About me

I build security programs from zero for tech and SaaS scaleups.

The trigger is usually the same: an enterprise customer or investor asks for ISO 27001 or a SOC 2 report, and there's no security program to show them. That's where I come in, as an interim or fractional CISO reporting to the CTO or Managing Director.

The track record: organizations taken from no security program to ISO 27001:2022 certification within 12 months, none with a major nonconformity, and SOC 2 Type II reports issued with no exceptions. The programs keep running after the audit, because I build the operating layer behind the policies: risk registers, vendor reviews, incident response exercises.

Why I work this way

I spent nearly two decades in the cybersecurity vendor world, at McAfee, Symantec, Trend Micro and Palo Alto Networks. Good companies, solid products. But I grew uncomfortable with how the industry sells: fear, lock-in, and tools small companies don't actually need. So in 2023 I founded BARE Consulting with a simple mission: help scaleups become measurably more resilient, without the fear-mongering or the security theater.

My journey started in Dublin, as an escalation engineer at Symantec while studying for a Master's in Management of Information Systems at Trinity College. That's where I learned that security isn't just a technical problem, it's an organizational one. It still shapes how I work: security should protect the business, not paralyze it.

I'm also a co-founder of securos, an alliance of European boutique cybersecurity and compliance firms, so clients who need more than one person get a team without the enterprise overhead.

Let's talk

Facing your first certification, a security questionnaire you can't answer, or NIS2 landing on your desk? Book a call or email me at paolo@bare-consult.com. You can also download my resume below.

Based in: The Netherlands, serving organizations across Europe.