FOUAD MULLA
EN

AI. Cloud. Enterprise security.

Technical depth.Business judgment.

I lead enterprise security programmes and advise on AI and cloud risk, connecting business priorities, technical decisions, and operational execution.

15+ years of experience

Teams across 10 countries

Finance, telecoms and critical infrastructure, including operational technology.

Set direction. Follow through.

I’ve owned security programmes at global enterprise scale, managed security professionals, and led across teams and security operations. That responsibility shapes how I approach every security decision.

Start with business priorities. Make risk and trade-offs explicit. Set clear ownership, then give teams the direction and support to deliver. Security strategy has to work in day-to-day operations and under pressure.

CISSPCISMSecurityX

How I can help

For executive teams making security decisions through growth, change and regulatory scrutiny.

01

Security strategy

Set the priorities, investment choices and accountability for a security programme that supports the business.

Discuss security strategy
02

Security leadership advisory

Support security leaders and executive teams with independent advice, executive reporting and clear accountability across their security programmes.

Discuss security leadership
03

AI & cloud governance

Review governance, risk and compliance across AI adoption and cloud environments. Define decision rights, control priorities and the evidence needed for assurance.

Discuss AI & cloud GRC

From the people I’ve worked with

“His knowledge of cloud solutions and corporate architecture was a great contribution to the successful ending of the project.”

Tomáš SýkoraAdvisor in CSDM, CMDB and integrationExcerpt from a LinkedIn recommendation · June 2023

“Under pressure he stays clear about who decides what. During a major incident he gave us direction and room to work.”

Michael AndersenCISO, critical infrastructureShared with permission

Writing & technical review.

ISACA / 2024

Building Cybersecurity Resilience With the Power of Habit

How everyday habits shape a resilient security culture.

Read the article

Technical reviewer / 2023

Multi-Cloud Administration Guide

Author: Jeroen Mulder
BPB Publications

Technical review of a guide to managing multi-cloud environments, including security, access management and compliance.

View the book

Security strategy and practice.

Conference talks on AI risk, cloud architecture, and incident response, connecting technical choices with their consequences for the organisation.

Invite me to speak
Earlier talks · 2023

Talk titles are shown in their original published language.

Let’s discuss your security priorities.

Connect with me on enterprise security, AI and cloud risk, or leading security teams. For advisory work and speaking invitations, contact me directly.

Connect on LinkedIn

Your details are used to acknowledge and respond to your enquiry. Please leave out confidential information.

FOUAD MULLALET’S STAY IN TOUCH

Stay in touch.

Save my details to your phone or computer. No app or account needed.

Save my contact

Open the contact file, then confirm “Add contact” on your device.

Wallet cardsComing later

Apple Wallet and Google Wallet cards will be available in a future release.

Privacy

Browser security diagnostics record only the blocked resource category and policy directive in AWS for 30 days, without page URLs, form contents or IP addresses in those diagnostic records. Fouad Mulla uses the details you submit to acknowledge and respond to your enquiry. AWS hosts the site and delivers messages to a private inbox. Cloudflare Turnstile processes browser and connection information to prevent automated abuse when you use the form. AWS temporarily stores your message in an encrypted delivery queue. Messages are removed after processing; unsuccessful messages are kept for no more than seven days. Delivery metadata expires after 30 days and aggregate counts after 90 days; database deletion may take a few additional days. Message contents are not recorded in application logs or analytics. Pseudonymous abuse-prevention counters expire within two days and may take a few more days to be deleted. Correspondence is retained in the inbox as needed to handle the conversation. This site uses no advertising trackers or analytics cookies. Downloading the contact card does not send your details to us. External sites have their own privacy policies. For privacy questions or deletion requests, use this form or LinkedIn.

We use Plausible to measure page views, referral sources, approximate location, device types, selected languages and interactions such as contact-card downloads, link clicks and confirmed enquiries. We do not send your name, email address or message content to analytics. Plausible processes analytics in the EU without cookies or persistent identifiers, using a daily identifier derived from connection information; it does not store raw IP addresses. Reports show aggregate statistics.

Plausible: Privacy
Cloudflare: Privacy