I ran security at Ingram, not as a side task, as the actual job. Wrote the guidelines everyone got onboarded with, picked NIST CSF + Belgium’s CCB Cyfun as the practical starting point instead of jumping straight to ISO 27001, and built the asset inventory and controls we’d need to go for certification later. Gave an internal presentation on cloud security to the team.
On the hands-on side: pentesting our own product (AI-assisted recon, manual follow-up — the tool paid off, results were good), setting up SSO/MFA with the dev team, picking vulnerability scanning and supply chain tooling, reviewing AI-generated (“vibe coded”) code for security issues before it shipped, and mentoring our security intern.