Defensive security
SIEM and SOC implementation, detection engineering, threat hunting, SOAR, incident response and forensics.
Sentinel / Splunk / CrowdStrike / KQLShadow IT, leaked credentials, alerts nobody closes. I find what others miss and leave fixes the client's own team can run.
Expertise.
Most engagements move between architecture, investigation and hands-on testing. Six disciplines cover the ground.
Cloud security
Azure, IAM, networking, CIS benchmarks, Kubernetes, Intune and DevSecOps reviews.
Offensive security
Authorised penetration testing of web applications, infrastructure and mobile platforms, plus purple-team and physical-security exercises.
Burp Suite / Nmap / Kali / OWASPPost-M&A cyber assessment
After a deal closes, I review the whole estate you just acquired: network, assets, cloud and on-premise Active Directory, and scope out the security risks it brings into your environment.
Network / Assets / Cloud / On-prem ADCyberfootprinting
External exposure discovery, OSINT, breach intelligence, metadata analysis and the automation behind it.
OT security
Asset discovery, vulnerability assessment and posture reviews in industrial environments.
Work.
Recurring engagement types from four years of client delivery, plus the internal tooling built to support them.
Cyber due diligence for acquisitions
Cyber risk assessments run as part of acquisition due diligence, scoped and delivered across multiple regions, feeding findings into the deal timeline alongside the legal and financial workstreams.
Attack surface monitoring
Internal tooling that continuously maps a client's external footprint: domains, exposed services, certificates and leaked credentials, correlated into a single view of what an outsider can actually see.
Sentinel implementation, end to end
Microsoft Sentinel deployments from architecture through go-live: log source onboarding, analytics rules, SOAR playbooks and handover to the client's own SOC team.
These cards generalise real engagement types. Client names and specifics stay confidential.
Terminal.
Poke around. Type help for every command, or start with one of these.
SESSION READY
Run help to list commands.
session 00:00tab completes, up/down for history
Background.
Four years at EY, on projects in government, transport, pharmaceuticals, food production and critical infrastructure.
Outside work
FPV drones and 3D printing. Flight films and builds.
Certifications
BSc
Education
Bachelor Information Security, Thomas More.
NLFREN
Languages
Dutch, French, English.
GovernmentTransportPharmaFood productionCritical infrastructure
Sectors
Where the last four years of engagements took place.
Let's talk
security.
Questions about an assessment, a SOC build or a deal on the table. My inbox is open.
diego.borghgraef@gmail.com