 2023 - Present
Technology Lead
Provide technology leadership and operational ownership for a UK-based non-profit organisation, overseeing technology strategy, infrastructure, applications and day-to-day IT operations.
- Own the organisation's technology infrastructure and architecture, with the core infrastructure hosted in Microsoft Azure.
- Manage cloud infrastructure, applications, services, identity, endpoints, networking, operational technology, and public address systems.
- Lead the administration, maintenance, security and lifecycle management of business applications and technology platforms.
- Plan and manage technology resources, priorities and projects in line with organisational requirements.
- Oversee application development and technical delivery, from requirements and architecture through implementation and ongoing maintenance.
- Manage endpoint technology and user access, including onboarding, offboarding and access management.
- Establish and maintain operational processes covering technology administration, security, backup, monitoring, maintenance and incident response.
- Evaluate technology solutions and make recommendations on technology investments and improvements.
- Provide technical leadership across infrastructure, software, cloud services, cybersecurity and digital operations.
Projects
Cyber Resilience Act (CRA) Readiness
Led product security readiness activities for the EU Cyber Resilience Act (CRA), supporting the organisation in assessing product gaps, prioritising remediation and addressing compliance requirements across the product portfolio.
- Conducted CRA gap assessments across products to identify security, process and compliance gaps.
- Worked with product and engineering teams to assess identified gaps and determine appropriate remediation actions.
- Prioritised remediation activities based on risk, product context and business considerations.
- Supported decisions regarding remediation, mitigation and product lifecycle, including end-of-life decisions where addressing CRA requirements was not considered appropriate or viable.
- Followed up remediation activities with product teams to ensure identified gaps were addressed and applicable products remained covered.
- Supported changes to software development lifecycle processes required to address CRA requirements.
- Ensured the assessment covered the wider product portfolio, including white-labelled products, reseller arrangements and solutions potentially falling within the scope of the regulation.
Education
2013 - 2014
MBA focused in Supply Chain Management
Toulouse Business School · Toulouse, France
2010 - 2011
Master of Engineering in IT
INSA · National Institute of Applied Sciences, Toulouse, France
Skills
Security
Product SecuritySecurity Architecture DesignSecurity Architecture ReviewsSecurity AssessmentsThreat ModelingSecure SDLCVulnerability AssessmentVulnerability ManagementCloud SecurityInformation SecurityInformation Security GovernanceSecurity ComplianceSecurity Risk ManagementShift-Left SecuritySecurity-by-DesignCybersecurityApplication Security
Architecture
Technical ArchitectureSoftware ArchitectureNetwork ArchitectureEnterprise ArchitectureEnterprise Service Bus (ESB) ArchitectureSystem ArchitectureIntegration ArchitectureAPI Architecture
Integration & Middleware
B2B / A2A IntegrationB2B IntegrationA2A IntegrationwebMethodsEnterprise Service Bus (ESB)SOASOAP Web ServicesSOAP / REST APIsREST APIsWeb ServicesEAIXMLXML Schema Definition (XSD)AS2cXMLX12EDIFACTEDI
Cloud & Infrastructure
Microsoft AzureCloud ComputingAWSIdentity and Access Management (IAM)Infrastructure ManagementSystem AdministrationIT OperationsEndpoint Management
Databases & Data
SQLOracleOracle DatabaseMySQLMicrosoft SQL ServerJava Database Connectivity (JDBC)Extract, Transform, Load (ETL)ETLInformaticaBPMUML
Programming Languages
JavaJava Enterprise EditionJPAJavaScriptPHPHTMLCSSAJAXUnixShell Scripting
Technical Skills
Secure File Transfer Protocol (SFTP)Requirements AnalysisTechnical DocumentationDistributed SystemsTechnical Leadership
Leadership & Management
Technical LeadershipProject DeliveryProject ManagementCapacity PlanningStakeholder ManagementCross-functional CollaborationsIncident Management
Interests
Travel Morocco, Spain, Belgium, France, UAE, USA.
Sports Squash, running and swimming.
Languages English, French, Arabic and Spanish.
