Fourteen years of practice behind a brand that is new.

1. 01 / Building

   Built regulated medical imaging software as a developer.

   Regulated medical imaging software used in clinical settings — DICOM and its failure modes learned from implementing them, not from a specification summary.

2. 02 / National scale

   Delivered a national-scale medical imaging archive.

   A state-level DICOM archive, taken through national registration and state audit review — the level of scrutiny where an architectural shortcut becomes someone else’s problem for a decade. The same pattern was repeated afterwards in neighbouring national programmes; I worked on those too, as an employee of a different company and on a different cluster.

3. 03 / The turn

   A tier-one buyer’s security requirements created the role.

   A tier-one European enterprise buyer evaluated the product for a national deployment. Its requirements — per-product security reporting, security controls inside the delivery process — went beyond what the vendor could answer at the time. The response was to build a dedicated security engineering function.

4. 04 / Now

   Product security and secure delivery, from the vendor side.

   Release security documentation, dependency and CVE hygiene, internal security, and the security questions customers ask before they sign. Including coordinated vulnerability disclosure: intake from a major disclosure programme, triage, fix, release, and the customer questions that follow once a national authority publishes an advisory.

In 2023 a demanding buyer asked for security reporting per product and security controls inside the delivery process. That is close to what the Cyber Resilience Act begins requiring of manufacturers on 11 September 2026. The capability was built because a customer insisted, before the law did.