Haroon Mahmood
I’m Haroon. I’ve spent more than 25 years in information security, including senior roles at Sun Microsystems, Oracle and Salesforce. My work has involved building security programmes, helping business leaders understand risk and turning security requirements into working policies and controls.
My focus is on making security work in the day-to-day business. That means understanding how your team works, being clear about what needs attention and agreeing a plan people can follow. A policy needs to make sense to the person using it. An action needs someone who can take it forward.
(ISC)² CISSP · ISACA CISM, CISA, CRISC · IAPP CIPM, CIPT · SANS GIAC GSTRT, GSLC, GCCC
Through Kurosec, I provide fractional security leadership, security programme reviews, policy and governance support and security programme development.
I use practical UK NCSC guidance alongside NIST CSF, ISO 27001 and CIS Controls where they help answer the questions your business faces. We agree the scope before starting, taking account of your team, existing work and available time.
Experience behind the approach
Read examples from my previous in-house roles, from establishing a security function to making policies usable and improving how sensitive information is handled. Each explains the work and how that experience can support a Kurosec engagement.
For practical starting points, explore my guides to the first 90 days of security leadership and writing policies people can use.