NULLSEC

Three years through computer science and then cybersecurity. The development internships came first — interfaces, performance work, a migration from WordPress to static HTML. They were useful for understanding how systems get built under time pressure, which turns out to be directly relevant to understanding how they fail. The security focus came after, at Guardia, and sharpened into a specific interest: the space between compliance documentation and operational reality, where most security programmes produce activity rather than outcomes.

The apprenticeship at Arvato is in ISMS management — security policy, IS audits, risk and incident processes. The work is governance-layer: translating frameworks into decisions an organisation can actually execute, then maintaining the evidence that it did. The domains I am building toward are GRC, blue team operations, and DevSecOps. The overlap between them is not an accident. Policy without operational instrumentation is assumption. Detection without governance accountability is noise that no one owns. The connective tissue between them is where security actually lives.