A few things I’ve worked on, the most recent first. Most of it was team work; I say what my part was.
fiskaltrust · since 2025
Security policies with a full history
The situation
An information security management system is mostly documents: policies, procedures, risks. In documents and email it is hard to see which version is current, who changed it and who agreed.
What I did
We moved our ISMS into GitHub. A change to a policy starts as a pull request with the reason written down; the policy owner reviews it, and once it is approved it becomes the current version. I built automations for the routine ISO 27001 tasks. The risk register comes next: from a spreadsheet to GitHub issues, one issue per risk, each with an owner, a review date, and likelihood and impact as labels. (in progress)
What changed
The history answers the questions an auditor asks: who changed what, when, why, and who approved it.
fiskaltrust · since 2025
The EU Cyber Resilience Act, day to day
The situation
The Cyber Resilience Act asks makers of software to know what is inside their products and to act on known security flaws. Since September 2026 some of this must also be reported.
What I did
I set up the processes for it. Every build now produces a software bill of materials (SBOM), a list of every part inside. Dependency tracking follows each outside part and checks it against vulnerability databases, ENISA’s EU database among them. I also wrote the procedures for reporting an actively exploited flaw within the legal deadlines, from the first 24 hours to the final report, and tested them in tabletop exercises.
What changed
The reports show which parts have known security flaws, without anyone collecting it by hand. A daily check compares our dependencies with the EU and US lists of flaws that are being actively exploited.
fiskaltrust · since 2025
Microsoft 365, secured
The situation
fiskaltrust works in Microsoft 365, so much of its security depends on how Microsoft 365 is set up.
What I did
I set a security baseline for the whole tenant, designed the Zero Trust conditional access policies with a colleague, and led the rollout of Microsoft Defender. I also look after devices and accounts, from a person’s first day to their last.
What changed
Conditional access has been live since February 2026, and Defender since October 2026.
fiskaltrust · 2026
A contract platform, built from scratch
The situation
The legal team wrote contracts from Word templates, many of them bilingual, with versions for each country.
What I did
I designed and built a contract management platform for them. It has a library of clauses and templates with their versions, Word and PDF output in two languages, and an approval workflow that records who approved what.
What changed
It runs in Azure and is deployed automatically from every passing build. Moving the templates over and going live come next.
Allego · 2021–2023
Charging, roaming and billing for EV drivers
The situation
Allego runs public chargers across Europe. When a driver taps a card, the charger asks Allego’s platform, and the platform asks the driver’s own provider, directly over OCPI or through a roaming hub such as Hubject.
What I did
As programme manager for commerce and payment, I led the development of its seven applications, from the infrastructure to the code and the business logic. Among them were authorisation, roaming and billing. I also owned the tariff system and its logic for each roaming protocol: OCPI, OCHP and OICP. I prepared the move to OCPI’s newer version.
What changed
With the developers we reduced refused authorisations at public chargers by 30 %. We also brought out the first Carrefour energies app and a charging offer with Fisker.
Allego · 2021–2023
The monthly billing run: from five days to fifteen hours
The situation
At the end of each month, the billing run adds up every charging session. It totals them per customer and per invoice line: by city, by customer or by country, depending on how that customer is invoiced. A large customer can have tens of thousands of sessions in a month. The totals then go into the ERP, Microsoft Dynamics at the time, order by order. Only then can the invoices go out to the e‑mobility providers and our other customers. The whole run took five days.
What I did
From the start I could see that most of the problem sat in the database, and that nobody’s job was to look after it. We hired a database administrator. I had my team go through the billing engine’s code, and they found many steps in the run that were very slow. Most of the gain came from optimising the database.
What changed
The run went from five days to fifteen hours. The next step was planned before I left: a stream that keeps the ERP up to date during the month, so the run at the end would take about five minutes.
Allego · 2024
SOX controls for finance applications
The situation
Two of Allego’s finance applications fell under the Sarbanes-Oxley Act, so their IT needed controls an auditor can test.
What I did
I implemented the IT general controls: who may access what, how changes are approved and tested, and how it is documented. The same year I kept the applications in line with IFRS 15 and set up self-service finance reporting in Databricks.
What changed
Both applications had their IT general controls in place, with procedures the team could follow.
Coyote Logistics, Jack Link’s, IFF · 2009–2020
Running IT across several sites
The situation
Before Allego I ran local and regional IT: for Coyote Logistics across four locations from Amsterdam, for Jack Link’s across EMEA, and for IFF across Latin America from São Paulo.
What I did
The work was people and budgets as much as systems: vendors, staff, new offices in Poland and the Netherlands, a domain migration, the choice of a manufacturing system for a plant in Germany. At Coyote I automated onboarding and offboarding with PowerShell.
What changed
A new colleague had an account, a mailbox and licences on day one.
Also
PEPPOL e-invoicing at fiskaltrust: I did the implementation, working with Philip Helger.
A security awareness training for fiskaltrust that I wrote and built myself.
Experience at a glance
2025 – now
fiskaltrustVienna
Corporate IT & Compliance Lead
2020 – 2024
AllegoArnhem and Vienna
Senior Business Application Manager, FinanceSenior Program Manager / Program Manager, Commerce & PaymentDemand Manager
2017 – 2020
Coyote LogisticsAmsterdam
IT Service Delivery Manager Europe
2016 – 2017
Jack Link’sAmsterdam
IT Manager EMEA
2009 – 2016
IFFSão Paulo and Paris
Regional IT Manager Latin AmericaIT Analyst
Certificates and education
ISO/IEC 27001 Lead Implementer, exam passed October 2026
PSPO I
Microsoft Azure Fundamentals
BSc (Hons) Engineering Management, University of Lincoln
Next to work
Writing — my thoughts, in writing: essays on technology and work All essays
The Long Landing — a climate scenario, not a prediction, for the century on one Earth: a timeline to 2100, a globe of nineteen data layers, essays and a film thelonglanding.com · About the project
Orchemist — a side project I built to understand how AI agents work in teams, with clear roles and checks; paused indefinitely What it taught me
The Door — this website, and the assistant on its home page How it’s built
If any of this is close to what you need, I’d be glad to talk.