About

An itch for a good challenge has defined most of my academic and professional life. From exploring neural networks and their application to speech recognition, to optimising algorithms for data transformation and database migration, my early days as an engineer provided a steady supply of exactly that.

A major milestone came around 2010. As an early adopter of iOS and Android and a senior engineer at Netcetera , a company where I would spend over eighteen years, I led the development of the PostFinance mobile app . It was among the first mobile banking apps with payment functionality, built on emerging technology with little to no established security practices to lean on. I still remember my 27-year-old rebellious self standing with serious-looking security engineers who had years of banking experience, trying to crack the architecture of the product we were about to build. Technical challenges aside, one theme kept recurring in those discussions: how do you convince the board to prioritise and fund security?

The success of that product led me to spearhead the development of several more banking apps, and eventually, Netcetera’s own mobile banking product. Launched in partnership with Finnova , it became the leading mobile banking solution in Switzerland, with around sixty banks running on it in just a couple of years.

I was still an engineer on paper, but by this point, information security filled most of my days. I took over Netcetera’s Security Office — an informal team of security-minded engineers helping the rest of the company — and in 2018 I initiated and built the company’s Information Security department, officially putting my software development days behind me.

Security became my profession. The early days were demanding: developing and managing the department by day, and doing technical work in the evenings, from security architectures to threat analysis and testing. Eventually, the team grew into a mature security organisation. Responsibilities could be handed over, and I moved into a more managerial role as deputy CISO, working on policies, strategies, and managing the overall security program.

This is when a pattern became hard to ignore. Whenever we traced a security problem to its root cause, the trail rarely ended at technology. It ended at fragmented processes, unclear ownership, and decisions made on gut feeling. By this time I was a member of multiple professional groups; most managers I talked to, both inside and outside the company, across different domains, kept repeating the theme I had first encountered in those PostFinance architecture meetings: how do you convince the board to invest in a change?

A new challenge — a new itch. I had been managing risks for years by this point, but a self-directed study in the foundations of business administration and the CRISC certification provided my first formal training on the topic. That was when I realised that risk is not a formality, but rather a common language that lets people from different disciplines (such as business management, engineering, finance, and HR) understand each other, prioritise, and allocate shared resources. Exploring decision theory and actuarial science convinced me of something more specific: quantifying risk is the clearest form that language can take, and the only one that can make dry concepts like risk appetite useful.

It was time to put my new belief to the test. A couple of years earlier I had already failed at consolidating several siloed risk assessment practices. We practised qualitative assessments which are notoriously difficult to consolidate without throwing away old results and retraining everyone involved — something we were not ready to do. As a result, the best that could be reported to management was a list of high-level risks that lived in the register for years as LOWs or MEDIUMs and which communicated our collective gut feeling on different aspects of security. This is what most organisations do at best.

I decided to give quantitative methods a chance. There is an overall stigma around them , so if I were to convince myself and my colleagues of their usefulness, they had to do more than consolidate the siloed processes — they had to improve our communication with management. Inspired by the work of well-known practitioners, I developed a methodology that let us quantify already-identified risks and aggregate them under a single umbrella. On the next reporting cycle, something new happened: management engaged with genuine interest and had questions on open issues.

And this is where I stand today. Two decades of experience, spanning from junior engineer to senior management. A professional life filled with challenges and know-how drawn from different disciplines. In a world where most organisations are stuck with the status quo, I’m on a journey to make a difference.

If that resonates, reach out — I would love to hear your story too