I'm a Distinguished Consulting Engineer at MongoDB, where I set the cloud and security governance that our Professional Services organisation runs on. Since November 2024 that work has halved the department's cloud spend and taken it from 66 critical severity findings to zero on unchanged infrastructure, with highs down from 229 to 10.
I hold OSCE3, OSCP and OSDA — so I know how the controls I write fail under attack. Twenty years building systems, more recently spent breaking them. I have been the primary AWS administrator on every estate I have run since 2013, and I hold an MBA, which mostly means I can explain to the people who control budgets why a finding matters.
Based in the Netherlands.
- Cloud and AWS security governance at organisation scale
- Web app & exploit development (OSWE / OSED-level)
- Cloud & AWS exploitation, IAM chaining
- DevOps-aware attack simulation (CI/CD, containers)
- Red team tooling & lab environment design
| OSED | OSEP | OSWE |
|---|---|---|
Additional certifications (OSCP, OSDA, OSWP, CEH Master, CEH Practical, CEH)
| OSCP | OSWP | OSDA |
|---|---|---|
| C|EH (Master) | C|EH (Practical) | C|EH |
|---|---|---|
 |
 |
 |
- Hack the MongoDB Planet! — conference talk, MongoDB World 2022
- 4 Common Misconceptions About Security That Hackers Hope You Don't Know — MongoDB engineering blog, 2022. NoSQL injection, unauthenticated private-network databases, TLS on the wire protocol, and the limits of encryption at rest.
- Red Team Capstone Write-Up — published on the TryHackMe blog
Languages
Cloud
Operating systems
Infrastructure & data
