I am an engineer first. The governance follows from the engineering.
I spent over two decades building and securing digital infrastructure for some of Europe's most complex organisations. I am good at it. The compliance and readiness work I do now is built on that engineering, not the other way round.
You work with me, one engagement at a time
For the past two decades I built secure, cloud-native platforms in places where an audit is never far away: public justice, banking, transport, aviation and retail. Kubernetes, identity and access, controlled and auditable CI/CD delivery, security-by-design. This is the work I know in my hands.
And while doing it, I kept noticing the same thing. A deal would stall on a security questionnaire. An AI feature would head to production with no clear story about its controls. The answer to that is not a slide deck. It is someone who has shipped the real thing and can tell you, plainly, what is solid and what is not. That is what I do, and I do it myself.
- CJIB, Dutch Ministry of JusticeCloud engineer / architect & DevOps, security-by-design2019 to present
- Nederlandse Spoorwegen (NS)DevOps, CI/CD delivery2019
- Ahold DelhaizeArchitect / DevOps2013 to 2019
- INGSoftware developer2013
- KLMDevOps / architect / lead Java2010 to 2013
Public engagements, as listed on my Malt CV.
Judgement over slideware
Security-by-design
I design controls in at the architecture level. I do not bolt them on before an audit. This is how I have built platforms for twenty years.
Controlled and auditable delivery
I build CI/CD that leaves an evidence trail. If you cannot show how a change reached production, you cannot defend it to an auditor.
Honest hand-offs
I tell you exactly where my work ends and a specialist's begins: certification audit, legal sign-off, penetration test. I do not pretend otherwise.
Fixed scope
I agree day blocks up front and take one engagement at a time. No open-ended retainer, no scope that quietly grows.
Regulated environments, end to end
These are the domains I have done the engineering in myself. No ranking, no order of preference. This is simply where the work has been.
Insured, and honest about scope
Professionally insured
I carry professional liability cover.
Frameworks as readiness, never as certification
ISO 27001, SOC 2, NIS2, GDPR and the EU AI Act come up constantly in my work. I treat them as readiness and response, never as a certificate I hold. I am an engineer, not an auditor, a lawyer or a pentester. Where you need certified sign-off, I bring in the right specialist and stay alongside.
My certifications are technical
Java (SCJP), Kubernetes Fundamentals, Go, Spring, WebMethods. I hold no GRC certifications, and I will never imply otherwise.
Sirrapa IT
I take one engagement at a time, in fixed-scope day blocks agreed up front.
- Legal entity
- Sirrapa BV
- KvK
- 60336250
- VAT
- NL8538.64.020.B01
- Based
- Tuitjenhorn, Netherlands
- contact@sirrapa.com
Worth a conversation?
Give me thirty minutes, no slide deck. We work out together whether the problem in front of you is one I can actually help with, and where, honestly, you would be better served by a specialist. I would like to talk.
Book a call