Security engineering · contract
I am Thomas Whalley. I build the security controls that regulated software has to pass through, and the evidence that proves they work, for the auditor, the notified body, or the client's security team who asks the awkward question.
Practice
Not a general cloud consultancy. These are the places where the work is scarce, the failure modes are expensive, and somebody eventually has to prove the control was real.
Removing static credentials from pipelines and applications entirely. Dynamic secrets with short lifetimes, workload identity in place of stored keys, and just-in-time elevation instead of standing administrator rights.
VaultOpenBaoEntra ID and PIMOIDC federationFIDO2
Knowing what you shipped, proving it came from your own build, and refusing anything that did not. Bills of materials that can be queried when a CVE lands rather than filed and forgotten, with signing and provenance enforced at the point of deployment.
SBOM and VEXSigstoreSLSA provenanceKyvernoKubernetes
Building a development lifecycle that satisfies a named standard and produces the artefacts to demonstrate it. Medical devices, payments, public sector. Every control mapped to a specific requirement, never to good intentions.
IEC 81001-5-1IEC 62304ISO 27001NIST SSDFPCI DSS
Evidence
Client work is confidential, so these are public builds I own end to end. Each is runnable, documented, and explicit about what it does not cover. Read the code rather than taking my word for it.
A cluster that runs only images signed and attested by one specific build workflow, and rejects everything else.
What it demonstrates A negative test suite: the gate is proven to reject unsigned, wrongly signed and right-signature-wrong-workflow images, not merely to admit the good one.
A GitOps-delivered Kubernetes payments workload with layered scanning, supply chain enforcement, service mesh mTLS and infrastructure defined in Terraform. Runs end to end from a devcontainer.
What it demonstrates Two independent admission gates, default-deny networking and runtime syscall detection, with a unit test on every policy so a broken policy fails in CI rather than in production. Controls mapped to PCI DSS, ISO 27001 Annex A and NIST CSF 2.0, with the accepted trade-offs written down rather than omitted.
Versioned, tested and attested operating system images built from version-controlled definitions, rather than a hand-configured machine somebody snapshotted once.
What it demonstrates Assertions run against the built image, so hardened is a test result with a date on it and not a claim in a document.
Record
Defence, regulated medical devices, and public sector. Environments where the paperwork is read by somebody whose job is to disbelieve it.
2026 –
Medical device manufacturer · under NDA
Establishing the lifecycle for a regulated instrument: hardened build pipeline, bill of materials and vulnerability management, and the technical documentation that has to satisfy an external assessor first time.
2025 – 2026
UK local authority · 300 users, 550 hosts
Sole practitioner. Built the CI/CD platform from nothing with quality and security gates inside the pipeline rather than bolted alongside it. Rebuilt privileged access onto just-in-time activation across five control planes, removing standing global administrator from daily accounts. Built the organisation's cyber risk register from an authorised scan of every live host, and led its first Cyber Essentials assessment.
2024 – 2025
Mehal Technologies, Dublin · clinical edge devices
Secure platform for medical edge devices deployed into clinical environments. Hardened bootable container images with a full audit trail, and secrets governance across distributed infrastructure using short-lived credentials rendered at runtime, so rotation propagated without restarting the application.
2022 – 2024
BAE Systems, Portsmouth · classified programme
Under formal change control. Technical lead on software-defined datacentre automation, taking environment build time from days to hours and removing manual steps from bare-metal provisioning entirely. Architected the enterprise secrets management model adopted across the programme, and ran the policy design and team onboarding for it.
Method
These are the habits that stop a security change becoming an outage, and stop a compliance claim falling over when somebody finally checks it.
Report-only before on, detection before remediation, on anything that can break a user or a device.
Every control points at an artefact: a pipeline run, a scan report, a signed attestation.
Test device, pilot, ring, fleet. The pilot stays static until the build is proven end to end.
Findings map to a control ID. If a control has no real security value I will say so rather than build it.
An untested rollback is a hope. Every change ships with one that has actually been run.
Runbooks, architecture documents and decision logs, so the work survives the engagement ending.
Contact
Currently engaged, with next availability in December 2026, and happy to talk earlier about work starting then. Direct and agency enquiries both welcome. Outside IR35 preferred; inside IR35 considered at an uplifted rate. Rate on application.