Sanitas Bupa Group
I run the group’s cyber portfolio and the framework seven very different levels of maturity have to live with. My job is prioritisation and reporting into the CISO office, and then taking the same decisions to market security and IT leadership as a case they can fund.
PMO for a ~150-project portfolio delivered by five manager-led teams across seven markets. I own prioritisation, quarterly review and what gets funded, and present it to the group committees, the group CISO and security and IT in all seven markets.
Six security due diligences on acquisitions. Assessment under real time and information constraints, cost-to-remediate for the deal team, then integration into the group model after close.
Framework adoption across seven markets. I translated the group’s NIST CSF standards and metrics into a model each country could implement at its own level of maturity, and agreed it market by market.
Buyer side: evaluated security tools, took part in RFPs and managed vendors.
Built my own reporting tooling with agentic AI: portfolio dashboards across seven markets of data, instead of waiting on a BI backlog. Plus the programme to secure internet-facing assets, and post-incident governance: root cause, remediation plan and the funding case behind it.
