About Craig
Craig is a Fellow of the Chartered Institute of Information Security and a Chartered Cyber Security Professional, specialising in audit and assurance, and cyber security governance and risk management. He has spent more than two decades helping organisations understand their cyber risk, meet regulatory expectations and build lasting resilience.
He has held senior leadership roles at NCC Group, SureCloud and Bridewell, where he built and led advisory practices of up to 45 consultants and directed large-scale security improvement programmes. He is a recognised expert in payments security and PCI DSS, auditing and assurance, risk management and the Cyber Assessment Framework, and has worked extensively with regulators and UK Competent Authorities.
Craig combines board-level advisory experience with hands-on technical skill, including Python development and responsible AI engineering, to deliver assurance that is practical, defensible and focused on measurable outcomes. He also gives back to the profession through the UK Cyber Security Council, ISC2 and CIISec.
Areas of expertise
Experience highlights
- Directed risk assessment and remediation programmes across CNI, SCADA and ICS environments
- Audit leader with extensive demonstrable experience
- Led PCI DSS assessment and remediation for environments processing more than 400 million transactions a year
- Requested speaker and author of industry guidance on CAF implementation and payments security
- Supported the design, pilot and first official audit of the Civil Aviation Authority's ASSURE scheme
- Built and led consulting teams, with practice strategy and P&L responsibility
Professional certifications
Talk to Craig
Arrange a conversation about your security challenges.