What matters in security and resilience depends on the business it serves, and that only shows up in context, in what an hour of downtime costs, which processes carry the revenue and which risks the organisation can live with.
I work where that context has teeth, in operations where an outage means a safety incident, lost production or a broken service commitment.
I planned and delivered security improvement across 40+ industrial sites and hydropower assets, a multi-year programme in the multi M€ range, with sector experience spanning paper, pulp, plywood, biofuels, timber, packaging materials, packaging solutions, biomaterials and hydro power plants. Each site presented a different threat profile, different production constraints and a different tolerance for risk. A cybersecurity score put each site next to its peers. Business leaders asked why theirs was lower, and that question drove investment without the programme pushing it. Where the score exposed weak network separation, the gap went to the right steering level as an investment or a risk acceptance, site by site. Once the inventory of production systems named owner, business criticality and location, the same kind of malware incident that had taken weeks of calls across countries was resolved in minutes.
My business cases put security spend in front of leadership as an investment choice. My risk reporting let leaders across all three lines see the exposure in their own units and act on it. I facilitated the decision on a cyber insurance renewal. The renewed policy responds to serious incidents like the ones the company has had, not only to a worst-case year, and it cost a small part of the saving the market was offering.
I spent seven years running 24/7 major incident and problem management in an IT command centre, across in-house teams and outsourced suppliers, restoring business-critical services under time pressure and exercising disaster recovery. On the industrial side I designed how a site’s cyber incident response plugs into its existing physical crisis response, so a mill has one command and control whether the problem is a fire, a break-in or malware.
My approach to risk-based thinking comes from leading accreditations for classified systems in defence, where system compromise meant national security implications. That methodology transferred directly to industrial environments: assess threats, quantify business impact, enable informed risk decisions.
I work at the governance level, translating between executive priorities and operational reality. Executive priorities become practical controls and processes teams can implement. Operational posture becomes risk language executives use for decisions.
I’ve adapted a classified-system security framework so that security design decisions land earlier in projects, and answered for critical incidents across an enterprise being resolved on time. The working toolset includes ISMS governance and ISO 27001, NIS2 and the Cyber Resilience Act, IEC 62443, business continuity and disaster recovery, vulnerability management and system security assessments.
Based in Finland. Norwegian and English, working Swedish, elementary Finnish. ISACA and ISF member.
Get in touch
Email is the quickest route.
[email protected] • LinkedIn • Mastodon • Bluesky • X