The Full Story
Bangalore → Bahrain → Dubai → Sharjah → Oklahoma City
Where It Started
In 2000, I walked into the Indian Institute of Science in Bangalore as a research assistant. The project was in AI — natural language processing and cognitive computing. This was before AI was a buzzword. Before ChatGPT. Before anyone outside of research labs cared about machine learning. I didn't know it then, but that year shaped how I think about technology: not as something you read about, but something you build and test and break and rebuild.
A year later, I packed a bag and moved to Bahrain. No safety net. No contacts. Just an IT job at Alzayani Investments and the belief that if I could figure out AI research, I could figure out anything they threw at me. For six years I ran their IT — servers, networks, applications, strategy. It was there I learned that technology problems are almost always people problems in disguise. The server isn't the issue. The process around the server is the issue. Fix the people problem and the tech problem usually solves itself.
The Dubai Years
In 2007, I moved to Dubai. The next two years were different — I became a Product Manager at Emirads Digital, leading development for digital signage and wayfinding solutions. Not cybersecurity. Not GRC. Product development. Cross-functional teams. Agile before anyone called it Agile. I shipped things. It taught me something I carry into every security role: if you can't ship, your strategy is just a PowerPoint.
Then in 2009, cybersecurity found me. Dubai Bank needed someone who understood both technology and risk. I joined through Quadrant Risk Management, and for the first time, I was solving security problems full time. Risk assessments. SIEM implementations. Incident management. ISMS programs. The work was hands-on and the stakes were real — this was banking, and regulators didn't accept excuses.
When Quadrant was acquired by ISYX Technologies in 2013, I stayed through the transition and grew into a project lead. Over those years, I worked with 10+ clients across government, banking, and enterprise. Each one had different problems, different cultures, different levels of maturity. But here's what I learned as a consultant that I've never forgotten:
Every framework follows the same DNA. Scope it, assess the gaps, map controls, remediate, monitor, report, repeat. The names change. The domains shift. But the structure is the same. Once you've implemented a few end-to-end, any new framework is a matter of time, not capability.
I coached 5 organizations through ISO 27001 certification. 80% passed on the first attempt. Not because I was brilliant, but because I learned to listen before I prescribe.
Building Something From Nothing
In 2015, the Government of Sharjah called. They were forming a new digital department and needed someone to build their cybersecurity capability. Not manage it. Not advise on it. Build it. From zero.
I said yes.
What followed was the most defining chapter of my career. Over nine years — first as a Senior Consultant, then as Information Security Manager — I built an entire cybersecurity function for an emirate. Here's what "from zero" actually looked like:
Just me and two other people. No SOC. No SIEM. No incident response process. No policies worth enforcing. 180+ government entities, each doing their own thing. I ran the first-ever state-wide gap assessment against UAE IA, NIST, ISO, and CIS standards.
We started building. Hired specialists. Deployed a SIEM. Wrote the policies. Created incident response playbooks. Launched a 24/7 SOC with MSSP partnerships. Founded the state's first CERT. Delivered 12+ executive workshops to align the Executive Council on strategy.
The team grew from 3 to 22. We deployed Zero Trust architecture, PAM, EDR, BAS, SOAR. Launched secure cloud services — IaaS, hosting, 15,000+ mailboxes. Incident response times dropped 60%. Detection coverage expanded 40%. Zero audit failures. Every year. For eight years.
The numbers aren't the point. The point is: I took something that didn't exist and made it work. Not by being the smartest person in the room, but by listening, planning, hiring well, and refusing to build governance that gets in the way of people doing their jobs.
The Move That Changed Everything
In late 2024, I made the decision to move to the United States. Oklahoma City. Green Card in hand. New country, new market, new chapter.
The job market was — and is — brutal. I know that. Everyone knows that. I could have spent my time refreshing job boards and feeling frustrated. Instead, I asked myself a different question:
What would happen if I tried to build the security tools I spent my career wishing existed?
So I picked up Claude Code — an AI-assisted development tool — and started building. Over the next few weeks, I planned, designed, and built 3 production-ready applications from scratch. A full-stack GRC platform with AI-assisted risk scoring, multi-tenant architecture, compliance mapping across SOC 2, ISO 27001, HIPAA, and NIST CSF. I deployed everything to production. From the command line.
I'm not a developer. I'm a security professional who now understands — at a code level — how the tools I've spent 15 years evaluating actually work. That makes me better at everything else I do.
Building People, Not Just Programs
One thing I'm quietly proud of that doesn't show up in the metrics: every year, we brought in roughly 10 university interns. Students with no security experience, most of them unsure whether cybersecurity was even the right career path. I made it a personal priority to train them — not just assign them tasks, but actually teach them how security operations work, how governance frameworks connect to real-world risk, how to think about problems before jumping to solutions.
I paired them with senior team members, gave them real projects with real stakes, and made sure they understood the "why" behind everything, not just the "how." Some of them sat in the SOC and learned to read alerts. Some of them worked on compliance reviews and saw firsthand how policies translate into controls. Some of them joined penetration testing engagements and discovered they liked breaking things more than defending them.
Most of those interns have since gone on to build careers in cybersecurity — in security operations, governance, risk, consulting. A few have reached out years later to tell me that their time with us was what convinced them to choose this field. That means more to me than any dashboard or audit result. Because the programs I built will eventually be replaced. The tools I deployed will eventually be retired. But the people I trained are still out there, building security programs of their own. That compounds in ways that no KPI can measure.
Where I Am Now
I'm in Oklahoma City. I'm consulting. I'm building. I'm applying to roles across cybersecurity, GRC, project management, and operations. I'm open to leadership and I'm open to being an individual contributor. I've led teams of 22 and I've been the person doing the hands-on work — and I'm comfortable in either seat.
I'm not looking for a title. I'm looking for the right team and the right problem to solve.