information risk manager / group CISO 15+ years in IT & security

Momchil Tsekov

Момчил Цеков

handle: zero_trust

CISO vCISO Security Solution Designer Endpoint Security Specialist

+ IoT gadget enthusiast

Cybersecurity architect based in Plovdiv, Bulgaria, working remote and hybrid, now leading group-level information risk as a CISO. I turn NIS2, ISO/IEC 27001 and GDPR into one clear governance model that engineers can implement and leadership can actually read.

View experience Get in touch

whoami

momchil.tsekov (zero_trust) - CISO, vCISO, security solution designer

cat role.txt

One framework. One risk method. Five companies.

ls frameworks/

NIS2 ISO-27001 GDPR BG-Cybersecurity-Act

01 // about

About

I have worked in IT and cybersecurity since 2008, and endpoint security is the red thread through all of it: from AVG antivirus support, to endpoint threat operations at Hewlett-Packard, network and endpoint security engineering at Caretower, managed file transfer at Axway, and leading digital services and anti-malware & endpoint security at TELUS International - then IT and security architecture at DRONAMICS. Today I serve as Information Risk Manager and Group CISO for a diversified holding group, responsible for information security risk across its operating companies, and I take on vCISO engagements.

My focus is governance that works in practice: the group sets the rules, each company owns its procedures, and every risk decision is traceable. I write for two audiences at once - engineers who need precise baselines, and leadership who needs a plain-language picture of risk.

Off duty I am an IoT gadget enthusiast - which is how Vhod Pro and ESTI Helper happened: secure products, not only policies.

02 // version history

Experience

  1. v7.0 · current

    Information Risk Manager (Group CISO)

    Engaged for a diversified private holding group

    - present

    Group-level CISO for a holding group of five operating companies: one framework, one risk method, shared across the group.

    • Own the group cybersecurity risk programme across five companies, built on a single risk method.
    • Designed a five-level governance framework - from a group framework policy down to company-level procedures and records - so every local control traces back to a group rule.
    • Align the group with NIS2, the Bulgarian Cybersecurity Act, ISO/IEC 27001 and GDPR, and prepare the companies for NIS2 compliance and ISO 27001 certification.
    • Author group policies including cybersecurity, roles & responsibilities, incident response, cyber risk management and acceptable risk in the use of AI.
    • Drive group-wide security programmes: one endpoint protection (EDR) standard, 24/7 security monitoring (SOC) as a group programme, and vendor selection by structured comparison.
    • Govern IT/OT separation for industrial sites as a principle: industrial control environments never trust corporate identity.
    • Work with each company's CEO, CFO and IT manager, keeping risk decisions (CISO) separate from operations (IT).
    • NIS2
    • ISO/IEC 27001
    • GDPR
    • Bulgarian Cybersecurity Act

  2. v6.0

    Architect, IT & Cybersecurity (System Architect)

    DRONAMICS - drone cargo airline

    -

    • IT and security architecture for a fast-growing aviation and logistics scale-up.
    • Identity, endpoint, network and cloud security design.
    • Aligning IT with aviation-grade reliability.

  3. v5.0

    Digital Services Team Lead; Anti-Malware & Endpoint Security

    TELUS International

    -

    • Led a digital services team.
    • Anti-malware and endpoint security for enterprise customers.

  4. v4.0

    MFT (Managed File Transfer) Product Specialist

    Axway

    -

    • Secure B2B file exchange: product expertise on a managed file transfer (MFT) platform.

  5. v3.0

    Senior Network Security Engineer & Senior Endpoint Security Engineer

    Caretower

    -

    • Network and endpoint security solutions for customers.

  6. v2.0

    End-Point Threat Management Operations Specialist

    Hewlett-Packard

    -

    • Security incident and operations management following ITIL.
    • Monitoring of enterprise security solutions.

  7. v1.0 · init

    AVG Anti-Virus Technical Support

    Sixty K Ltd (60K)

    -

    • Where it started: antivirus technical support - the first line of endpoint security.

03 // side quests that shipped

Founder projects

Products I founded under ONZI EU (Onzi EU EOOD) - proof that I build secure products, not only policies: security by design and privacy by design, shipped.

  • founder · onzi eu

    flagship

    Vhod Pro (ВходПро)

    Walk up. The door unlocks.

    Smart remote and automatic access for building entrances and garage doors - the phone is the key. Built for residents, property managers, building companies and short-term-rental hosts. My most successful project so far.

    • A Bluetooth beacon per door and a small cellular controller - no Wi-Fi, and a non-destructive install alongside existing fobs.
    • Walk-up auto-unlock, Apple Watch support and remote opening from anywhere.
    • Many buildings in one app, a web management panel, and access revoked in seconds.
    • security by design
    • IoT
    • access control
    Visit Vhod Pro

  • founder · onzi eu

    ESTI Helper

    Stop retyping passports.

    Self check-in automation for Airbnb and Booking.com hosts in Bulgaria.

    • Guests self-register through a permanent link, in 12 languages, with on-device document scanning - photos never leave the phone.
    • Auto-generated CSV files for ESTI, the national tourism register.
    • Per-reservation, auto-expiring door codes via Nuki / TTLock, plus Vhod Pro building access.
    • Privacy by design: data auto-deleted after checkout and encrypted in transit.
    • privacy by design
    • GDPR
    • automation
    Visit ESTI Helper

04 // framework

Governance framework

A five-level model: the group sets the rules, each company adopts its own procedures.

  1. Group framework policy

    The single top-level document: scope, principles and authority for information security across the group.

  2. Roles & responsibilities

    Who decides and who operates - risk decisions with the CISO, operations with IT.

  3. 11 thematic group policies

    From cybersecurity, incident response and cyber risk management to acceptable risk in the use of AI.

  4. 12 group standards & technical baselines

    Measurable minimums that turn policy into something engineers can implement and verify.

  5. 17 company-level procedures & records

    Each company adopts and owns its procedures and evidence - traceable back up to the group rules.

DON'T PANIC

Parent child traceability: every company procedure maps to a group standard, policy and principle.

05 // skills

Competencies

  • Governance & compliance

    • Governance, risk & compliance
    • NIS2
    • ISO/IEC 27001
    • GDPR
    • Policy writing
    • Vendor risk
    • AI risk governance

  • Security architecture & operations

    • Security architecture
    • Network security
    • IT/OT security
    • Endpoint security (EDR)
    • Security operations (SOC) strategy
    • Incident response

  • Leadership & reporting

    • Risk programme ownership
    • Working with CEOs, CFOs & IT
    • Plain-language risk communication

06 // education

Education, certifications & languages

Network Technologies (Network Administration)

New Bulgarian University - coursework completed

Vendor certifications

vendor-level certifications

  • VMware
  • Check Point
  • Microsoft
  • AVG

Languages

Bulgarian - native English - professional

07 // off duty

Off duty

  • defcon

    DEF CON 32 · Las Vegas, Aug 2024 · attendee

  • aesthetic

    cyberpunk - hence the neon

  • hardware

    IoT gadget enthusiast - see Vhod Pro

  • handle

    zero_trust

ls -la ~/books

  • Hyperion - Dan Simmons Seven pilgrims and the Shrike - the threat nobody can predict.
  • The Fall of Hyperion - Dan Simmons Farcasters: remote access at galactic scale. Vhod Pro is the humble version.
  • Endymion - Dan Simmons A long journey, and proof that trust has to be earned.
  • The Rise of Endymion - Dan Simmons How the Cantos end - no spoilers in this window.
  • The Hitchhiker's Guide to the Galaxy - Douglas Adams Don't panic - still the best first line of any incident response plan.
  • Foundation - Isaac Asimov Psychohistory: risk forecasting, with better marketing.
  • Solaris - Stanisław Lem An ocean that mirrors what you bring to it - much like your logs.
  • The Martian - Andy Weir Work the problem. Then the next one. That is incident response.

08 // contact

Contact

Open to conversations about security leadership, governance and architecture.

Available for vCISO engagements.

Based in Plovdiv, Bulgaria - remote / hybrid